Istanbul MCP

io.github.Batu1-1an/istanbul-mcpBatu1-1anstreamable-httpv0.2.4Scanned 1 hour ago

Read-only Istanbul open city data: transport, parking, water, nearby services and datasets.

18 tools: 2 change things and 16 only read.

Reads private data · 2
Reads text others write · 18
Can send data out · 0
2 findings

Anlyon alternative

2 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

18 tools

Changes things 2Creates or changes something that can be changed back.Claude Code: ask

istanbul_datastore_queryRun a bounded SELECT over records from one allowlisted CKAN resource.Reads private dataReads text others write1 finding
Why it is in this group
- The name "istanbul_datastore_query" says "query": a word for reading.
- The description's first verb is "run": a word for a change.
- The input takes a statement or command to run (input.sql), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- private-dataThe name says "query" and the input takes a statement (input.sql): it reads databases.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
  The server marks "istanbul_datastore_query" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "istanbul_datastore_query" says "query": a word for reading.
  What this check looks for
Description, as the server wrote it
Run a bounded SELECT over records from one allowlisted CKAN resource. SQLite dialect: use table records and published column names. GROUP BY and aggregates are supported; no writes, arbitrary functions or application DB. A complete bounded capture is required, never partial counts. The server enforces an outer result limit (default 20, max 100) even if SQL omits LIMIT. Only resources configured in CKAN_SQL_ALLOWED_RESOURCE_IDS are available. Local query syntax and bounds: https://github.com/Batu1-1an/istanbulmcp/blob/main/docs/datastore-sql.md Source API: https://docs.ckan.org/en/latest/maintaining/datastore.html
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_market_scheduleReturn the published weekly İBB market schedule, optionally by district/day.Reads text others write1 finding
Why it is in this group
- The name "istanbul_market_schedule" says "schedule": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
  The server marks "istanbul_market_schedule" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "istanbul_market_schedule" says "schedule": a word for a change.
  What this check looks for
Description, as the server wrote it
Return the published weekly İBB market schedule, optionally by district/day. day accepts Turkish/English weekdays, today/yesterday/tomorrow, or an ISO date. Results are a static weekly schedule, not proof a market is open today; coordinates are source points and maps_url is a map search link.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true

