Atlas / MCP servers / r-huijts / NS Travel Information

NS Travel InformationSAFE

Name: NS Travel Information
Author: r-huijts

mcp/r-huijts/ns-travel-information

MCP server by r-huijts · Audited 2026-10-08

A Model Context Protocol (MCP) server that provides access to NS (Dutch Railways) travel information through Claude AI. This server enables Claude to fetch real-time train travel information and disruptions using the official Dutch NS API.

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

6 6r · 0w · 0d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://mseep.ai/app/r-huijts-ns-mcp-server)

[](https://smithery.ai/server/ns-server) [](https://www.npmjs.com/package/ns-mcp-server)

Transform your AI assistant into a Dutch railways expert! This MCP server connects Claude to real-time NS (Nederlandse Spoorwegen) travel information, making it your perfect companion for navigating the Netherlands by train.

Installation

You can install this server in three ways:

1. Using Claude Desktop with NPM Package

Update your Claude configuration file (~/Library/Application Support/Claude/claude_desktop_config.json):

{
"mcpServers": {
"ns-server": {
"command": "npx",
"args": [
"-y",
"ns-mcp-server"
],
"env": {
"NS_API_KEY": "your_api_key_here"
}
}
}
}

You can get an API key from NS API Portal

2. Using Smithery

To install NS Travel Information Server automatically via Smithery:

npx -y @smithery/cli install ns-server --client claude

3. From Source

Clone this repository
Install dependencies:

npm install

Copy the example environment file:

cp .env.example .env

Add your NS API key to the .env file:

NS_API_KEY=your_api_key_here

Then update your Claude configuration file:

{
"mcpServers": {
"ns-server": {
"command": "node",
"args": [
"/path/to/ns-serve

Read from source at commit 79508577b302OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add ns-mcp-server --env NS_API_KEY=${NS_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "ns-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "NS_API_KEY": "${NS_API_KEY}"
      }
    }
  }
}

Exposed tools (6)

6 read · 0 write · 0 destructive.

Tool	Risk	Description
`get_arrivals`	read	Get real-time arrival information for trains at a specific station, including platform numbers, delays, origin stations, and any relevant travel notes. Returns a list of upcoming arrivals with timing, origin, and status information.
`get_current_time_in_rfc3339`	read	Get the current server time (Europe/Amsterdam timezone) in RFC3339 format. This can be used as input for other tools that require date-time parameters.
`get_departures`	read	Get real-time departure information for trains from a specific station, including platform numbers, delays, route details, and any relevant travel notes. Returns a list of upcoming departures with timing, destination, and status information.
`get_ovfiets`	read	Get OV-fiets availability at a train station
`get_prices`	read	Get price information for domestic train journeys, including different travel classes, ticket types, and discounts. Returns detailed pricing information with conditions and validity.
`get_station_info`	read	Get detailed information about a train station

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (1 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (1)

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@modelcontextprotocol/sdk, dotenv, axios, typescript, @types/dotenv, @types/node

Why it matters. 6 dependency range(s) float

Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha 79508577b302full audit observations/trust-audit/mcp-server/r-huijts__ns-travel-information.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-08	`79508577b302`	SAFE	B	89	first audit

Questions

What is the NS Travel Information MCP server?

What tools does NS Travel Information expose?

6 in total: 6 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is NS Travel Information safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does NS Travel Information need?

It reads NS_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does NS Travel Information run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as ns-mcp-server at 0.1.6.

How current is this page?

The grade is for one exact copy of the source (79508577b302), read on 2026-10-08. The repository is watched and re-audited when it changes.

Source	r-huijts/ns-mcp-server
npm	`ns-mcp-server@0.1.6`
Transports	stdio
Credentials it reads	`NS_API_KEY`
License	MIT
Activity	pushed 408d ago