topo^alpin MCP server
app.topoalpin/mcptopoalpin.appstreamable-httpv3.2.1Scanned
Avalanche bulletins, mountain weather, stations, huts, ski and snowshoe tours in the Alps.
9 tools: 9 change things.
- Reads private data · 0
- Reads text others write · 9
- Can send data out · 0
- No findings
Tools listed without sign-in. Remote posture
With Anlyon
9 tools here change things. Govern them.
- Anlyon lists the tools and adopts none.
- Each tool you adopt gets approvals and receipts.
- Your agent never holds the key.
A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.
What the topo^alpin MCP server can do
The topo^alpin MCP server is published by topoalpin.app, a domain the MCP Registry verified. It has 9 tools. It can create or change data (9 tools: avalanche_coverage, avalanche_region, avalanche_overview, avalanche_bulletin and 5 more), but cannot delete data. None of its tools only reads.
9 tools bring in text other people can write (avalanche_coverage, avalanche_region, avalanche_overview and 6 more).
None of the fixed checks matched anything in its tool definitions. That is not a safety guarantee.
Its remote endpoint lists its tools without sign-in, and its tools changed 10 times since anlyon.dev first saw them.
Last scanned Nov 13, 2026, version 3.2.1.
Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
9 tools
Changes things 9Claude Code: ask
avalanche_bulletinThe danger level where someone is going in the Alps, from the official avalanche bulletin: give a place name or the name of a warning region, or lat and lon, or a region id.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The danger level where someone is going in the Alps, from the official avalanche bulletin: give a place name or the name of a warning region, or lat and lon, or a region id. The elevation of a named place or point is looked up unless you give elevationM. atPlace holds the level for that elevation and time of day and the avalanche problems there; reports hold who issued the bulletin, when, until when and when the next is due, all its ratings and problems, and its texts: main message, danger description, snowpack, weather and tendency. Set when=next for the following bulletin once it is out. Say the level from atPlace.levels with its elevation and time of day, the warning service, when it was issued and until when it applies. If problemsInTextOnly is true, the service names its avalanche problems in its texts only: read them from texts. If nearbyRegions is not empty, the place lies within 2 km of another region: name it with its own level, or that it has no report, since a tour may cross into it. If outsideDescribedElevation is true, the report describes this level at describedElevation only: say so, and do not apply the level to the place or call it lower there. If atPlace.regionsWithoutLevel is not empty, the place also lies in regions without a report: say that no level is available for them, and ask the user which side the tour is on if that matters.
Annotations the server declares
- title: Avalanche danger level at a place
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
avalanche_coverageIs there an avalanche report at all right now, and in which regions?Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Is there an avalanche report at all right now, and in which regions? Lists every warning region in the Alps with a current report, grouped by warning service, with validity. Off season most regions have none. Contains no danger levels: use avalanche_bulletin for those.
Annotations the server declares
- title: Where avalanche reports exist
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
avalanche_overviewHow is the avalanche situation in a wider area of the Alps, such as Tyrol or the Valais?Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it How is the avalanche situation in a wider area of the Alps, such as Tyrol or the Valais? Give the name of a place or warning region, or lat and lon, with an optional radius, or a warning service. Returns the reports for the area with their danger levels per elevation, avalanche problems and main message, at most limit of them; offset gives the next ones. If regionsNotShown is present, the regions there have a report that is not listed: say so, never that they have none. For one destination use avalanche_bulletin.
Annotations the server declares
- title: Avalanche situation in an area
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
avalanche_regionDoes a summit, destination or point lie in an avalanche warning region of the Alps, in which one, and does it have a current report?Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Does a summit, destination or point lie in an avalanche warning region of the Alps, in which one, and does it have a current report? Takes the name of a place or of a region, or up to 20 points such as start and summit of a tour. Also names other regions within 2 km.
Annotations the server declares
- title: Warning region of a place
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
mountain_forecastThe weather forecast at a place in the Alps, for its elevation: weather, precipitation, fresh snow, freezing level, temperature, wind and gusts, sunshine and thunderstorm risk, in …Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The weather forecast at a place in the Alps, for its elevation: weather, precipitation, fresh snow, freezing level, temperature, wind and gusts, sunshine and thunderstorm risk, in six-hour periods of local time for up to ten days. Computed from several weather models like the forecast in the topo^alpin app. Say the elevation elevationM and the period, and the weather, precipitation, fresh snow, freezing level, wind with gusts and thunderstorm risk where they matter. temperatureC is the spread of the models, from the coldest to the warmest: give it as a range. Where freezingLevelSource is estimate, the freezing level is carried from the temperature at the place: call it estimated. Where precipitationMm is above 0 and rainMm and fresh snow are 0, only a trace falls: say so, not that it stays dry. A period marked past has ended: do not give it as forecast, and say that the day totals include it.
