openstreetmap-mcp-server-216ddf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited openstreetmap-mcp-server-216ddf (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/openstreetmap-mcp-server</h1> <p><b>Geocode, reverse geocode, and run Overpass spatial queries on OpenStreetMap data via MCP. STDIO or Streamable HTTP.</b> <div>6 Tools</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://openstreetmap.caseyjhand.com/mcp
</div>
OpenStreetMap data through Nominatim and the Overpass API. Geocode places and addresses, resolve coordinates to the nearest address, look up known OSM objects, and query features by tag around a point, inside a bounding box, or inside an OSM boundary.
| Tool | Description |
|---|---|
openstreetmap_search_places | Convert a place name or address to coordinates and structured place data |
openstreetmap_reverse_geocode | Convert latitude/longitude to the nearest address or place name |
openstreetmap_lookup_objects | Fetch address records for known OSM objects by ID |
openstreetmap_query_nearby | Find OSM features within a radius of a point |
openstreetmap_query_bbox | Find OSM features inside a bounding box or an OSM boundary such as a city, park, or region |
openstreetmap_query_raw | Run a raw Overpass QL query for anything the other tools cannot express |
The openstreetmap-guide skill covers place resolution, spatial queries, paging, and interpreting coverage and tag results.
Argument aliases are accepted before canonical validation: latitude / longitude for lat / lon on nearby and reverse queries, radius_m for nearby's radius_meters, and q for search's query. Send either spelling, never both. radius, tag, and tags remain invalid; advertised schemas use canonical names.
openstreetmap_search_places <sub>tool</sub>query or the structured fields street, city, county, state, country, postalcode, never both; up to 40 results (limit, default 5; a larger limit is served as 40 with a limitNotice), narrowed by countrycodes, layer, featureType, and a viewbox (restricting with bounded: true)address, boundingbox, importance, and osm_type + osm_id; extratags adds contact and physical-attribute tags; an empty first page fails as no_resultsnextExcludeIds to pass back as exclude_place_ids; once results run out you get zero results and a notice, not an erroropenstreetmap_reverse_geocode <sub>tool</sub>lat / lon plus zoom from 3 (country) to 18 (building, the default); layer defaults to address,poiaddress, osm_type + osm_id, and boundingbox; coordinates with no OSM data fail as no_coverageopenstreetmap_lookup_objects <sub>tool</sub>osm_ids entries, each prefixed N, W, or R (["N240109189"]); a malformed ID fails as invalid_id_formatdeferred_ids for the next callnot_found (including objects Nominatim does not index, such as street lamps); a notice carries an openstreetmap_query_raw query to check which existopenstreetmap_query_nearby <sub>tool</sub>lat / lon with radius_meters up to 50,000 (default 1,000); one primary tag, amenity or tag_key with an optional tag_value, plus up to five ANDed filters; up to 500 features per page (a larger limit is served as 500 with a limitNotice)list_item mode (tag_value_match, or match on a filter) matches one item of a semicolon list, so cuisine = pizza also finds cuisine=pizza;italianamenity value that OpenStreetMap tags under another key (amenity: "museum"; museums are tourism=museum) gets a notice naming the key to retry withosm_type + osm_id, coordinates, distance_meters (to the feature's nearest point), and the full tag set, sorted nearest-first; effectiveTag echoes the filter chainopenstreetmap_query_bbox <sub>tool</sub>south, west, north, east, or within and one R/W boundary ref (R237385) built from a geocoding result's osm_type + osm_id; the same tag filters, list-item matching, stray-amenity notice, and 500-per-page cap as openstreetmap_query_nearbyeffectiveArea echoes how within resolved and areasTimestamp how old the area data is; a ref that maps to no area returns an empty page with a noticewest greater than east is a box crossing the antimeridian; south greater than north fails as invalid_bboxopenstreetmap_query_raw <sub>tool</sub>[out:json]; [timeout:N] comes from timeout_seconds (up to 180, default 30) and [maxsize:268435456] (256 MiB) is added when the query sets none; up to 500 elements per page (a larger limit is served as 500 with a limitNotice)nodes[], relations members[]), plus total_elements and the effectiveQuery as sent; malformed QL fails as query_error with Overpass's parse errormax_element_bytes (default 20,000, minimum 1,000) withholds an over-budget element's members, nodes, or geometry arrays, listed under withheld_keys; withheldElements and withheldNotice say how to fetch themBuilt on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.
