hooks 100/100 — SaferSkills

Is hooks safe to install?

SaferSkills independently audited hooks (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md8.9 KB · Markdown

<h1>Cesium MCP</h1>

The minimum-overhead way to add AI commands to CesiumJS

<a href="packages/cesium-mcp-bridge/">cesium-mcp-bridge</a> is a protocol-agnostic command dispatcher with 60+ tools, drivable from browser-only agents, function calling, or MCP — your choice.

Three entry points: <a href="examples/browser-agent/">Browser Agent</a> (simplest, zero backend) · function calling (embed in your web app) · <a href="packages/cesium-mcp-runtime/">MCP runtime</a> (Claude Desktop / Cursor / Dify)

<a href="https://cesium-browser-agent.pages.dev/">Try it now</a> — open the live browser demo, no install, no signup.

<a href="https://gaopengbin.github.io/cesium-mcp/">Website</a> · <a href="README.zh-CN.md">中文</a> · <a href="https://gaopengbin.github.io/cesium-mcp/guide/getting-started.html">Getting Started</a> · <a href="https://gaopengbin.github.io/cesium-mcp/api/bridge.html">API Reference</a>

Demo

https://github.com/user-attachments/assets/8a40565a-fcdd-47bf-ae67-bc870611c908

Packages & Entry Points

Module	Role	Status	Links
cesium-mcp-bridge	Protocol-agnostic command dispatcher (60+ tools)	Mainline, actively iterated	· source
examples/browser-agent	Browser-only AI agent (recommended starting point, zero backend)	Recommended	example · live demo
cesium-mcp-runtime	MCP server (stdio + HTTP)	Stable, slow updates	· source
cesium-mcp-dev	CesiumJS API knowledge base for coding assistants	Maintained	· source

Which one? Personal project or quick try → browser-agent. Existing web app embedding an AI assistant → bridge + your own function calling. Calling from Claude Desktop / Cursor / Dify → MCP runtime.

Architecture

flowchart LR
  subgraph clients ["AI Drivers (pick one)"]
    BA["Browser Agent\n(in the same page)"]
    FC["Your web app\nfunction calling"]
    MCP["Claude / Cursor / Dify\nvia MCP runtime"]
  end

  subgraph core ["cesium-mcp-bridge (browser)"]
    B["60+ tools\nprotocol-agnostic dispatcher"]
    C["CesiumJS Viewer"]
  end

  BA -- "in-page call" --> B
  FC -- "in-page call" --> B
  MCP -- "WebSocket / JSON-RPC" --> B
  B --> C

  style clients fill:#1e293b,stroke:#528bff,color:#e2e8f0
  style core fill:#1e293b,stroke:#12B76A,color:#e2e8f0

The bridge is the only required piece. Pick whichever driver matches your scenario — they all hit the same 60+ tools.

Quick Start

Path 0 — Try in 30 seconds (browser agent, recommended)

Open the live demo, paste an OpenAI-compatible API key, and ask:

"Fly to the Eiffel Tower and drop a red marker"

Fork the examples/browser-agent folder to deploy your own.

Path 1 — Embed in your own web app (function calling)

npm install cesium-mcp-bridge

import { CesiumBridge } from 'cesium-mcp-bridge';

const bridge = new CesiumBridge(viewer);
// Then: send the bridge's tool schema to any LLM that supports function/tool calling,
// route the model's tool calls to bridge.execute(name, params).

See examples/browser-agent/index.html for a complete loop with OpenAI-compatible APIs.

Path 2 — Use from Claude Desktop / Cursor / Dify (MCP)

Install bridge as in Path 1, then start the MCP runtime:

# stdio mode (Claude Desktop, VS Code, Cursor)
npx cesium-mcp-runtime

# HTTP mode (Dify, remote/cloud MCP clients)
npx cesium-mcp-runtime --transport http --port 3000

MCP client config:

{
  "mcpServers": {
    "cesium": {
      "command": "npx",
      "args": ["-y", "cesium-mcp-runtime"]
    }
  }
}

58 Available Tools

Tools are organized into 12 toolsets. Default mode enables 4 core toolsets (~31 tools). Set CESIUM_TOOLSETS=all for everything, or let the AI discover and activate toolsets dynamically at runtime.

i18n: Tool descriptions default to English. Set CESIUM_LOCALE=zh-CN for Chinese.

Toolset	Tools
view (default)	`flyTo`, `setView`, `getView`, `zoomToExtent`, `saveViewpoint`, `loadViewpoint`, `listViewpoints`, `exportScene`
entity (default)	`addMarker`, `addLabel`, `addModel`, `addPolygon`, `addPolyline`, `updateEntity`, `removeEntity`, `batchAddEntities`, `queryEntities`, `getEntityProperties`
layer (default)	`addGeoJsonLayer`, `listLayers`, `removeLayer`, `clearAll`, `setLayerVisibility`, `updateLayerStyle`, `getLayerSchema`, `setBasemap`
interaction (default)	`screenshot`, `highlight`, `measure`
camera	`lookAtTransform`, `startOrbit`, `stopOrbit`, `setCameraOptions`
entity-ext	`addBillboard`, `addBox`, `addCorridor`, `addCylinder`, `addEllipse`, `addRectangle`, `addWall`
animation	`createAnimation`, `controlAnimation`, `removeAnimation`, `listAnimations`, `updateAnimationPath`, `trackEntity`, `controlClock`, `setGlobeLighting`
tiles	`load3dTiles`, `loadTerrain`, `loadImageryService`, `loadCzml`, `loadKml`
trajectory	`playTrajectory`
heatmap	`addHeatmap`
scene	`setSceneOptions`, `setPostProcess`
geolocation	`geocode`

Relationship with CesiumGS official MCP servers: The camera, entity-ext, and animation toolsets natively fuse capabilities from CesiumGS/cesium-mcp-server (Camera Server, Entity Server, Animation Server) into this project's unified bridge architecture. This means you get all official functionality plus additional tools — in a single MCP server, without running multiple processes.

Examples

See examples/minimal/ for a complete working demo.

Development

git clone https://github.com/gaopengbin/cesium-mcp.git
cd cesium-mcp
npm install
npm run build

Version Policy

Version format: {CesiumMajor}.{CesiumMinor}.{MCPPatch}

Segment	Meaning	Example
`1.139`	Tracks CesiumJS version — built & tested against Cesium `~1.139.0`	`1.139.8` → Cesium 1.139
`.8`	MCP patch — independent iterations for new tools, bug fixes, docs	`1.139.7` → `1.139.8`

When CesiumJS releases a new minor version (e.g. 1.140), we will bump accordingly: 1.140.0.

mapbox-mcp — AI control for Mapbox GL JS
openlayers-mcp — AI control for OpenLayers

Star History

License

MIT

hooks— hook

Is hooks safe to install?

Demo

Packages & Entry Points

Architecture

Quick Start

Path 0 — Try in 30 seconds (browser agent, recommended)

Path 1 — Embed in your own web app (function calling)

Path 2 — Use from Claude Desktop / Cursor / Dify (MCP)

58 Available Tools

Examples

Development

Version Policy

Star History

License

Audit the pieces. Scan the whole. Decide.

Is hooks safe to install?

Demo

Packages & Entry Points

Architecture

Quick Start

Path 0 — Try in 30 seconds (browser agent, recommended)

Path 1 — Embed in your own web app (function calling)

Path 2 — Use from Claude Desktop / Cursor / Dify (MCP)

58 Available Tools

Examples

Development

Version Policy

Related Projects

Star History

License

Audit the pieces. Scan the whole. Decide.