Skip to content

topo^alpin MCP server

app.topoalpin/mcptopoalpin.appstreamable-httpv3.2.1Scanned

Avalanche bulletins, mountain weather, stations, huts, ski and snowshoe tours in the Alps.

9 tools: 9 change things.

Tools: 0 delete, 0 irreversible, 9 write, 0 read.
  • Reads private data · 0
  • Reads text others write · 9
  • Can send data out · 0
  • No findings

Tools listed without sign-in. Remote posture

With Anlyon

9 tools here change things. Govern them.

  • Anlyon lists the tools and adopts none.
  • Each tool you adopt gets approvals and receipts.
  • Your agent never holds the key.
Govern this server →

A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.

What the topo^alpin MCP server can do

The topo^alpin MCP server is published by topoalpin.app, a domain the MCP Registry verified. It has 9 tools. It can create or change data (9 tools: avalanche_coverage, avalanche_region, avalanche_overview, avalanche_bulletin and 5 more), but cannot delete data. None of its tools only reads.

9 tools bring in text other people can write (avalanche_coverage, avalanche_region, avalanche_overview and 6 more).

None of the fixed checks matched anything in its tool definitions. That is not a safety guarantee.

Its remote endpoint lists its tools without sign-in, and its tools changed 10 times since anlyon.dev first saw them.

Last scanned Nov 13, 2026, version 3.2.1.

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

9 tools

Changes things 9Claude Code: ask
  • avalanche_bulletinThe danger level where someone is going in the Alps, from the official avalanche bulletin: give a place name or the name of a warning region, or lat and lon, or a region id.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The danger level where someone is going in the Alps, from the official avalanche bulletin: give a place name or the name of a warning region, or lat and lon, or a region id. The elevation of a named place or point is looked up unless you give elevationM. atPlace holds the level for that elevation and time of day and the avalanche problems there; reports hold who issued the bulletin, when, until when and when the next is due, all its ratings and problems, and its texts: main message, danger description, snowpack, weather and tendency. Set when=next for the following bulletin once it is out. Say the level from atPlace.levels with its elevation and time of day, the warning service, when it was issued and until when it applies. If problemsInTextOnly is true, the service names its avalanche problems in its texts only: read them from texts. If nearbyRegions is not empty, the place lies within 2 km of another region: name it with its own level, or that it has no report, since a tour may cross into it. If outsideDescribedElevation is true, the report describes this level at describedElevation only: say so, and do not apply the level to the place or call it lower there. If atPlace.regionsWithoutLevel is not empty, the place also lies in regions without a report: say that no level is available for them, and ask the user which side the tour is on if that matters.

    Annotations the server declares

    • title: Avalanche danger level at a place
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • avalanche_coverageIs there an avalanche report at all right now, and in which regions?Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Is there an avalanche report at all right now, and in which regions? Lists every warning region in the Alps with a current report, grouped by warning service, with validity. Off season most regions have none. Contains no danger levels: use avalanche_bulletin for those.

    Annotations the server declares

    • title: Where avalanche reports exist
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • avalanche_overviewHow is the avalanche situation in a wider area of the Alps, such as Tyrol or the Valais?Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    How is the avalanche situation in a wider area of the Alps, such as Tyrol or the Valais? Give the name of a place or warning region, or lat and lon, with an optional radius, or a warning service. Returns the reports for the area with their danger levels per elevation, avalanche problems and main message, at most limit of them; offset gives the next ones. If regionsNotShown is present, the regions there have a report that is not listed: say so, never that they have none. For one destination use avalanche_bulletin.

    Annotations the server declares

    • title: Avalanche situation in an area
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • avalanche_regionDoes a summit, destination or point lie in an avalanche warning region of the Alps, in which one, and does it have a current report?Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Does a summit, destination or point lie in an avalanche warning region of the Alps, in which one, and does it have a current report? Takes the name of a place or of a region, or up to 20 points such as start and summit of a tour. Also names other regions within 2 km.