Annotations the server declares
- title: Mountain weather forecast at a place
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
mountain_hutsThe mountain huts nearest to a place in the Alps, or to where the user stands: name, distance and direction in a straight line, elevation and the difference to the place, mountain …Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The mountain huts nearest to a place in the Alps, or to where the user stands: name, distance and direction in a straight line, elevation and the difference to the place, mountain hut or self-catering, operator, beds and contact, as far as OpenStreetMap has them. Not opening times, free places or prices. Say how far, in which direction and how much higher or lower each hut lies, in a straight line, and pass on the field notice: whether a hut is staffed, opening times, free places and prices are not in the data.
Annotations the server declares
- title: Mountain huts near a place
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
station_observationsWhat the weather stations near a place in the Alps measure now: temperature, snow depth, fresh snow, wind and gusts, each with the time of the measurement, and optionally the last …Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it What the weather stations near a place in the Alps measure now: temperature, snow depth, fresh snow, wind and gusts, each with the time of the measurement, and optionally the last days. Measured, not forecast, at the place and elevation of the station. Stations are chosen by distance and elevation difference, like in the topo^alpin app. Say which station, its elevation, how far away it is and when it measured: a station measures at its own place and elevation, not at the destination. A value of null means nothing current, never zero.
Annotations the server declares
- title: What weather stations measure near a place
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
tour_terrainThe terrain of one ski or snowshoe tour in the Alps, by the id from winter_tours: how steep it is and for how long, the aspects of the steep slopes, how much lies in avalanche terr…Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The terrain of one ski or snowshoe tour in the Alps, by the id from winter_tours: how steep it is and for how long, the aspects of the steep slopes, how much lies in avalanche terrain (ATES and ATM), stretch by stretch, and the grade explained with the words of the SAC scale and who gave it. Terrain only, computed from terrain models; not snow or avalanche conditions. Name ATES and ATM with what terrainExplained says they are, and compare aspectsSteep and the elevations with the avalanche bulletin, without turning them into a go/no-go. Where atm lists runout, avalanches from slopes above can reach the line, also below 30° and with ates 0: say so. Pass on gradeSources with the grades, and name terrain.onFoot, the part on foot above the ski depot, with the grade: it is often the steepest.
Annotations the server declares
- title: Terrain of a ski or snowshoe tour
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
winter_toursSki and snowshoe tours in the Alps at a place: the routes up to a summit, hut or pass, and the routes that start in a valley or at a hut.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Ski and snowshoe tours in the Alps at a place: the routes up to a summit, hut or pass, and the routes that start in a valley or at a hut. Each with title, grade in the scale of the language, elevation gain, length, and the start seen from the place. From the guidebook and portal data shown in the topo^alpin app; not current conditions. Say the grade, the elevation gain, where the route starts and who gave the grade: gradeSource on each tour, explained once in gradeSources; a grade with ~ is estimated by topo^alpin. Give each tour with its appUrl, which opens it in the topo^alpin app. Say where each route in startingHere starts: it can lie in another valley, across a pass. Where target.endBelowM is above 30, the line ends at a ski depot that far below the summit and the rest is not in the route: say so. Pass on the field notice, check avalanche_bulletin for the tour, and use tour_terrain for how steep it is and how much lies in avalanche terrain.
