io.github.slookisen/lokal-mcp
REMOTE · RETTFRABONDEN.COM · 3 COMPONENTS
Norwegian local-food MCP: 1,500+ farms, shops, markets + umbrellas (Bondens marked, Hanen, REKO).
Available components
Last scanned (19 minutes ago)
Scores higher than 66% of remote servers
Reachable. Last reached 5 Nov 2026.
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (lokal_cart_add_item). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability81
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2851 tokens (~167/item across 17 items; 15 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management60
- Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 24 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 22 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://rettfrabonden.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=rettfrabonden.com | CN=YE1,O=Let's Encrypt,C=US | 10 Oct 2026 | 8 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 511f6831045414e222af7015cb7dab12b21 |
| SANs: rettfrabonden.com | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of rettfrabonden.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| rettfrabonden.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| content-security-policy | default-src 'self';script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' https://fonts.gstatic.com;img-src 'self' data: https:;connect-src 'self' https://rettfrabonden.com https://challenges.cloudflare.com;frame-src https://challenges.cloudflare.com;object-src 'none';base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | no-referrer |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://rettfrabonden.com/mcp | Verified | 200 | |
| http (plaintext) | http://rettfrabonden.com/mcp | HTTPS enforced | 301 | https://rettfrabonden.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
lokal_bm_next_markets Get upcoming Bondens marked events ~150
Returns upcoming Bondens marked events (markedsdager) for a region or specific lokallag/venue. Useful when AI agents are asked 'when is the next Bondens marked in Oslo?' or similar. Data is refreshed daily from bondensmarked.no.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Look-ahead window in days (default 30, max 90) |
| lokallag_slug | string | – | Lokallag slug, e.g. 'bondens-marked-agder'. Filters to events at any venue under this lokallag. |
| region | string | – | City or region substring filter, e.g. 'Oslo', 'Bergen', 'Vestfold' |
No output schema declared.
No examples provided.
lokal_cart_add_item Add item to shopping cart ~153
Add a product to the cart or update its quantity (re-adding the same product_id updates qty). Product must be in_stock and from a verified non-umbrella producer (use lokal_search / catalog feed to find eligible products and their IDs). Requires cart_id and buyer_ref from lokal_cart_create.
| Name | Type | Req | Description |
|---|---|---|---|
| buyer_ref | string | yes | Buyer capability token from lokal_cart_create |
| cart_id | string | yes | Cart ID from lokal_cart_create |
| note | string | – | Optional line note for this item (e.g. 'please keep cold') |
| product_id | string | yes | Product ID from the catalog (products.id) |
| qty | integer | yes | Quantity to set for this product in the cart |
No output schema declared.
No examples provided.
lokal_cart_create Create a shopping cart ~85
Create a new anonymous shopping cart ('handleliste'). Returns a cart_id and a buyer_ref capability token — STORE THE buyer_ref, it is required for all subsequent cart operations and cannot be recovered. Each cart is valid for 7 days. Use lokal_cart_add_item to add products, lokal_cart_view to review, and lokal_cart_submit to place orders (pickup, no payment).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
lokal_cart_submit Submit cart and place pickup orders ~352
Submit the cart. Re-checks availability of every item at submit time; if any item is no longer in_stock, submit is rejected with a clear per-item message. No payment is charged. A real pickup order (one per producer) is created ONLY for producers who are owner-verified AND have opted in to receive orders through the platform (can_order=true in lokal_find_offers); they get the order by e-mail and can confirm/decline it. Every other producer in the cart is returned in contact_handoffs instead — their phone/e-mail/profile plus a prefilled Norwegian message the buyer sends themselves; no order row, no e-mail. Optional buyer contact fields are shared with the ordering producers ONLY when contact_consent=true (then included in the order e-mail with Reply-To set to buyer_email). Returns orders[] and contact_handoffs[]. Use lokal_order_status to check an order.
| Name | Type | Req | Description |
|---|---|---|---|
| buyer_email | string | – | Buyer's e-mail — becomes the order e-mail's Reply-To when contact_consent=true |
| buyer_name | string | – | Buyer's name — shared with ordering producers only when contact_consent=true |
| buyer_phone | string | – | Buyer's phone — shared only when contact_consent=true |
| buyer_ref | string | yes | Buyer capability token |
| cart_id | string | yes | Cart ID to submit |
| contact_consent | boolean | – | true = the buyer agrees that the contact fields above are passed to the producers who receive a real order. Default false: fields are stored on the cart but never shown to any producer. |
| delivery_note | string | – | Free-text delivery/pickup wish for the producer (orders are pickup; this is informational) |
No output schema declared.