Only reads 16Looks things up and changes nothing.Show 16 read-only tools

istanbul_city_services_nearbySummarize WiFi near a static reference point and district-level libraries/culture.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "summarize": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Summarize WiFi near a static reference point and district-level libraries/culture. district (all 39 Istanbul districts) is exclusive with place/coordinates; district-only place names also return district address lists, without WiFi or invented distances. Radius applies only to WiFi with a point. For Acıbadem, specify 'Acıbadem, Kadıköy' or 'Acıbadem, Üsküdar'. Not full address geocoding.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_get_datasetReturn metadata and resources for one IBB dataset.Reads text others writeNo findings
Why it is in this group
- The name "istanbul_get_dataset" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return metadata and resources for one IBB dataset.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_get_resource_schemaReturn DataStore field schema for a resource.Reads text others writeNo findings
Why it is in this group
- The name "istanbul_get_resource_schema" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return DataStore field schema for a resource.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_gtfs_snapshot_statusInspect local GTFS load age, calendar validity, row counts and skipped rows.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "istanbul_gtfs_snapshot_status" says "snapshot": a word for reading.
What it can reach
- private-dataThe description's first sentence says "inspect" and "calendar": it reads calendars.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Inspect local GTFS load age, calendar validity, row counts and skipped rows. No upstream request or refresh is made. A missing or warming snapshot is unavailable, not an empty timetable. Cache age is not feed publication age; a loaded snapshot does not prove live arrivals or transport service.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_healthReturn Istanbul MCP service readiness.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "return": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return Istanbul MCP service readiness.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_metro_accessibility_statusReturn official Metro İstanbul equipment/total counts and current equipment fault details, optionally filtered by line, station, or equipment type.Reads text others writeNo findings
Why it is in this group
- The name "istanbul_metro_accessibility_status" says "status": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return official Metro İstanbul equipment/total counts and current equipment fault details, optionally filtered by line, station, or equipment type. This is not an end-to-end accessibility guarantee.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_mobility_nearbySummarize mobility near a static place reference or coordinates.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "summarize": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Summarize mobility near a static place reference or coordinates. district (all 39 Istanbul districts) is exclusive with place/coordinates and returns parking only, without distances. District-only place names do the same. For Acıbadem specify 'Acıbadem, Kadıköy' or 'Acıbadem, Üsküdar'. Not address geocoding.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_nearbyFind city services by kind and coordinates, or parking/pharmacy by district.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "find": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Find city services by kind and coordinates, or parking/pharmacy by district. bbox and types apply only to city_feature (parking, metro_station, air_quality_station, public_transport_stop, wifi, ev_charging, taxi_stand, market). air_quality includes latest readings; city_feature has station locations only. Static layers return published locations, not live status. District lists have no distances. Pharmacy records include name, district, address, phone, map links, provenance and freshness; maps_search_url is address search, not a verified pin. Pharmacy duty-end times are not guaranteed. Card/social locations are static, not live operating status.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_neighborhood_profileReturn a joined neighborhood profile from social, building, and earthquake scenario records.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "return": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return a joined neighborhood profile from social, building, and earthquake scenario records.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_next_departuresSearch GTFS stop names or return published departures for selected stops.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Search GTFS stop names or return published departures for selected stops. Use stop_query with limit only to discover stop_id candidates by name, including Turkish/ASCII spellings (Kadıköy/kadikoy). This mode returns stops, NOT departures. Same-name stops remain separate; never choose the first automatically. Approximate spelling suggestions are labeled, not matches. Ask the user to select a candidate using name/map, then call with stop_id. stop_code identifies the published stop sign when present. stop_desc and platform_direction_text preserve source text; they are not inferred route directions. Missing metadata stays null; districts are not inferred. at is an ISO datetime with a UTC offset; omitted means now in Europe/Istanbul. The search covers 24 hours. stop_id and coordinates are mutually exclusive. line matches the published route short name. Times are scheduled, never live ETA, delays or proof of service. Outside-calendar queries are unavailable.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_query_resourceQuery IBB CKAN DataStore records with guarded filters and limits.Reads text others writeNo findings
Why it is in this group
- The name "istanbul_query_resource" says "query": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Query IBB CKAN DataStore records with guarded filters and limits. API reference: https://docs.ckan.org/en/latest/maintaining/datastore.html Uses datastore_search, not SQL; field names come from the resource schema.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_search_datasetsSearch the IBB open data catalog.Reads text others writeNo findings
Why it is in this group
- The name "istanbul_search_datasets" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Search the IBB open data catalog.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_traffic_statusReturn Istanbul citywide traffic index.Reads text others writeNo findings
Why it is in this group
- The name "istanbul_traffic_status" says "status": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return Istanbul citywide traffic index.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_transit_lineGet IETT line info, ordered stops or planned main-terminal departures.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Get IETT line info, ordered stops or planned main-terminal departures. limit applies only to departures. This is not live intermediate-stop ETA. Cross-operator service notices are provided by istanbul_transport_disruptions.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_transport_disruptionsReturn current official disruptions and service announcements across supported transport operators.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "return": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return current official disruptions and service announcements across supported transport operators.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
istanbul_water_statusGet ISKI active faults (district or fault_number) or dam occupancy.Reads text others writeNo findings
Why it is in this group
- The name "istanbul_water_status" says "status": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Get ISKI active faults (district or fault_number) or dam occupancy. Dam filters apply only to dams; fault_number is exclusive with district. Nearby faults are provided by istanbul_nearby(kind="water_fault"). Results carry fallback freshness and approximate fault locations; no restoration guarantee.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data2: Reads files, mail, messages, databases, secrets, calendars or repositories.; istanbul_datastore_query
istanbul_gtfs_snapshot_status
Reads text others write18: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; istanbul_city_services_nearby
istanbul_datastore_query
istanbul_get_dataset
istanbul_get_resource_schema
istanbul_gtfs_snapshot_status
istanbul_health
istanbul_market_schedule
istanbul_metro_accessibility_status
istanbul_mobility_nearby
istanbul_nearby
istanbul_neighborhood_profile
istanbul_next_departures
and 6 more
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

