chrischall-hemnetSAFE
Hemnet.se real estate for Claude: search, sold prices, listings & market stats
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/chrischall/hemnet-mcp/actions/workflows/ci.yml) [](https://www.npmjs.com/package/hemnet-mcp) [](LICENSE)
An MCP server for [hemnet.se](https://www.hemnet.se), Sweden's largest real-estate portal. Search for-sale listings, look up sold prices (slutpriser), pull full listing detail and photos, compute market statistics, resolve addresses, and run a Swedish mortgage calculation — all from Claude.
⚠️ This project is built and maintained by AI (Claude). It reads hemnet.se through its public GraphQL API. Use at your own discretion and within hemnet.se's terms of service.
Highlights
- No configuration. Hemnet serves its read queries anonymously — no
login, no API key. npx hemnet-mcp just works (a browser extension is only needed if Hemnet serves a Cloudflare challenge — see below).
- Sold prices (slutpriser). Hemnet's signature dataset: achieved
final price, asking price, and over/under-asking percentage — the comps an agent needs to value a home.
- Swedish-native. Money in SEK, areas in m2, rooms,
bostadsrätt
fees (avgift), energy class, and a mortgage model that follows Swedish rules (amorteringskrav, ränteavdrag).
- Embeddable. Ships as a standalone MCP server and as a library so
it can be composed into a larger multi-portal server.
Install
Claude Code / Claude Desktop (npx)
{
"mcpServers": {
"hemnet": {
"command": "npx",
"args": ["-y", "hemnet-mcp"]
}
}
}If Hemnet serves a Cloudflare challenge
Hemnet sometimes fronts its GraphQL API with a Cloudflare bot challenge. When that happens the server switches (under the default HEMNET_TRANSPORT=auto) to a browser bridge that sends the same anonymous queries from a `ww
3a99d5c9b883OBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add hemnet-mcp -- npx -y [email protected]
Exposed tools (10)
10 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
hemnet_autocomplete_location | read | |
hemnet_calculate_mortgage | read | |
hemnet_compare_listings | read | |
hemnet_get_by_address | read | |
hemnet_get_listing | read | |
hemnet_get_listing_photos | read | |
hemnet_get_market_stats | read | |
hemnet_get_sold_listing | read | |
hemnet_search_listings | read | |
hemnet_search_sold | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (11)
.mcpbignore
.release-please-manifest.json
AGENTS.md
import { registerAutocompleteTools } from '../../src/tools/autocomplete.js';import { HemnetClient } from '../../src/client.js';import { registerByAddressTools } from '../../src/tools/by-address.js';import { HemnetClient } from '../../src/client.js';import { registerCompareTools } from '../../src/tools/compare.js';@chrischall/mcp-utils, @chrischall/realty-core, @fetchproxy/server, @modelcontextprotocol/server, zod, @modelcontextprotocol/client, @types/node, @vitest/coverage-v8
* keep credentials and report edge_blocked on CDN/WAF blocks (mcp-utils 2.10.0) ([#125](https://github.com/chrischall/hemnet-mcp/issues/125)) ([41442c2](https://github.com/chrischall/hemnet-mcp/commit
* report CDN/WAF blocks as edge_blocked, not a rejected credential (mcp-utils 2.9.0) ([#122](https://github.com/chrischall/hemnet-mcp/issues/122)) ([cf7fd54](https://github.com/chrischall/hemnet-mcp/c
Gates applied: no_behavioural_pass.
3a99d5c9b883full audit observations/trust-audit/mcp-server/chrischall__hemnet-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | 3a99d5c9b883 | SAFE | B | 89 | first audit |
Questions
What is the chrischall-hemnet MCP server?
Hemnet.se real estate for Claude: search, sold prices, listings & market stats
What tools does chrischall-hemnet expose?
10 in total: 10 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is chrischall-hemnet safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does chrischall-hemnet need?
No credential environment variables were found in its source, so it appears to need none.
How does chrischall-hemnet run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as hemnet-mcp at 1.1.11.
How current is this page?
The grade is for one exact copy of the source (3a99d5c9b883), read on 2026-10-14. The repository is watched and re-audited when it changes.