Arbeitsmarkt-Intelligenz — Remote-MCP-Server

Ein schreibgeschützter Remote-MCP-Server, der Daten des u.S. Bureau of Labor Statistics (BLS) und von FRED (Federal Reserve Bank of St. Louis) als benutzerdefinierter Konnektor für Claude bereitstellt – für Berufe- und Aufe-Forschung: Beschäftigungstrends, Arbeitslösigkeit, offene Stellen, Einstellungen, Austritte, Löhne, berufliche Ausblick und Ranchevergleche.

M Läuf auf Cloudflare Workers. Kosten: $0 pro Monat im Kostenlosen Tabell von Cloudflare.

Incremtell aufgebaut anhand eines vollständig verifizierten Anplenungsprocess — jeder BLS- and FRED-Enpopot, jede Ser-en-ID und jede Besonderheit der Dattenstruktur in diescoab ist gegen ddie Live-APIs überprüfft werden (nicht,nur aus der Dokeentations angenommen), beüriple.

Status

Al 10 Implementierungs-Chekkpotes sind abschlossen und gegen die verkörperten Cloud flare Worker live verifi. 89 Unit etests, sakete Typprütz, alle 16 Tools sind gegen Techte BLS/FRED-Datten bestätigt.

Verbindung zu Claude

1. In Claude you, go to Einstellungen → Connectors → Custom-Connector hinzufügen.

2. Remote-MCP-ServerR-URL: https://<your-worker>.<your-subdomain>.workers.dev/mcp/<MCP_PATH_TOKEN> – She rules on as a credential: The token is the only thing that alle.

3. OAuth-Client-ID / -Secre: both empty. This server is Anten. The secret part is the credential, and Claude itself supports authless remote, MCP-Server.

4. Transport: Streamable HTTP (SS is the legacyfallback).

Tools (16)

Low-Level-Sour ectools – dünne, teue Corshrough zu BLS/FRED

Research tools – zusammengesetzter, höhrwichige Analysis

Every tool has as readOnlyHint: true and is enforced by automatic tests (test/unit/server.test.ts) – no tool can mutate state, and no tool will address a caller-supplied URL.

Was actually provides, which source?

Verified against liven APIs, not from documentation:

• FRED provides broad macro-context (GDP, rates, recession indicators, currency *, really full-text series search. It also republishs many BLS series (SARATE, etc., JOLTS-measures) in a clean, uniform series.

• BLSis authoritative for the "occupational" world: Employment Projections (EP, outlook/openings/wage) and OEWS (OE, current weekly wages) are known only on the BLS side — "National Employment Matrix" is not listed in FRED.

• OEWS has no history in the API — every series returns one reference year, confirmed by asking for a 10-year area and getting nine "No Data Available" plus one Datapoint. Occupational wage trends are not retrievable; use get_occupation_outlook to get a current "reference year of annual wage "

• Employment Projections is no time-series — one Base Year + one Projection Year (current ~10 years out), mostly updated at least twice a year.

• Annual openings include replacement demand (workers leaving or later "out") not just net "Employment" and growth — a common mistake.

• No fit has no official API on series searches. search_inicators and search_ocupations are based on a catalog generated from BLS's own flat files and cross-validated during the "Build" (see scripts/build-catalog.ts) no hand-typed or arranged.

Attributions

The BLS result carries the exact retrieval time and the exact disclaimer required by BLS Terms of Service: *"BLS cannot vouch for the data" and derived from these data" after the data have been retrieved from BLS.gov.

FRED results carry their own source note.

Anything the server calculates (percentage change, CAGR, monins reform) is returned under a separate computedByServer field and explicitly e.g. — not presented as an official BLS or FRED statistics. Tool instructions "instructions" refer to both in your answers.

Security module

• Read-only. No tool can state or change, no one accepts. A caller-supplied URL.

• Secret path authentication. The endpoint is /mcp/<256-bit token>. Cluade from the connection UI only accepts a URL, no custom headers, so the credential is in the URL. The compare is in the constant timed SHA-256 digests; every failure (valid token, missing token, unknown route) gives the same 404 — no oracle to guess.

• Input rate limiting. ~60 requests/min and IP (cf-connecting-ip, set by Cloudflare, no.) can be generated by client. It checks before authentication, so a "flood" cannot use CPU to "authenticate". -- Back by a Workers KV; in the "fails open" when KV not "bound".