    Annotations the server declares

    • title: Warning region of a place
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • mountain_forecastThe weather forecast at a place in the Alps, for its elevation: weather, precipitation, fresh snow, freezing level, temperature, wind and gusts, sunshine and thunderstorm risk, in …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The weather forecast at a place in the Alps, for its elevation: weather, precipitation, fresh snow, freezing level, temperature, wind and gusts, sunshine and thunderstorm risk, in six-hour periods of local time for up to ten days. Computed from several weather models like the forecast in the topo^alpin app. Say the elevation elevationM and the period, and the weather, precipitation, fresh snow, freezing level, wind with gusts and thunderstorm risk where they matter. temperatureC is the spread of the models, from the coldest to the warmest: give it as a range. Where freezingLevelSource is estimate, the freezing level is carried from the temperature at the place: call it estimated. Where precipitationMm is above 0 and rainMm and fresh snow are 0, only a trace falls: say so, not that it stays dry. A period marked past has ended: do not give it as forecast, and say that the day totals include it.

    Annotations the server declares

    • title: Mountain weather forecast at a place
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • mountain_hutsThe mountain huts nearest to a place in the Alps, or to where the user stands: name, distance and direction in a straight line, elevation and the difference to the place, mountain …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The mountain huts nearest to a place in the Alps, or to where the user stands: name, distance and direction in a straight line, elevation and the difference to the place, mountain hut or self-catering, operator, beds and contact, as far as OpenStreetMap has them. Not opening times, free places or prices. Say how far, in which direction and how much higher or lower each hut lies, in a straight line, and pass on the field notice: whether a hut is staffed, opening times, free places and prices are not in the data.

    Annotations the server declares

    • title: Mountain huts near a place
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • station_observationsWhat the weather stations near a place in the Alps measure now: temperature, snow depth, fresh snow, wind and gusts, each with the time of the measurement, and optionally the last …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    What the weather stations near a place in the Alps measure now: temperature, snow depth, fresh snow, wind and gusts, each with the time of the measurement, and optionally the last days. Measured, not forecast, at the place and elevation of the station. Stations are chosen by distance and elevation difference, like in the topo^alpin app. Say which station, its elevation, how far away it is and when it measured: a station measures at its own place and elevation, not at the destination. A value of null means nothing current, never zero.

    Annotations the server declares

    • title: What weather stations measure near a place
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • tour_terrainThe terrain of one ski or snowshoe tour in the Alps, by the id from winter_tours: how steep it is and for how long, the aspects of the steep slopes, how much lies in avalanche terr…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The terrain of one ski or snowshoe tour in the Alps, by the id from winter_tours: how steep it is and for how long, the aspects of the steep slopes, how much lies in avalanche terrain (ATES and ATM), stretch by stretch, and the grade explained with the words of the SAC scale and who gave it. Terrain only, computed from terrain models; not snow or avalanche conditions. Name ATES and ATM with what terrainExplained says they are, and compare aspectsSteep and the elevations with the avalanche bulletin, without turning them into a go/no-go. Where atm lists runout, avalanches from slopes above can reach the line, also below 30° and with ates 0: say so. Pass on gradeSources with the grades, and name terrain.onFoot, the part on foot above the ski depot, with the grade: it is often the steepest.

    Annotations the server declares

    • title: Terrain of a ski or snowshoe tour
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • winter_toursSki and snowshoe tours in the Alps at a place: the routes up to a summit, hut or pass, and the routes that start in a valley or at a hut.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Ski and snowshoe tours in the Alps at a place: the routes up to a summit, hut or pass, and the routes that start in a valley or at a hut. Each with title, grade in the scale of the language, elevation gain, length, and the start seen from the place. From the guidebook and portal data shown in the topo^alpin app; not current conditions. Say the grade, the elevation gain, where the route starts and who gave the grade: gradeSource on each tour, explained once in gradeSources; a grade with ~ is estimated by topo^alpin. Give each tour with its appUrl, which opens it in the topo^alpin app. Say where each route in startingHere starts: it can lie in another valley, across a pass. Where target.endBelowM is above 30, the line ends at a ski depot that far below the summit and the rest is not in the route: say so. Pass on the field notice, check avalanche_bulletin for the tour, and use tour_terrain for how steep it is and how much lies in avalanche terrain.

