mcp-mobility-databaseSAFE
MobilityData's open catalogue of public-transport feeds — ~4,500 GTFS schedule feeds and ~1,900 realtime feeds worldwide, each with the operator's own download URL.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The open catalogue of public-transport data feeds maintained by MobilityData — ~4,500 GTFS Schedule feeds and ~1,900 GTFS-Realtime feeds across ~70 countries, each with the operator's own download URL, licence and bounding box. The successor to TransitFeeds.
Part of Pipeworx — an MCP gateway connecting AI agents to 1683+ live data sources.
Tools
mobilitydb_search_feeds(query?, country?, municipality?, provider?, data_type?, include_inactive?, limit?)
— find the transit feed for an agency, city or country.
mobilitydb_gtfs_rt_feeds(country?, query?, entity_type?, group_by_agency?, limit?)
— realtime feeds (vehicle positions / trip updates / service alerts) with the schedule feed each is keyed against.
mobilitydb_feed(feed_id)— everything the catalogue records about one feed,
plus its sibling realtime streams and any superseding entry.
Auth
Keyless.
MobilityData also runs an authenticated REST API at api.mobilitydatabase.org, which takes a bearer token minted from a refresh token issued on free signup at . This pack deliberately does not use it and declares no platform key: the catalogue export carries the same feed inventory with no credential, and declaring a key env var the gateway does not hold un-sinks routing toward a tool that could only refuse. What the authenticated API would add is per-version dataset history and MobilityData's own validation reports; if that is wanted, PLATFORM_MOBILITYDB_TOKEN and the code that uses it land together in one change.
Data sources
- — the catalogue export
(~6,475 rows including superseded entries).
Traps, verified live 2026-09-17
- It is real CSV, not line-splittable. Feed names and notes contain commas,
quotes, CJK text and nested parentheses — "TC_大有巴士(公總) (Dayou bus (public bus))". Splitting on , puts an operator's contac
e0f1026d850fOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-mobility-database -- npx -y @pipeworx/[email protected]
{
"mcpServers": {
"mcp-mobility-database": {
"command": "npx",
"args": [
"-y",
"@pipeworx/[email protected]"
]
}
}
}Exposed tools (2)
1 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
mobilitydb_feed | read | Everything the Mobility Database records about one transit feed, by its catalogue id (e.g. mdb-1210, or a jbda-* id). Returns the operator |
mobilitydb_search_feeds | write | Find the public-transport schedule feed (GTFS) for an agency, city or country from the Mobility Database, MobilityData |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
@modelcontextprotocol/sdk, tsx, typescript, @cloudflare/workers-types
Gates applied: no_behavioural_pass.
e0f1026d850ffull audit observations/trust-audit/mcp-server/pipeworx-io__mcp-mobility-database.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | e0f1026d850f | SAFE | B | 89 | first audit |
Questions
What is the mcp-mobility-database MCP server?
MobilityData's open catalogue of public-transport feeds — ~4,500 GTFS schedule feeds and ~1,900 realtime feeds worldwide, each with the operator's own download URL.
What tools does mcp-mobility-database expose?
2 in total: 1 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-mobility-database safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does mcp-mobility-database need?
No credential environment variables were found in its source, so it appears to need none.
How does mcp-mobility-database run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @pipeworx/mcp-mobility-database at 0.1.1.
How current is this page?
The grade is for one exact copy of the source (e0f1026d850f), read on 2026-10-11. The repository is watched and re-audited when it changes.