Sbb Opendata Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Sbb Opendata Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
🇨🇭 Part of the [Swiss Public Data MCP Portfolio](https://github.com/malkreide/swiss-public-data-mcp)
MCP server connecting AI models to Swiss Federal Railways (SBB) open data – passenger frequency, live rail disruptions, infrastructure & real-estate projects, train counts, platform data, rolling stock and station search from data.sbb.ch. No API key required.
Demo: Claude queries SBB passenger frequency
sbb-opendata-mcp gives AI assistants like Claude direct access to public SBB data – no copy-pasting or manual API calls. A question like "How many passengers passed through Zürich HB every day in 2024?" is answered with real measured data.
The SBB Open Data portal speaks the OpenDataSoft REST API (v2.1). This server translates it into clean Markdown and JSON for the AI model, and adds MCP structuredContent alongside the human-readable text so programmatic clients can consume the underlying records without re-parsing. The server is model-agnostic and works with any MCP-compatible client.
Anchor demo query: "Compare Zürich HB, Bern and Basel SBB by passenger frequency and platform capacity." → More use cases by audience →
Install uv (recommended):
curl -LsSf https://astral.sh/uv/install.sh | shFrom PyPI:
pip install sbb-opendata-mcpOr with uvx (no permanent installation):
uvx sbb-opendata-mcpFor local development, install from a clone in editable mode:
git clone https://github.com/malkreide/sbb-opendata-mcp.git
cd sbb-opendata-mcp
pip install -e ".[dev]"# Start the server (stdio mode for Claude Desktop)
sbb-opendata-mcpTry it immediately in Claude Desktop:
"How many people boarded at Zürich HB daily in 2024?" "Are there any current disruptions on the Swiss rail network?"
The server needs no configuration to run over stdio. The variables below tune the optional Streamable HTTP transport, logging and observability.
| Variable | Effect | Default |
|---|---|---|
MCP_HOST | Bind host for the HTTP transport. Keep 127.0.0.1 locally; only bind 0.0.0.0 inside a controlled container/cloud environment. | 127.0.0.1 |
MCP_PORT | Port for the HTTP transport. | 8000 |
MCP_ALLOWED_HOSTS | Comma-separated host allow-list for DNS-rebinding protection (e.g. your-app.onrender.com,your-app.onrender.com:*). | localhost only |
MCP_ALLOWED_ORIGINS | Comma-separated browser-origin allow-list (e.g. https://your-app.onrender.com). | _(none)_ |
LOG_LEVEL | Log verbosity (DEBUG/INFO/WARNING/…). | INFO |
LOG_FORMAT | json for structured logs; anything else for human-readable text. Always written to stderr. | text |
🔒 DNS-rebinding / Origin protection is always on; localhost is allow-listed so local HTTP development works out of the box. Logs go to stderr — stdout is reserved for the stdio JSON-RPC channel.
{
"mcpServers": {
"sbb-opendata": {
"command": "uvx",
"args": ["sbb-opendata-mcp"]
}
}
}Config file locations:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonRestart Claude Desktop — the server is downloaded automatically on first use.
Works with Cursor, Windsurf, VS Code + Continue, LibreChat, Cline and self-hosted models via mcp-proxy — same configuration as above.
For use via claude.ai in the browser or remote servers (e.g. Render.com). The cloud transport is Streamable HTTP (endpoint /mcp).
Docker (recommended):
# Build + run with explicit resource limits (see docker-compose.yml)
docker compose up --build
# → http://127.0.0.1:8000/mcpThe image is a multi-stage build running as a non-root user; docker-compose.yml adds read_only, no-new-privileges and memory/CPU/PID limits.
Manual / Render.com:
pip install -e .
# Bind publicly (behind a rate-limiting reverse proxy) and configure
# DNS-rebinding / Origin protection for your hostname:
export MCP_HOST=0.0.0.0
export MCP_ALLOWED_HOSTS="your-app.onrender.com,your-app.onrender.com:*"
export MCP_ALLOWED_ORIGINS="https://your-app.onrender.com"
python -m sbb_opendata_mcp.server --http --port 8000⚠️ Binding: In a network transport the server binds to127.0.0.1by default so a locally started server is not exposed to your whole network. SetMCP_HOST=0.0.0.0only in a container/cloud environment where binding to all interfaces is intended (the Docker image does this for you), and place the server behind a reverse proxy that enforces rate limiting (and authentication, if the endpoint should not be public). SeeSECURITY.md.
