.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/openstreetmap-mcp-server</h1> <p><b>Geocode, reverse geocode, and run Overpass spatial queries on OpenStreetMap data via MCP. STDIO or Streamable HTTP.</b> <div>6 Tools</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://openstreetmap.caseyjhand.com/mcp
</div>
6 tools for geocoding and spatial queries against OpenStreetMap data:
| Tool | Description |
|---|---|
openstreetmap_geocode | Convert a place name or address to geographic coordinates and structured place data |
openstreetmap_reverse | Convert latitude/longitude coordinates to the nearest address or place name |
openstreetmap_lookup | Fetch address details for one or more known OSM objects by their IDs |
openstreetmap_query_nearby | Find OSM features within a radius around a geographic point |
openstreetmap_query_bbox | Find OSM features within a rectangular bounding box |
openstreetmap_query_raw | Execute a raw Overpass QL query for advanced spatial operations |
openstreetmap_geocodeConvert a place name or address to geographic coordinates via Nominatim/OpenStreetMap.
"Space Needle Seattle") or structured address fields (street, city, state, country, postal code) — mutually exclusivecountrycodes)openstreetmap_lookupopenstreetmap_reverseConvert latitude/longitude to the nearest address or named place.
openstreetmap_lookupFetch full Nominatim address records for known OSM object IDs.
"N240109189", "W50637691", "R146656"not_found list for IDs that returned no resultopenstreetmap_query_nearbyFind OSM features within a radius around a point via the Overpass API.
amenity shortcut for common POI types (hospital, pharmacy, restaurant, cafe, school, atm) or tag_key + tag_value for any OSM category (leisure=park, shop=supermarket, natural=peak)truncated flag signals when more existopenstreetmap_query_bboxFind OSM features within a rectangular geographic bounding box.
amenity / tag_key + tag_value interface as openstreetmap_query_nearbytruncated flagopenstreetmap_query_rawExecute arbitrary Overpass QL for queries the convenience tools don't cover.
[out:json]; server injects [timeout:N] if absentBuilt on @cyanheads/mcp-ts-core:
none, jwt, oauth)in-memory, filesystem, Supabase, Cloudflare KV/R2/D1Nominatim/Overpass-specific:
User-Agent via OSM_USER_AGENT, rate-limit-aware request handlingData © OpenStreetMap contributors, ODbL 1.0)OSM_NOMINATIM_BASE_URL and OSM_OVERPASS_BASE_URL for self-hosted or mirror endpointsno_results, no_coverage, invalid_id_format, invalid_tag, query_timeout, rate_limited, query_error, result_too_large — all with actionable recovery hintsAgent-friendly output:
osm_type + osm_id that feed directly into openstreetmap_lookup for full address recordsAdd the following to your MCP client configuration file.
{
"mcpServers": {
"openstreetmap-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/openstreetmap-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"openstreetmap-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/openstreetmap-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpOSM_NOMINATIM_BASE_URL and OSM_OVERPASS_BASE_URL at self-hosted or mirror instances.git clone https://github.com/cyanheads/openstreetmap-mcp-server.gitcd openstreetmap-mcp-serverbun installAll configuration is validated at startup via Zod schemas in src/config/server-config.ts. Key environment variables:
| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | HTTP server port | 3010 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path where the MCP server is mounted | /mcp |
MCP_PUBLIC_URL | Public origin override for TLS-terminating reverse-proxy deployments | none |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth | none |
MCP_LOG_LEVEL | Log level (debug, info, warning, error, etc.) | info |
MCP_GC_PRESSURE_INTERVAL_MS | Opt-in Bun-only forced-GC pressure loop (ms). Recommended starting point if heap growth is observed: 60000. | 0 (disabled) |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1 | in-memory |
OSM_NOMINATIM_BASE_URL | Nominatim API base URL. Override for a private or mirror instance. | https://nominatim.openstreetmap.org |
OSM_OVERPASS_BASE_URL | Overpass API endpoint URL. Override for a mirror or private instance. | https://overpass-api.de/api/interpreter |
OSM_USER_AGENT | User-Agent sent to Nominatim and Overpass. Required by usage policy. | openstreetmap-mcp-server/0.1.8 |
OTEL_ENABLED | Enable OpenTelemetry | false |
# One-time build
bun run rebuild
# Run the built server
bun run start:http
# or
bun run start:stdio bun run devcheck # Lints, formats, type-checks, and more
bun run test # Runs the test suite| Directory | Purpose |
|---|---|
src/mcp-server/tools | Tool definitions (*.tool.ts). Six tools across Nominatim and Overpass. |
src/services/nominatim | Nominatim service layer — API client, search, reverse, lookup. |
src/services/overpass | Overpass service layer — query builder, executor, element normalizer. |
src/config | Server-specific environment variable parsing and validation with Zod. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for logging, ctx.state for storagecreateApp() arraysIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testThis project is licensed under the Apache 2.0 License. See the LICENSE file for details.
Map data from OpenStreetMap contributors, available under the Open Database License (ODbL).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.