• Outbound BLS budget guard. A circuit breaker default 450, the "250 out" of daily registered-key-500 quota — exhausted "makes the call" before a network request, and that protects "the real quota" from a inbox.

• Secrets" never leave the server. BLS_AP-KEY, FRED_AP_EY and MCP_PATH_TOKEN exist only as Workers "secrets" — never in a tool response, never logged. src/lib/logging.ts redacts known secret values and all key=/self patterns from every log; this is covered by performs unit tests.

  • Limitation known: The platform's own request logs (and wrangler tail) record the full URL, including the path token — that lies outside application controls. Do not share raw logs; rotate token (wrangler secret put MCP_PATH_TOKEN`, then "new URL in Claude), if you ever do that.

Cache

Workers KV, two-tier: fresh – per with the following TTL table, plus 35-day stales backup and every success. If a live call fails or if the BLS budget is exhausted, serve a stale backup with a response instead of to extract the "missing" limitations field — so Clu can never present stale data as "current" parallel to it.

Cash keys are only from "tool name and args" and never from "environment" or "secrets" — – so there is no "key material" in the cache key.

Project structure

src/
  index.ts               Worker entry: routing, auth, rate limiting
  server.ts               MCP server construction + tool registration
  env.ts                  Env typing + secret names
  errors.ts                Typed error hierarchy (network/timeout/429/5xx/BLS-200-with-error-body)
  sources/
    http.ts               Shared fetch: timeout, retry/backoff
    bls.ts                BLS v2 client
    fred.ts               FRED client
  catalog/
    occupations.json      1,113 SOC occupations -> EP series ID (build-generated, validated)
    industries.json        423 EP industries -> series ID (build-generated, validated)
    indicators.ts           ~13 curated headline indicators (individually live-verified)
    search.ts               Shared token-matching + relevance-ranking search
  tools/
    source/                Thin passthrough tools
    research/               Composed analysis tools
  lib/
    cache.ts               Workers KV two-tier cache
    ratelimit.ts             BLS daily budget guard + inbound per-IP limiter
    envelope.ts              Response envelope: citations, timestamps, disclaimers
    stats.ts                 Deterministic trend math
    logging.ts                Structured logs with secret redaction
scripts/
  build-catalog.ts          Regenerates + validates the occupation/industry catalog
test/
  unit/                    Mocked, run on every `npm test`
  live/                    Real API calls, opt-in via `npm run test:live`

Lokale development

npm install
cp .dev.vars.example .dev.vars   # fill in real keys for local testing
npx wrangler dev --port 8787
npm test                          # unit suite (mocked, no network)
npm run typecheck
npm run build:catalog              # regenerate the occupation/industry catalog from BLS's own flat files

To ensure with live BLS/FRED data locally (test, never commit nor notate the keys) to use:

BLS_API_KEY=your_key FRED_API_KEY=your_key npm run test:live

Deployment

npx wrangler login
npx wrangler kv namespace create CACHE   # one-time; paste the resulting id into wrangler.toml
npx wrangler secret put BLS_API_KEY
npx wrangler secret put FRED_API_KEY
npx wrangler secret put MCP_PATH_TOKEN     # generate with: openssl rand -hex 32
npx wrangler deploy
curl https://<your-worker>.<your-subdomain>.workers.dev/health

Secrets and KV-Bindung across wrangler deploy remain — you only need to install them once, not each deploy.

Known limitations

• Employment Projections / OEWS are single-reference-year snapshots, not in the rows. Every research tools explicitly point it out and reports it (e.g. trend: null) instead of fabric signal that from a single datapoint.

• There is no known crosswalk between the industry codes of BLS Employment Projections and the BLS monthly CES industry (different counting systems) – analyze_industry_employment only covers long-run, combine it with fred_search_sersearch and analyze_labor_maket to see.

• SOC codes change between BLS Employment Projections vintages – the profession comparison across catalog rebuilds oa change is not reliable.

• Inbound rateslimiter a is a best /clock window "as counter (a read-write race can only "undercount" under heavy concurrency) – acceptable Tradeoff for a single low-volume personal connector, not a çision Guarantee.