.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/transitland-mcp-server</h1> <p><b>Global transit data via the Transitland v2 registry — operators, GTFS/GTFS-RT/GBFS feeds with license terms, routes, stops, and real-time-aware departures via MCP. STDIO or Streamable HTTP.</b> <div>6 Tools • 2 Resources</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
Six tools mirroring the Transitland resource hierarchy — operators → feeds → routes → stops → departures:
| Tool | Description |
|---|---|
transitland_find_operators | Find transit operators/agencies by name, point/radius, bounding box, country/region, or Onestop ID. The entry point for "what transit runs here?" |
transitland_get_operator | Fetch the full operator record by Onestop ID — agencies, places served, published feeds, and source tags (Wikidata QID, US NTD ID, social handles) |
transitland_find_feeds | Discover GTFS, GTFS-Realtime, and GBFS feeds — fetch URLs, license terms, and last-fetch freshness. Where to legally get a place's open transit data, and on what terms |
transitland_find_routes | Find routes by point/radius, bounding box, operator, Onestop ID, or GTFS mode. Returns name, mode, brand color, and operating agency |
transitland_find_stops | Find stops/stations by point/radius, bounding box, Onestop ID, or operator network. Returns coordinates, location type, accessibility, and timezone |
transitland_get_departures | Departures from a stop, each flagged realtime true/false — live GTFS-Realtime predictions distinguished from static schedule, per departure |
Transitland does not geocode place names. Turn a city or address into coordinates with a geocoding MCP server (e.g. openstreetmap-mcp-server's openstreetmap_geocode) first, then pass lat/lon or a bbox. Geocoding is intentionally not built in — this server resolves coordinates to transit, not names to coordinates.
transitland_find_operatorsFind operators near a place or by name — the entry point that resolves a location to the agencies serving it.
search (operator/agency name), lat+lon+radius, bbox, onestop_id, or adm0_name/adm1_name (country/region)GTFS_RT entry signals real-time departures may be available), and its Wikidata QID for cross-referencingafter cursor; enrichment.totalCount and a truncation notice report capped resultstransitland_get_operatorFetch the complete operator record when you already hold an ID — no search round-trip.
o-9q9-bart) or an internal integer IDtransitland://operator/{onestop_id} resourcetransitland_find_feedsThe open-data catalog — where to get a place's transit data and whether you may redistribute it.
operator_onestop_id (from transitland_find_operators) to list exactly the feeds an operator publishes — the reliable path to a specific agency's feedsspec (gtfs, gtfs-rt, gbfs, mds), search, or fetch_error (data-quality auditing)yes/no/unknown (never inferred from a blank registry field), plus SPDX identifier and attribution text where knownauthorizationRequired flags feeds whose download needs a separate key/registrationtransitland_find_routesFind scheduled (GTFS static) route definitions by geography, operator, or mode.
lat+lon+radius, bbox, operator_onestop_id, onestop_id, route_type (GTFS mode), or searchroute_type mapped to a human-readable mode (bus, subway, rail, ferry, tram, …), brand color, the operating agency's Onestop ID, and the source feed's Onestop IDafter cursortransitland_find_stopsLocate stops and stations — the step before departures.
lat+lon+radius, bbox, onestop_id, or served_by_onestop_ids (operator/route network)location_type with a label (stop, station, entrance, node, boarding area), wheelchair accessibility, timezone, and the parent station's Onestop ID for child platformslocation_type 0) — a station may return none; use its child platformstransitland_get_departurestransitland_get_departuresDepartures from a stop, with the live-vs-scheduled distinction made structural.
