Atlas / MCP servers / mavrovde / viafrei-mcp

viafrei-mcpSAFE

Name: viafrei-mcp
Author: mavrovde

mcp/mavrovde/viafrei-mcp

MCP server by mavrovde · ai agents · autobahn · claude · Audited 2026-10-11

Live German traffic, rail, parking, EV charging, fuel, address and weather data in any AI assistant or agent, no API key, no sign-up. Streamable HTTP: https://mcp.viafrei.de/mcp, legacy HTTP+SSE: https://mcp.viafrei.de/sse. This repo is the stdio bridge for clients that speak neither.

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

13 12r · 1w · 0d

Transport

sse · stdio · streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://smithery.ai/servers/viafrei/viafrei) [](https://www.npmjs.com/package/viafrei) [](https://glama.ai/mcp/servers/mavrovde/viafrei-mcp)

Germany's traffic, trains, charging and roads — in your AI assistant.

Ask in plain words. Get the live answer, with its source.

[](https://viafrei.de/en) [](https://nodejs.org) [](LICENSE) [](#-connect-in-one-minute) [](https://modelcontextprotocol.io)

[viafrei.de](https://viafrei.de/en) · Connect your assistant · For developers · For businesses · All tools · API reference

claude mcp add --transport http viafrei https://mcp.viafrei.de/mcp

Free. No account, no API key, no sign-up. One line and your assistant knows whether the A8 is jammed, whether your train is late, where the nearest Type 2 charger is (and whether it is free, where the operator publishes that) and whether the lift at your station works — from official German open data, live, with the source named in every answer.

Beta. ViaFrei is being stabilised: sources are still being added, and answers and coverage can change. The answers are written by an AI assistant from our data, and AI can make mistakes, so check anything important (a closure, a departure, a price) against the source each answer names.

**New i

Read from source at commit dd99609bd67dOBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add viafrei --env GH_TOKEN=${GH_TOKEN} --env VF_EXTRA_TOKEN_HASHES=${VF_EXTRA_TOKEN_HASHES} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "viafrei": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GH_TOKEN": "${GH_TOKEN}",
        "VF_EXTRA_TOKEN_HASHES": "${VF_EXTRA_TOKEN_HASHES}"
      }
    }
  }
}

Exposed tools (13)

12 read · 1 write · 0 destructive.

Tool	Risk	Description
`a_tool`	read	Does A.
`b_tool`	read	Does B.
`brand_new_tool`	read	Does a new thing.
`c_tool`	read	C.
`check_something_new`	read	a tool the snapshot gained
`find_fuel_nearby`	read	fuel prices from Tankerkönig / MTS-K
`find_fuel_price_history`	read	a second-generation fuel tool
`find_something_new`	read	a tool the server gained
`stub_ask_client_for_roots`	write	Send a roots/list request back to the client and report the answer.
`stub_echo`	read	Echo a word back, with a structured result and an attribution line.
`stub_emit_notification`	read	Emit a logging notification on the standalone event stream.
`stub_observed`	read	Report what the stub has seen arrive from the client.
`stub_with_progress`	read	Report progress twice before answering.

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (5 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (11)

LOWInventory / provenance · inv.hidden_file · CWE-1104

.sonarcloud.properties

.sonarcloud.properties

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/version.ts:8

for (const relative of ['../package.json', '../../package.json']) {

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

test/cli-basics.test.ts:9

const manifest = JSON.parse(readFileSync(fileURLToPath(new URL('../../package.json', import.meta.url)), 'utf8')) as {

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

test/helpers.ts:5

export const CLI_PATH = fileURLToPath(new URL('../../dist/cli.js', import.meta.url));