| Tool | Description | Data Update |
|---|---|---|
sbb_get_passenger_frequency | Boardings/alightings by station and year (daily avg.) | Annual |
sbb_get_rail_disruptions | Live rail traffic messages | Every 5 min. |
sbb_get_infrastructure_construction_projects | Infrastructure construction (stations, lines) | Ongoing |
sbb_get_real_estate_projects | SBB real estate development projects | Daily |
sbb_get_trains_per_segment | Train counts per route segment (SBB, BLS, SOB …) | Annual |
sbb_get_platform_data | Platform data (length, type, area) | Ongoing |
sbb_get_rolling_stock | Rolling stock (capacity, year built) | Ongoing |
sbb_compare_stations | Compare up to 10 stations (multi-dataset) | – |
sbb_search_stations | Search stops (Swiss DiDok register, all CH) | Ongoing |
sbb_list_datasets | List all ~89 SBB open datasets | – |
All tools support response_format: "markdown" (human-readable) and "json" (machine-readable), plus pagination. Every tool also returns MCP structuredContent (the underlying records/metadata) alongside the rendered text.
| Query | Tool |
|---|---|
| "How many people boarded at Zürich HB daily in 2024?" | sbb_get_passenger_frequency |
| "Are there any current disruptions on the Swiss rail network?" | sbb_get_rail_disruptions |
| "Compare Zürich HB, Bern and Basel SBB" | sbb_compare_stations |
| "Which SBB construction projects are active in Zürich?" | sbb_get_infrastructure_construction_projects |
| "How many trains run yearly on the Zürich–Winterthur route?" | sbb_get_trains_per_segment |
| "Which stops exist in Wädenswil?" | sbb_search_stations |
┌─────────────────┐ ┌───────────────────────────┐ ┌──────────────────────────┐
│ Claude / AI │────▶│ SBB Open Data MCP │────▶│ data.sbb.ch │
│ (MCP Host) │◀────│ (MCP Server) │◀────│ │
└─────────────────┘ │ │ │ OpenDataSoft REST v2.1 │
│ 10 Tools │ │ (public, no API key) │
│ Stdio | Streamable HTTP │ │ │
│ │ │ passagierfrequenz │
│ Shared httpx client │ │ rail-traffic-information │
│ (pooled, lifespan-managed)│ │ construction-projects │
│ ODSQL escaping + Pydantic │ │ perron · rollmaterial │
│ validation │ │ zugzahlen · dienststellen│
└───────────────────────────┘ └──────────────────────────┘sbb-opendata-mcp/
├── src/sbb_opendata_mcp/
│ ├── __init__.py
│ └── server.py # FastMCP server, all 10 tool definitions
├── tests/
│ └── test_server.py # Unit + live API smoke tests
├── audits/ # MCP best-practice audit evidence
├── docs/assets/demo.svg # README demo asset
├── .github/workflows/ci.yml # GitHub Actions (Python 3.11/3.12/3.13)
├── Dockerfile # Multi-stage, non-root runtime image
├── docker-compose.yml # Local run with resource limits
├── claude_desktop_config.json # Example Claude Desktop config
├── pyproject.toml
├── CHANGELOG.md
├── CONTRIBUTING.md
├── SECURITY.md
├── EXAMPLES.md
├── LICENSE
├── README.md # This file (English)
└── README.de.md # German versionyear/canton are regex-validated and every value interpolated into an ODSQL where clause is escaped via a central helper.See SECURITY.md for the full security posture.
limit and pagination.No API key is required.
# Unit tests (no network required)
PYTHONPATH=src pytest tests/ -m "not live"
# Live API smoke tests (require network access to data.sbb.ch)
PYTHONPATH=src pytest tests/ -m liveSee CHANGELOG.md
See CONTRIBUTING.md
MIT License — see LICENSE
Hayal Oezkan · github.com/malkreide
<!-- mcp-name: io.github.malkreide/sbb-opendata-mcp -->
<!-- BEGIN GENERATED: install -->
Run via uv's uvx — no clone or manual install needed. Add to your MCP client config (mcpServers for Claude Desktop, Cursor and Windsurf; use a top-level servers key for VS Code in .vscode/mcp.json):
{
"mcpServers": {
"sbb-opendata-mcp": {
"command": "uvx",
"args": [
"sbb-opendata-mcp"
]
}
}
}<!-- END GENERATED: install -->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.