transitland_find_stops firstrealtime flag — true for a live GTFS-Realtime prediction, false for a static scheduled time — plus a scheduleRelationship (STATIC, SCHEDULED, ADDED, CANCELED, UNSCHEDULED, DUPLICATED) so a timetable entry is never mistaken for a live arrival and cancellations are visiblerealtimeAvailable reports whether the stop's feed publishes GTFS-RT at allnext_seconds (up to 24h) or set use_service_window: true when a stop returns nothing — some feeds only expose times inside their declared service window| Type | Name | Description |
|---|---|---|
| Resource | transitland://operator/{onestop_id} | Operator record by Onestop ID — agencies, places served, published feeds, and source tags. Mirrors transitland_get_operator. |
| Resource | transitland://feed/{onestop_id} | Feed record by Onestop ID — spec, fetch URL, license terms, and latest-fetch freshness. The open-data catalog entry for one feed. |
All resource data is also reachable via tools (transitland_get_operator, transitland_find_feeds), so tool-only clients lose nothing. Stops and routes have no resource — they're discovered in bulk by geography, not referenced by a single stable URI. No prompts: the domain is operational data lookup, with workflow guidance carried in the tool descriptions (geocode-first, operator-then-feeds, stop-then-departures).
Built on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1Transitland-specific:
o-/f-/r-/s-) are the identifier spine — surfaced in every result, accepted on input alongside internal integer IDsAgent-friendly output:
realtime boolean and scheduleRelationship, plus a top-level realtimeAvailable, so an agent branches on data, never on parsing a timestampunknown/null and are never inferred as permissive; the schema descriptions tell agents to confirm against the license URL before redistributingmeta.next URL embeds the API key in plaintext; the service discards it and surfaces only the opaque integer after cursor, so the key never reaches tool output or logsAdd the following to your MCP client configuration file. A Transitland API key is required — see Prerequisites for how to get one.
{
"mcpServers": {
"transitland-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/transitland-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"TRANSITLAND_API_KEY": "your-api-key"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"transitland-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/transitland-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"TRANSITLAND_API_KEY": "your-api-key"
}
}
}
}Or with Docker:
{
"mcpServers": {
"transitland-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"-e", "TRANSITLAND_API_KEY=your-api-key",
"ghcr.io/cyanheads/transitland-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 TRANSITLAND_API_KEY=your-api-key bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/transitland-mcp-server.gitcd transitland-mcp-serverbun installcp .env.example .env
# edit .env and set TRANSITLAND_API_KEYAll configuration is validated at startup via Zod schemas in src/config/server-config.ts. A missing TRANSITLAND_API_KEY fails at startup with a banner naming the variable, not at the first tool call.
| Variable | Description | Default |
|---|---|---|
TRANSITLAND_API_KEY | Required. Transitland v2 API key, sent as the apikey query parameter. | — |
TRANSITLAND_BASE_URL | Transitland REST API base URL. Override to pin a specific deployment or a self-hosted instance. | https://transit.land/api/v2/rest |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for the HTTP server. | 3010 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path where the MCP server is mounted. | /mcp |
MCP_AUTH_MODE | Authentication mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (debug, info, notice, warning, error). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1. | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security, changelog sync
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t transitland-mcp-server .
docker run --rm -e TRANSITLAND_API_KEY=your-key -p 3010:3010 transitland-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/transitland-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools and resources, inits the Transitland service. |
src/config | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools | Tool definitions (*.tool.ts). Six tools across operators, feeds, routes, stops, and departures. |
src/mcp-server/resources | Resource definitions (*.resource.ts). Operator and feed records. |
src/services/transitland | Transitland v2 REST client — HTTP, apikey injection, cursor normalization, error classification, and per-endpoint typed methods. |
tests/ | Unit and integration tests mirroring src/. |
See CLAUDE.md / AGENTS.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/mcp-server/*/definitions/index.tsunknown, not permissive)Issues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
Transit data is provided by Transitland — an open registry aggregating GTFS, GTFS-Realtime, and GBFS feeds from thousands of operators worldwide. Products built on Transitland data must display the name "Transitland" with a link to transit.land/terms, clearly visible to end users.
Transitland aggregates feeds from thousands of operators, each of which may carry its own license and attribution requirements. Review the per-feed license terms at transit.land/terms and comply with each source feed's requirements before redistributing or publishing data obtained through this server.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.