
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
@pipeworx/mcp-overture-places
Advanced tools
Overture Maps places — business and point-of-interest locations (name, category, confidence, address, websites, phones, socials, brand) for the United States and the United Kingdom, from the Overture Maps Foundation places theme (CDLA-Permissive-2.0 / Apa
Business and point-of-interest locations in the United States and the United Kingdom, from the Overture Maps Foundation places theme. Each place carries a name, category, existence confidence score, street address, websites, phones, emails, social links, brand and contributing source record ids. Use it to find places near a point or in a city, to map every location of a company by its website domain, and to count what is in an area.
Part of Pipeworx — an MCP gateway connecting AI agents to 1867+ live data sources. This is an independent, unofficial integration — not affiliated with, endorsed by, or published by the upstream provider.
places_search(name?, category?, near{lat,lon} + radius_m | bbox | city + country [+ region], min_confidence?, include_closed?, limit?):
businesses matching a name and/or category. Results are ranked by match
quality and then by distance (for near) or confidence. Example: the
Starbucks branches within 3 km of downtown Austin.places_by_domain(domain, country?, region?, min_confidence?, include_closed?, limit?):
every location whose website is on a company's domain, which gives that
company's physical footprint. Subdomains and paths fold to the registrable
domain (https://www.starbucks.com/store-locator → starbucks.com). Returns
the total plus counts by country and by state/region.places_in_area(near + radius_m | bbox | city + country, category?, min_confidence?, include_closed?, limit?):
the count of places in an area, a breakdown by category, and the
highest-confidence places.Every response starts with attribution, a source block (licence, release,
terms URL) and data_as_of, which is the Overture release the answer came
from (for example 2026-09-23.1).
Overture gives every place an existence confidence from 0 to 1 and calls it
"the primary tool for filtering potential junk data". By default this pack
hides places below 0.7, and places marked permanently_closed. In the
measured sample the distribution breaks sharply at 0.7, and the rows below it
were mostly junk. The default keeps about 68% of places. Every place shows its
confidence, and every response states the threshold it applied and how many
places it hid (hidden_by_filters). To see everything, pass
min_confidence: 0 and include_closed: true.
found:false, reason:"outside_coverage" and lists the covered countries.complete:false and explains in
coverage_warning what was not searched. places_in_area still gives exact
or bounded totals from its index. Narrow the area with near + radius_m
for a complete answer.region field is consistent in the US (state codes; full state names are
accepted too) but inconsistent in the UK, so leave region out for UK
cities. A name that matches several places (several Springfields) uses the
largest and lists the others in other_places_with_this_name.places_by_domain refuses them
with reason:"platform_domain".locations_listing_domain and says when the cap applied.Keyless. The pack answers only through the Pipeworx gateway
(https://gateway.pipeworx.io/mcp). A standalone install has no Overture
release to read, so every call fails with an error that says so.
s3://overturemaps-us-west-2/release/<release>/theme=places/type=place/.
The overture-places-ingest workflow checks for a new release every week
(design: docs/overture-places-design.md).The places theme is published under CDLA-Permissive-2.0 and Apache-2.0, depending on the source. Redistribution is permitted, including commercial use, with attribution. Overture states that the theme contains no OpenStreetMap data, so ODbL does not apply. Attribution, as Overture publishes it (https://docs.overturemaps.org/attribution/):
© Overture Maps Foundation (https://overturemaps.org), places theme. Data from Meta. Available under CDLA Permissive 2.0. Data from Microsoft. Available under CDLA Permissive 2.0. Data from PinMeTo. Available under CDLA Permissive 2.0. Data from Krick. Available under CDLA Permissive 2.0. Data from RenderSEO. Available under CDLA Permissive 2.0. Data from DAC. Available under CDLA Permissive 2.0. Data from BrightQuery. Available under CDLA Permissive 2.0. Data from Foursquare. Copyright 2024 Foursquare Labs, Inc. All rights reserved. Available under Apache 2.0. Foursquare data was transformed to the Overture schema. Data from AllThePlaces. Available under CC0 1.0.
Each response's attribution names the Overture release and the per-source
credit lines for the sources in that response. Each place lists its own
contributing datasets in sources and their licences in source_licenses.
Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
{
"mcpServers": {
"overture-places": {
"url": "https://gateway.pipeworx.io/overture-places/mcp"
}
}
}
tools/list at https://gateway.pipeworx.io/overture-places/mcp returns the tools in the table
above plus the shared Pipeworx meta-tools — ask_pipeworx,
discover_tools, search_within, remember/recall and the rest of the
gateway-wide set. So the tool count you see is larger than this table: a
single-pack endpoint currently lists roughly 30 shared tools alongside the
pack's own. The connection's initialize response states its exact scope, and
is the authoritative answer for a given day.
This is deliberate, not multiplexing by accident. The meta-tools are what let a
scoped connection answer a question this pack does not cover — via
ask_pipeworx, which routes across the whole catalog — without you adding a
second MCP server. There is currently no way to mount a pack endpoint without
them; if the extra schemas cost you more context than the routing is worth,
connect to the full gateway once rather than to several pack endpoints.
Or connect to the full Pipeworx gateway to get every pack's tools listed directly, instead of just this one's:
{
"mcpServers": {
"pipeworx": {
"url": "https://gateway.pipeworx.io/mcp"
}
}
}
Both URLs reach the same gateway and the same 1867+ data sources. The
only difference is which pack's tools are listed directly; ask_pipeworx
reaches all of them from either one.
curl -X POST https://gateway.pipeworx.io/v1/tools/places_search \
-H 'Content-Type: application/json' \
-d '{"name":"Starbucks","near":{"lat":30.2672,"lon":-97.7431},"radius_m":3000,"limit":5}'
No account needed for the first calls. Inspect any tool: GET https://gateway.pipeworx.io/v1/tools/places_search. Find one: POST https://gateway.pipeworx.io/v1/tools/search_packs with {"query":"..."}.
@pipeworx/mcp-overture-places is a local stdio bridge to the Pipeworx gateway: your MCP client
starts it with npx, and it forwards every call to the same
https://gateway.pipeworx.io/overture-places/mcp endpoint shown above. It needs network access;
there is no offline mode.
{
"mcpServers": {
"overture-places": {
"command": "npx",
"args": ["-y", "@pipeworx/mcp-overture-places"]
}
}
}
Without a key it calls anonymously, capped at 50 calls a day. A free account
raises that to 200 a day: get a key at https://pipeworx.io/signup and add
"env": { "PIPEWORX_API_KEY": "<your key>" } to the server entry.
The key is sent as a Bearer token, the same way a hosted connection sends it,
so calls are metered and billed exactly as they are there.
It lists only this pack's tools by default. Set PIPEWORX_META_TOOLS=1 to
also list ask_pipeworx and the other gateway-wide tools.
Behind an HTTPS proxy: Node's built-in fetch does not read HTTPS_PROXY by
default. Newer Node releases honour it when NODE_USE_ENV_PROXY=1 is set; check
your Node version's documentation.
Instead of calling tools directly, you can ask questions in plain English — this works on the pack endpoint above as well as on the full gateway:
ask_pipeworx({ question: "your question about Overture Places data" })
The gateway picks the right tool and fills the arguments automatically.
MIT
FAQs
Overture Maps places — business and point-of-interest locations (name, category, confidence, address, websites, phones, socials, brand) for the United States and the United Kingdom, from the Overture Maps Foundation places theme (CDLA-Permissive-2.0 / Apa
We found that @pipeworx/mcp-overture-places demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.