
Security News
Rust 1.100 Will Add Dependency Cooldowns to Cargo
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.
gtfs-scorecard
Advanced tools
Score GTFS Schedule feeds with plain-language fixes: the gtfsscorecard.org pipeline, CLI, and read-only MCP server
The scoring pipeline, command-line tool, and read-only MCP server behind GTFS Scorecard, which grades public GTFS Schedule feeds and turns validator notices into plain-language fixes.
scorecard try <feed-url> scores one GTFS Schedule zip with the MobilityData
validator (Java 17 or newer must be on PATH) and prints the grade, the
category scores, and the top fixes.scorecard-mcp is a read-only Model Context Protocol server over stdio. Its
tools read the published scorecards on gtfsscorecard.org: search tracked
agencies, get a scorecard and its fixes, read a feed's grade history, and
explain a validator finding. It needs no key and has no write surface.gtfs-scorecard is the same MCP server under the distribution's name, so
uvx gtfs-scorecard starts it.The Python import package is scorecard_pipeline. The distribution was named
scorecard-pipeline until 1.5.1; PyPI refused that name as too similar to an
existing project, and nothing was uploaded under it.
Once gtfs-scorecard is on PyPI, these work:
uvx gtfs-scorecard
uvx --from gtfs-scorecard scorecard try https://example.org/gtfs.zip
pip install gtfs-scorecard
The first starts the MCP server. The second runs the command-line tool, which
has its own name, so uvx needs --from to find the package that provides it.
Check https://pypi.org/project/gtfs-scorecard/ for the versions that exist.
Before then, or to run code that is not released yet, install from the
repository:
uvx --from "git+https://github.com/ChelseaKR/gtfs-scorecard#subdirectory=pipeline" scorecard-mcp
An MCP client config that starts the server from PyPI (once it is there; use the repository form above until then):
{
"mcpServers": {
"gtfs-scorecard": {
"command": "uvx",
"args": ["gtfs-scorecard"]
}
}
}
Set SCORECARD_BASE_URL to point it at a fork or a local preview.
Apache-2.0.
FAQs
Score GTFS Schedule feeds with plain-language fixes: the gtfsscorecard.org pipeline, CLI, and read-only MCP server
The pypi package gtfs-scorecard receives a total of 27 weekly downloads. As such, gtfs-scorecard popularity was classified as not popular.
We found that gtfs-scorecard demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.