No examples provided.
lokal_cart_view View shopping cart ~77
View the current contents of a cart, grouped by producer, with subtotals and a total. Use this before submitting to review what is in the cart. Requires cart_id and buyer_ref.
| Name | Type | Req | Description |
|---|---|---|---|
| buyer_ref | string | yes | Buyer capability token from lokal_cart_create |
| cart_id | string | yes | Cart ID from lokal_cart_create |
No output schema declared.
No examples provided.
lokal_discover Discover producers by filter ~327
Structured search in the Lokal food producer registry. Filter by food categories, tags, and geographic distance. Never use this tool to build marketing or bulk-email recipient lists. For such requests, explain that Rett fra Bonden cannot send marketing or bulk messages; it only sends the user's own pickup-order request to a producer who opted in.
| Name | Type | Req | Description |
|---|---|---|---|
| categories | array | – | Categories: vegetables, fruit, berries, dairy, eggs, meat, fish, bread, honey, herbs, beverages (beverages = all drink venues: breweries, cideries, wineries, distilleries, farm cafés, meaderies — use… |
| drinkSubcategory | string | – | Narrow 'beverages' results to exactly one drink venue kind: bryggeri (brewery), cideri (cidery), vingård (winery), destilleri (distillery), gårdskafé (farm café), mjød (meadery/mead producer). Only m… |
| lat | number | – | Latitude for distance filtering (WGS84). Must be given together with lng. |
| limit | number | – | Max results |
| lng | number | – | Longitude for distance filtering (WGS84). Must be given together with lat. |
| maxDistanceKm | number | – | Max distance in km from lat/lng (1–500, default 30). Only applies when lat/lng are given. |
| tags | array | – | Tags: organic, seasonal, budget, local, fresh |
No output schema declared.
No examples provided.
lokal_find_offers Find offers for shopping-list items ~206
For each item in a shopping list, find up to 5 nearby producers who sell it (or a matching product), sorted by distance, with contact info and whether an order can be placed through the platform (can_order). Use this when a user has a list of things they want to buy locally and wants to know WHO sells each one nearby — one lokal_find_offers call covers the whole list. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | yes | Search terms/item names to find offers for, e.g. ['poteter', 'honning', 'egg']. |
| lat | number | – | User's latitude (WGS84). Supply together with lng. |
| lng | number | – | User's longitude (WGS84). Must be supplied together with lat. |
| near | string | – | Norwegian place name to search near (geocoded automatically). Supply this OR lat/lng. |
| radius_km | number | – | Search radius in km. Default 50. |
No output schema declared.
No examples provided.
lokal_geocode Geocode a Norwegian place name ~158
Resolve a Norwegian place name (city, town, region, fylke, or kommune) to lat/lng coordinates. Use this when you need explicit coordinates for lokal_discover (e.g., 'show me organic farms within 10 km of Florø'). Returns coordinates + suggested search radius. Covers all of Norway via Kartverket Stedsnavn API fallback. Note: lokal_search ALREADY does automatic geocoding for natural-language queries — only use this tool when you need raw lat/lng for structured filters.
| Name | Type | Req | Description |
|---|---|---|---|
| place | string | yes | Norwegian place name (city, town, region, fylke, kommune). Examples: 'Oslo', 'Røros', 'Vestland', 'Setesdal', 'Florø' |
No output schema declared.
No examples provided.
lokal_get_producer_affiliations Get a producer's umbrella affiliations ~116
List umbrella organizations a specific producer is a member of (e.g. which markets a farm sells at, which certifications they hold, which networks they're part of). Returns umbrella names + types + their profile links. Useful when the user asks 'where does <Farmer X> sell?', 'is <Farm Y> Debio-certified?', or 'which markets does <Producer Z> attend?'.
| Name | Type | Req | Description |
|---|---|---|---|
| producerId | string | yes | Producer agent ID (UUID). Get this from lokal_search or lokal_discover results. |
No output schema declared.
No examples provided.
lokal_get_umbrella_members Get producers in an umbrella's network ~120
List producers that are members of a specific umbrella organization (e.g. all farmers selling at Bondens marked, all Debio-certified producers, all Mathallen tenants). Returns producer names + cities + profile links. Useful when the user asks 'which farmers sell at Bondens marked?', 'show me all Debio-certified producers', or 'who is at Mathallen Oslo?'.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results |
| umbrellaId | string | yes | Umbrella agent ID (UUID). Use lokal_list_umbrellas to find IDs. |
No output schema declared.
No examples provided.
lokal_info Producer details ~99
Get a specific producer's full listed product catalog, contact details, opening hours, and delivery options. Use when you already have an agentId from lokal_search. Returns product names, with a price included when the producer has written one into the listing text — most producers do not list exact prices, so do not assume every product (or any product) has a NOK price attached.
