Hafasmcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Hafasmcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
[!NOTE] vibe-coded ✨
MCP server for real-time German public transport data via HAFAS. Lets Claude (or any MCP client) query departures, arrivals, journeys, and nearby stops — currently configured for the VBN network (Lower Saxony / Bremen).
No API key needed. Uses the same public HAFAS API as fahrplaner.vbn.de.
| Tool | Description |
|---|---|
locations | Search stops, addresses, or POIs by name |
departures | Upcoming departures from a stop |
arrivals | Upcoming arrivals at a stop |
journeys | Route planning between two locations |
nearby | Find stops near a coordinate |
Add to your MCP config:
{
"mcpServers": {
"hafas": {
"command": "node",
"args": ["dist/index.js"],
"cwd": "/path/to/hafasmcp"
}
}
}cp .env.example .env
docker compose up -dThis starts the HTTP server on port 3000 with a Cloudflare quick tunnel for remote access.
npm install
npm run build
npm start # stdio mode
npm run start:http # HTTP mode with OAuth 2.1| Variable | Default | Description |
|---|---|---|
PORT | 3000 | HTTP server port |
ISSUER_URL | http://localhost:$PORT | OAuth 2.1 issuer URL |
The server wraps hafas-client with the VBN profile and exposes it as MCP tools. Two transport modes:
Ask Claude:
"Wann fährt die nächste Straßenbahn vom Hauptbahnhof Bremen?"
Claude will use locations to find the stop ID, then departures to get real-time data — all in under a second.
TypeScript, Node.js, hafas-client, @modelcontextprotocol/sdk, Express 5
ISC
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.