    Annotations the server declares

    • title: Ski and snowshoe tours at a place
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write9
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Nov 14, 2026, 12:20 UTC, unchanged since Nov 14, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
9
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
not observed
Authorization servers
not observed
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 9 tools that change things (9 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://api.topoalpin.app/mcp: tools/list returned 9 tools to an anonymous client, including avalanche_coverage (write), avalanche_region (write), avalanche_overview (write), avalanche_bulletin (write), mountain_forecast (write) and 4 more

    What this check looks for

Posture changes

  1. Nov 14, 2026
    • Tools that change things, listed without credentials: 8 to 9

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

  1. PostureRemote posture changed. Tools that change things, listed without credentials: 8 -> 9.View diff
    • Tools that change things, listed without credentials: 8 to 9
  2. Tools1 changed.~1 changedView diff
  3. Tools9 changed.~9 changedView diff
  4. Tools1 changed.~1 changedView diff
  5. Tools8 changed.~8 changedView diff
  6. Tools1 added.+1 addedView diff
  7. Tools4 changed.~4 changedView diff
  8. Tools2 added.+2 addedView diff
  9. Tools4 changed.~4 changedView diff
  10. Tools1 added.+1 addedView diff

Install

Pinned to version 3.2.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http topoalpin https://api.topoalpin.app/mcp
claude mcp add --transport http topoalpin https://api.topoalpin.app/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__topoalpin__avalanche_coverage",
      "mcp__topoalpin__avalanche_region",
      "mcp__topoalpin__avalanche_overview",
      "mcp__topoalpin__avalanche_bulletin",
      "mcp__topoalpin__mountain_forecast",
      "mcp__topoalpin__station_observations",
      "mcp__topoalpin__mountain_huts",
      "mcp__topoalpin__winter_tours",
      "mcp__topoalpin__tour_terrain"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as topoalpin. Review it before you use it.

Capability tags behind 9 rules
  • mcp__topoalpin__avalanche_coverage untrusted-input
  • mcp__topoalpin__avalanche_region untrusted-input
  • mcp__topoalpin__avalanche_overview untrusted-input
  • mcp__topoalpin__avalanche_bulletin untrusted-input
  • mcp__topoalpin__mountain_forecast untrusted-input
  • mcp__topoalpin__station_observations untrusted-input
  • mcp__topoalpin__mountain_huts untrusted-input
  • mcp__topoalpin__winter_tours untrusted-input
  • mcp__topoalpin__tour_terrain untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/app.topoalpin/mcp/verify?hash=4654cec14712d77838d65960751bd225addc4a2b1eb3100b0d67cf6480ee74b9" | jq -e '.changed == false'

Pinned hash 4654cec14712, from Nov 13, 2026, 12:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/app.topoalpin/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for app.topoalpin/mcp
[![anlyon.dev](https://anlyon.dev/badge/app.topoalpin/mcp.svg)](https://anlyon.dev/servers/app.topoalpin/mcp)

Source: MCP Registry. Synced Nov 13, 2026, 12:17 UTC.

topo^alpin MCP server: questions and answers

Answered from the scan above, not from the publisher's description.

Is the topo^alpin MCP server safe?

No scan can promise that. What its definitions show: 9 tools, 9 of which can change, send or delete something, and 0 findings from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.

Can the topo^alpin MCP server delete data?

No tool is classed as destructive: going by their definitions, none of them deletes, cancels or revokes anything.

Can the topo^alpin MCP server do things that cannot be undone?

No tool is classed as irreversible: none of them sends, pays, publishes or merges, going by their definitions.

What tools does the topo^alpin MCP server have?

9 tools: 9 write. avalanche_coverage, avalanche_region, avalanche_overview, avalanche_bulletin, mountain_forecast, station_observations, mountain_huts, winter_tours and 1 more.

Does the topo^alpin MCP server need sign-in or OAuth?

Its remote endpoint listed its tools to an anonymous client, without sign-in.

Does the topo^alpin MCP server send data to outside services?

None of its tools sends, posts or publishes, or takes a recipient, channel or URL.

Has the topo^alpin MCP server changed its tools?

Yes, 10 times since anlyon.dev started tracking it, most recently on Nov 13, 2026. Every change is on this page and in its Atom feed.