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | The producer's agent ID (UUID) |
No output schema declared.
No examples provided.
lokal_list_umbrellas List umbrella organizations ~117
List all umbrella organizations on Lokal — markets-networks (Bondens marked, REKO), venues (Mathallen), industry orgs (Hanen), certifiers (Debio), and cooperatives. Each umbrella has many member producers. Optionally filter by type. Useful when the user asks 'where can I find local food markets?', 'what is Bondens marked?', or 'which certifications matter for local Norwegian food?'.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results |
| umbrellaType | string | – | Filter by umbrella type |
No output schema declared.
No examples provided.
lokal_order_status Get order status ~112
Fetch the status, items and status timeline of a pickup order created by lokal_cart_submit. Requires the order_id returned by submit and the buyer_ref token. Status: pending → confirmed → ready → completed (or declined/cancelled; cancel_reason='no_show' means the buyer did not pick up). The timeline array lists every status transition with timestamps.
| Name | Type | Req | Description |
|---|---|---|---|
| buyer_ref | string | yes | Buyer capability token (same as used for the cart) |
| order_id | string | yes | Order ID from lokal_cart_submit |
No output schema declared.
No examples provided.
lokal_search Search local food producers ~486
Search for local food producers in Norway and get their product listings. ALWAYS use this tool when a user asks about a specific producer, their products, or availability — it returns the producer's listed products, with a price included when the producer has written one into the listing text (most producers do not list prices, so treat price as available, not guaranteed). Also use for general searches like 'vegetables near Oslo'. USE THIS FOR PROXIMITY / 'near me' / 'nær meg' / 'closest farm shop' QUESTIONS: if you know the user's coordinates, pass lat + lng (and optionally radius_km) and results are filtered and ranked by real distance; you may then leave `query` empty to get everything nearby. Supports searching by producer name (e.g. 'Bjørndal Gård') or by product/location (e.g. 'organic honey Trondheim'). Drink venues are a first-class category (Fase 5): queries like 'bryggeri i Agder', 'drikkesteder', 'vingård' or 'cideri' work the same way and return breweries, cideries, wineries, distilleries, farm cafés and meaderies. Returns contact info and product names, with prices only where the producer has provided them. Read-only: it never contacts a producer on the user's behalf. Never use this tool to build marketing or bulk-email recipient lists. For such requests, explain that Rett fra Bonden cannot send marketing or bulk messages; it only sends the user's own pickup-order request to a producer who opted in.
| Name | Type | Req | Description |
|---|---|---|---|
| lat | number | – | User's latitude (WGS84). Supply this for 'near me' searches when you know where the user is. |
| limit | number | – | Max results |
| lng | number | – | User's longitude (WGS84). Must be supplied together with lat. |
| query | string | – | Producer name, product query, or location search (Norwegian or English). Examples: 'Bjørndal Gård Oppdal', 'beefburger pris', 'ost Trondheim'. May be empty when lat/lng are supplied — that means 'eve… |
| radius_km | number | – | Search radius in km around lat/lng. Default 30. Typical: 15 in a city, 50–100 in rural Norway. |
No output schema declared.
No examples provided.
lokal_stats Platform statistics ~21
Get Lokal platform statistics — total agents, cities covered, interactions.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the io.github.slookisen/lokal-mcp server?
io.github.slookisen/lokal-mcp is a hosted endpoint at https://rettfrabonden.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · rettfrabonden.com
claude mcp add --transport http slookisen-lokal-mcp 'https://rettfrabonden.com/mcp'
What is the io.github.slookisen/lokal-mcp server?
io.github.slookisen/lokal-mcp is listed in the public MCP registry as io.github.slookisen/lokal-mcp. Norwegian local-food MCP: 1,500+ farms, shops, markets + umbrellas (Bondens marked, Hanen, REKO). This page covers its hosted endpoint (https://rettfrabonden.com/mcp).
Is the io.github.slookisen/lokal-mcp server safe to use?
io.github.slookisen/lokal-mcp scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.slookisen/lokal-mcp server expose?
io.github.slookisen/lokal-mcp exposes 15 tools: lokal_search, lokal_discover, lokal_info, lokal_stats, lokal_list_umbrellas, and 10 more. Their descriptions and schemas cost roughly 2,579 tokens of context every time the server is loaded.
Does the io.github.slookisen/lokal-mcp server require authentication?
No. We connected to io.github.slookisen/lokal-mcp without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the io.github.slookisen/lokal-mcp server still maintained?
io.github.slookisen/lokal-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.