2 warn

Warnistanbul_datastore_query
The server marks "istanbul_datastore_query" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "istanbul_datastore_query" says "query": a word for reading.
What this check looks for
Warnistanbul_market_schedule
The server marks "istanbul_market_schedule" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "istanbul_market_schedule" says "schedule": a word for a change.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.2.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http istanbul https://istanbulmcp-production.up.railway.app/mcp/

claude mcp add --transport http istanbul https://istanbulmcp-production.up.railway.app/mcp/

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__istanbul__istanbul_health",
      "mcp__istanbul__istanbul_search_datasets",
      "mcp__istanbul__istanbul_get_dataset",
      "mcp__istanbul__istanbul_get_resource_schema",
      "mcp__istanbul__istanbul_query_resource",
      "mcp__istanbul__istanbul_nearby",
      "mcp__istanbul__istanbul_traffic_status",
      "mcp__istanbul__istanbul_water_status",
      "mcp__istanbul__istanbul_mobility_nearby",
      "mcp__istanbul__istanbul_city_services_nearby",
      "mcp__istanbul__istanbul_neighborhood_profile",
      "mcp__istanbul__istanbul_transit_line",
      "mcp__istanbul__istanbul_transport_disruptions",
      "mcp__istanbul__istanbul_metro_accessibility_status",
      "mcp__istanbul__istanbul_next_departures",
      "mcp__istanbul__istanbul_gtfs_snapshot_status"
    ],
    "ask": [
      "mcp__istanbul__istanbul_datastore_query",
      "mcp__istanbul__istanbul_market_schedule"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as istanbul. Review it before you use it.

Capability tags behind 18 rules

mcp__istanbul__istanbul_health untrusted-input
mcp__istanbul__istanbul_search_datasets untrusted-input
mcp__istanbul__istanbul_get_dataset untrusted-input
mcp__istanbul__istanbul_get_resource_schema untrusted-input
mcp__istanbul__istanbul_query_resource untrusted-input
mcp__istanbul__istanbul_nearby untrusted-input
mcp__istanbul__istanbul_traffic_status untrusted-input
mcp__istanbul__istanbul_water_status untrusted-input
mcp__istanbul__istanbul_mobility_nearby untrusted-input
mcp__istanbul__istanbul_city_services_nearby untrusted-input
mcp__istanbul__istanbul_neighborhood_profile untrusted-input
mcp__istanbul__istanbul_transit_line untrusted-input
mcp__istanbul__istanbul_transport_disruptions untrusted-input
mcp__istanbul__istanbul_metro_accessibility_status untrusted-input
mcp__istanbul__istanbul_datastore_query private-data, untrusted-input
mcp__istanbul__istanbul_market_schedule untrusted-input
mcp__istanbul__istanbul_next_departures untrusted-input
mcp__istanbul__istanbul_gtfs_snapshot_status private-data, untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.Batu1-1an/istanbul-mcp/verify?hash=2ad3215086e0d2486b71b81b60fcd6c984cfaca9214d8c0b47e199c23dae68a9" | jq -e '.changed == false'

Pinned hash 2ad3215086e0, from Oct 25, 2026, 15:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.Batu1-1an/istanbul-mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.Batu1-1an/istanbul-mcp.svg)](https://anlyon.dev/servers/io.github.Batu1-1an/istanbul-mcp)

Source: MCP Registry · repository. Synced Oct 25, 2026, 15:17 UTC.