commutescoutBLOCK
Live road conditions across 37 US states: map, route planner, toll pricing, and AI assistant - plus an MCP server so any assistant gets incidents, closures, chain controls, cameras, and wildfires.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
CommuteScout Live road conditions across 37 states: a map, a route planner, and an AI assistant.Also an MCP server, so your assistant can use it too.
[](https://github.com/nicglazkov/commutescout/actions/workflows/ci.yml) [](https://github.com/nicglazkov/commutescout/releases) [](EVALS.md) [](LICENSE)
Open the app · Add to Claude · Coverage · Running it yourself · Data · MCP tools · Architecture
No install, no account: commutescout.com
<img src="docs/demo.gif" width="880" alt="Demo: autocompleting San Jose and South Lake Tahoe, planning the drive and getting three route options that each say what is on them, switching between them, then tapping a suggested question and reading an answer built from the incidents, closures, cameras and signs along the way">
CommuteScout reads 53 official agency feeds (CHP dispatch, state DOT closures and incidents, chain controls, cameras, message signs, wildfire perimeters, road weather, toll prices) and turns them into one live picture of the road. Look at the map, plan a route and see what is actually on it, or
c5a7abf245d1OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add site --env BAY511_API_KEY=${BAY511_API_KEY} --env CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN} --env COTRIP_API_KEY=${COTRIP_API_KEY} --env FIREBASE_API_KEY=${FIREBASE_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"site": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"BAY511_API_KEY": "${BAY511_API_KEY}",
"CLOUDFLARE_API_TOKEN": "${CLOUDFLARE_API_TOKEN}",
"COTRIP_API_KEY": "${COTRIP_API_KEY}",
"FIREBASE_API_KEY": "${FIREBASE_API_KEY}"
}
}
}
}Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (17 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/us-states" > us-states.json
curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/map-states-py" > map_states.py
tok() { curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" | python3 -c 'import sys,json;print(json.load(sys.stdin)["accecurl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/us-states" > us-states.json
curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/map-states-py" > map_states.py
beacon('example_click');beacon('tell_more');function beacon(event, extra) {if not base.startswith("https://") and not base.startswith("http://127.0.0.1") \cc_d01.xml.gz
cc_d02.xml.gz
cc_d03.xml.gz
cc_d04.xml.gz
cc_d05.xml.gz
.envrc
.gcloudignore
return hashlib.sha1(raw.encode()).hexdigest()[:20]
key = hashlib.sha1(raw.encode()).hexdigest()[:20]
return hashlib.md5(
return "st:" + hashlib.sha1(raw.encode()).hexdigest()[:16]
for bad in ("../../etc", "a/b", "..", "x" * 200):src="https://static.cloudflareinsights.com/beacon.min.js"
data-cf-beacon={'{"token": "d2d77aff6dfe4462b09ca501c9151de4"}'}python -m ca_roads.flare check http://127.0.0.1:8300
<Block text={"git clone https://github.com/nicglazkov/commutescout\ncd commutescout/examples/flare-plugin\npip install starlette uvicorn && python server.py\npython -m ca_roads.flare check http://127.Gates applied: no_behavioural_pass.
c5a7abf245d1full audit observations/trust-audit/mcp-server/nicglazkov__commutescout.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | c5a7abf245d1 | BLOCK | D | 69 | first audit |
Questions
What is the commutescout MCP server?
Live road conditions across 37 US states: map, route planner, toll pricing, and AI assistant - plus an MCP server so any assistant gets incidents, closures, chain controls, cameras, and wildfires.
Is commutescout safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does commutescout need?
It reads BAY511_API_KEY, CLOUDFLARE_API_TOKEN, COTRIP_API_KEY, FIREBASE_API_KEY, FLARE_TOKEN, NVROADS_API_KEY, OHGO_API_KEY, RESEND_API_KEY, SMARTERROADS_PASS, STADIA_API_KEY, STATICMAP_SIGNING_KEY and TOMTOM_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does commutescout run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as site at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (c5a7abf245d1), read on 2026-10-11. The repository is watched and re-audited when it changes.