OpenStreetMap-specific:
OSM_USER_AGENT identifies the server to both upstreamsOSM_OVERPASS_MAX_CONCURRENCY, with opt-in failover across OSM_OVERPASS_ENDPOINTS (see Overpass endpoint failover)limit and offset and report totalFound, truncated, and nextOffset; results are cached for 10 minutes (Nominatim for 60), so re-paging makes no new upstream requestresult_too_largeOSM_NOMINATIM_BASE_URL and OSM_OVERPASS_BASE_URL point the server at a self-hosted or mirror instanceAgent-friendly output:
effectiveQuery, effectiveTag, and effectiveArea echo what was sent; Overpass responses add data_timestamp and servingEndpoint, and every response carries the ODbL attributionosm_type + osm_id from any tool feed openstreetmap_lookup_objects, and a geocoded relation or way becomes a within ref for openstreetmap_query_bboxtagSelectionCaveat says so; regex, alternation, and negation go through openstreetmap_query_rawstructuredContent keeps the raw textConnect to the hosted instance, no install:
claude mcp add --transport http openstreetmap-mcp-server https://openstreetmap.caseyjhand.com/mcpOr run it locally:
claude mcp add openstreetmap-mcp-server -- npx -y @cyanheads/openstreetmap-mcp-serverFor other clients, add this to the MCP config file:
{
"mcpServers": {
"openstreetmap-mcp-server": {
"command": "npx",
"args": ["-y", "@cyanheads/openstreetmap-mcp-server"]
}
}
}No API key is required. For heavy use, point OSM_NOMINATIM_BASE_URL and OSM_OVERPASS_BASE_URL at your own instances. For Docker or a source build, see Running the server.
| Variable | Description | Default |
|---|---|---|
OSM_NOMINATIM_BASE_URL | Nominatim base URL. A path prefix such as https://maps.example.com/nominatim is supported. | https://nominatim.openstreetmap.org |
OSM_OVERPASS_BASE_URL | Pins every query to one Overpass endpoint and disables failover. | unset |
OSM_OVERPASS_ENDPOINTS | Comma-separated, ordered Overpass endpoints; more than one enables failover. Ignored when OSM_OVERPASS_BASE_URL is set. | https://overpass-api.de/api/interpreter |
OSM_OVERPASS_MAX_CONCURRENCY | Max Overpass queries in flight per endpoint. Public instances allow one per user. | 1 |
OSM_USER_AGENT | User-Agent sent to Nominatim and Overpass. Required by usage policy. | openstreetmap-mcp-server/<package version> |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | HTTP server port. | 3010 |
MCP_SESSION_MODE | HTTP session mode: stateless, stateful, or auto. The server declares stateless in code; an explicit value overrides it. | stateless |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (debug, info, warning, error, etc.). | info |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1. | in-memory |
OTEL_ENABLED | Enable OpenTelemetry. | false |
See .env.example for the full list of optional overrides. An invalid value for any OSM_* variable stops the server at startup with a message naming the variable.
By default every Overpass query goes to one endpoint, the FOSSGIS-operated main instance. List more in OSM_OVERPASS_ENDPOINTS and a failed call moves to the next entry in order:
OSM_OVERPASS_ENDPOINTS="https://overpass-api.de/api/interpreter,https://overpass.private.coffee/api/interpreter"rate_limited, upstream_error, overpass_unavailable, endpoints_rejected, endpoints_exhausted, or endpoints_unavailable, with each endpoint's outcome in the messagehttps://overpass-api.de) in servingEndpoint, error messages, and logs|N to its entry (https://mirror.example/api/interpreter|4) for N slots; write a literal | in a URL as %7C. Never size a public FOSSGIS serverpacer_shed and a retryAfter of at least 30 seconds after 30 seconds in lineAdding an endpoint sends your queries to a third party. Check its usage policy on the OSM wiki instance list, confirm it holds global data (a regional instance answers out-of-extract queries with an empty HTTP 200), and expect mirrors to lag the main instance; servingEndpoint and data_timestamp show which host answered and how fresh its data was.
Requires Bun v1.4.0 or higher (or Node.js v24+).
git clone https://github.com/cyanheads/openstreetmap-mcp-server.git
cd openstreetmap-mcp-server && bun install
cp .env.example .env
# edit .env to override endpoints or the User-Agent as needed # One-time build
bun run rebuild
# Run the built server
bun run start:http
# or
bun run start:stdio bun run devcheck # Lints, formats, type-checks, and more
bun run test # Runs the test suitedocker run --rm -p 3010:3010 ghcr.io/cyanheads/openstreetmap-mcp-server:latest
# or build locally
docker build -t openstreetmap-mcp-server .
docker run --rm -p 3010:3010 openstreetmap-mcp-serverThe image serves HTTP at http://localhost:3010/mcp in stateless session mode and logs to /var/log/openstreetmap-mcp-server. OpenTelemetry peer dependencies are installed by default; build with --build-arg OTEL_ENABLED=false to omit them. Runtime telemetry stays off until you pass -e OTEL_ENABLED=true.
| Directory | Purpose |
|---|---|
src/mcp-server/tools | Tool definitions (*.tool.ts) and shared input, formatting, and escaping helpers. Six tools across Nominatim and Overpass. |
src/services/nominatim | Nominatim service: paced API client for search, reverse, and lookup, plus error parsing. |
src/services/overpass | Overpass service: query builder, endpoint failover and executor, element normalizer, error parsing. |
src/config | Server-specific environment variable parsing and validation with Zod. |
tests/ | Unit and integration tests for tools, services, and security. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for logging, ctx.state for storagecreateApp() arrays in src/index.tsIssues are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
Map data from OpenStreetMap contributors, available under the Open Database License (ODbL).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.