v0.9.0 — Deutsche Bahn on open data, import-time probe, honest keyless count

Deutsche Bahn works again, on open data

The Deutsche Bahn adapter no longer scrapes bahn.de through db-rest (Deutsche Bahn blocks datacenter IPs; the cloud had not completed a call since 30 August). It now talks to a MOTIS routing engine loaded with the open gtfs.de train timetable (every ICE, IC, EC, regional train and S-Bahn, CC BY 4.0) and a GTFS-RT feed for live delays, platform changes and cancellations.

• deploy/motis: a ready-to-run image (official MOTIS + feed download, import and weekly refresh). About 12 MB of GTFS, a one-second import, ~100 MB of RAM. The cloud runs it as an internal service; self-hosters enable it with COMPOSE_PROFILES=motis (see deploy/motis/README.md).
• Five tools rewritten against the MOTIS v1 API with response mappings: a departure board is now ~2 KB instead of 12 KB, and carries realTime, cancelled and live vs scheduled times.
• MOTIS_URL is filled in automatically wherever the operator runs MOTIS (MOTIS_INTERNAL_URL), and asked for otherwise. Transitous is never the default: its policy forbids commercial use.
• New adapter deutsche-bahn-timetables: Deutsche Bahn's official Timetables API (free key, 60 requests/minute) for planned station boards and the live change feed. The REST engine now parses XML responses into objects so response mapping applies to them.

Installed connectors on the cloud are migrated; self-hosters re-sync the connector from the catalog and enter a MOTIS_URL.

The "no API key" number is now checked

scripts/probe-keyless.mjs calls one real tool of every keyless adapter from a GitHub runner (a datacenter address, like any hosted deployment) every week and fails when one answers with a bot wall or a login demand. Eight adapters that only work from residential IPs — Vinted, Untappd, DPD, Idealista, Reddit, Sorare, Trenitalia, OpenTable — are marked selfHostOnly: still available self-hosted, hidden on the cloud, and out of the advertised count. 189 adapters, 20 of which need no API key.

Activation

• Importing an adapter now runs one read-only call with the credentials you entered and reports the result on the install form, so a wrong token is caught on the spot rather than by the agent days later. Adapters declare the call with a probe field.
• The page that shows a server's MCP endpoint records what people do there (product_events), so the step between "connector attached" and "first request" can be measured.
• The activation reminder links to the MCP server page with client instructions when a server already exists.
• Trials past their end date are now marked expired (access was already blocked at runtime; the status column was never transitioned).
• Catalog re-sync applies a catalog response mapping to tools that have none.

Also

• SSRF_ALLOWED_HOSTS and MOTIS_INTERNAL_URL documented in docker-compose.yml.
• CodeQL configuration file added.

Upgrade notes: run prisma migrate deploy (one new table, product_events). Cloud operators replace the db-rest service with motis as in docker-compose.cloud.yml.