Annotations the server declares
- title: Ski and snowshoe tours at a place
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write9
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Nov 14, 2026, 12:20 UTC, unchanged since Nov 14, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 9
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- not observed
- RFC 9728 protected resource metadata
- not observed
- Authorization servers
- not observed
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- not observed
- Client ID metadata documents
- not observed
- WarnThe whole server
The endpoint served tools/list without credentials, and the list has 9 tools that change things (9 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://api.topoalpin.app/mcp: tools/list returned 9 tools to an anonymous client, including avalanche_coverage (write), avalanche_region (write), avalanche_overview (write), avalanche_bulletin (write), mountain_forecast (write) and 4 more
Posture changes
- Nov 14, 2026
- Tools that change things, listed without credentials: 8 to 9
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
PostureRemote posture changed. Tools that change things, listed without credentials: 8 -> 9.View diff
- Tools that change things, listed without credentials: 8 to 9
Tools1 changed.~1 changedView diff
- Changed:mountain_forecastChanges thingsdescription
Tools9 changed.~9 changedView diff
- Changed:avalanche_bulletinChanges thingsdescriptioninputSchemaannotations
- Changed:avalanche_coverageChanges thingsinputSchemaannotations
- Changed:avalanche_overviewChanges thingsdescriptioninputSchemaannotations
- Changed:avalanche_regionChanges thingsinputSchemaannotations
- Changed:mountain_forecastChanges thingsdescriptioninputSchemaannotations
- Changed:mountain_hutsChanges thingsinputSchemaannotations
- Changed:station_observationsChanges thingsinputSchemaannotations
- Changed:tour_terrainChanges thingsdescriptioninputSchemaannotations
- Changed:winter_toursChanges thingsdescriptioninputSchemaannotations
Tools1 changed.~1 changedView diff
- Changed:winter_toursChanges thingsdescription
Tools8 changed.~8 changedView diff
- Changed:avalanche_bulletinChanges thingsdescriptioninputSchema
- Changed:avalanche_overviewChanges thingsinputSchema
- Changed:avalanche_regionChanges thingsinputSchema
- Changed:mountain_forecastChanges thingsdescriptioninputSchema
- Changed:mountain_hutsChanges thingsdescriptioninputSchema
- Changed:station_observationsChanges thingsdescriptioninputSchema
- Changed:tour_terrainChanges thingsdescriptioninputSchema
- Changed:winter_toursChanges thingsdescriptioninputSchema
Tools1 added.+1 addedView diff
- Added:tour_terrainChanges things
Tools4 changed.~4 changedView diff
- Changed:avalanche_bulletinChanges thingsinputSchema
- Changed:avalanche_overviewChanges thingsinputSchema
- Changed:avalanche_regionChanges thingsinputSchema
- Changed:mountain_hutsChanges thingsdescription
Tools2 added.+2 addedView diff
- Added:mountain_hutsChanges things
- Added:winter_toursChanges things
Tools4 changed.~4 changedView diff
- Changed:avalanche_bulletinChanges thingsinputSchema
- Changed:avalanche_overviewChanges thingsinputSchema
- Changed:mountain_forecastChanges thingsinputSchema
- Changed:station_observationsChanges thingsinputSchema
Tools1 added.+1 addedView diff
- Added:station_observationsChanges things
Install
Pinned to version 3.2.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http topoalpin https://api.topoalpin.app/mcpclaude mcp add --transport http topoalpin https://api.topoalpin.app/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [],
"ask": [
"mcp__topoalpin__avalanche_coverage",
"mcp__topoalpin__avalanche_region",
"mcp__topoalpin__avalanche_overview",
"mcp__topoalpin__avalanche_bulletin",
"mcp__topoalpin__mountain_forecast",
"mcp__topoalpin__station_observations",
"mcp__topoalpin__mountain_huts",
"mcp__topoalpin__winter_tours",
"mcp__topoalpin__tour_terrain"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as topoalpin. Review it before you use it.
Capability tags behind 9 rules
- mcp__topoalpin__avalanche_coverage untrusted-input
- mcp__topoalpin__avalanche_region untrusted-input
- mcp__topoalpin__avalanche_overview untrusted-input
- mcp__topoalpin__avalanche_bulletin untrusted-input
- mcp__topoalpin__mountain_forecast untrusted-input
- mcp__topoalpin__station_observations untrusted-input
- mcp__topoalpin__mountain_huts untrusted-input
- mcp__topoalpin__winter_tours untrusted-input
- mcp__topoalpin__tour_terrain untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/app.topoalpin/mcp/verify?hash=4654cec14712d77838d65960751bd225addc4a2b1eb3100b0d67cf6480ee74b9" | jq -e '.changed == false'Pinned hash 4654cec14712, from Nov 13, 2026, 12:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/app.topoalpin/mcp/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/app.topoalpin/mcp)Source: MCP Registry. Synced Nov 13, 2026, 12:17 UTC.
topo^alpin MCP server: questions and answers
Answered from the scan above, not from the publisher's description.
Is the topo^alpin MCP server safe?
- No scan can promise that. What its definitions show: 9 tools, 9 of which can change, send or delete something, and 0 findings from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.
Can the topo^alpin MCP server delete data?
- No tool is classed as destructive: going by their definitions, none of them deletes, cancels or revokes anything.
Can the topo^alpin MCP server do things that cannot be undone?
- No tool is classed as irreversible: none of them sends, pays, publishes or merges, going by their definitions.
What tools does the topo^alpin MCP server have?
- 9 tools: 9 write. avalanche_coverage, avalanche_region, avalanche_overview, avalanche_bulletin, mountain_forecast, station_observations, mountain_huts, winter_tours and 1 more.
Does the topo^alpin MCP server need sign-in or OAuth?
- Its remote endpoint listed its tools to an anonymous client, without sign-in.
Does the topo^alpin MCP server send data to outside services?
- None of its tools sends, posts or publishes, or takes a recipient, channel or URL.
Has the topo^alpin MCP server changed its tools?
- Yes, 10 times since anlyon.dev started tracking it, most recently on Nov 13, 2026. Every change is on this page and in its Atom feed.