
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@showmeonmap/mcp
Advanced tools
MCP server for ShowMeOnMap — geospatial visualization tools for any MCP-speaking agent (Claude Desktop, Cursor, Zed, ChatGPT Apps SDK)
Model Context Protocol server for ShowMeOnMap. Lets any MCP-speaking agent — Claude Desktop, Cursor, Zed, Windsurf, ChatGPT Apps SDK, custom LangGraph / CrewAI / Autogen agents — build and mutate geospatial maps over a typed tool surface.
Spec: docs/superpowers/specs/2026-04-17-mcp-server-design.md (in the parent repo).
npx -y @showmeonmap/mcp
That's it. Or pin a version: npx -y @showmeonmap/mcp@0.2.0.
The server speaks standard MCP/stdio; it's a thin proxy to the ShowMeOnMap HTTP API. Point it at production with your API key (below), or at a local checkout (default: http://localhost:3000).
/pricing).smo_live_… key — it's shown once.Prefer no local process? Use the hosted remote endpoint directly — no install:
{
"mcpServers": {
"showmeonmap": {
"url": "https://showmeonmap.com/api/mcp",
"headers": { "Authorization": "Bearer smo_live_…" }
}
}
}
The hosted endpoint speaks streamable HTTP (stateless), is rate-limited to 30 requests/min per key, and works anywhere remote MCP servers do — Claude custom connectors, the OpenAI Responses API (server_url), Gemini managed agents (mcp_server), Cursor, Copilot Studio, Bedrock.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS):
{
"mcpServers": {
"showmeonmap": {
"command": "npx",
"args": ["-y", "@showmeonmap/mcp"],
"env": {
"SHOWMEONMAP_BASE_URL": "https://showmeonmap.com",
"SHOWMEONMAP_API_KEY": "smo_live_…"
}
}
}
}
Restart Claude Desktop. showmeonmap appears in the tools picker.
Cursor (~/.cursor/mcp.json), Zed, Windsurf, and any other MCP host follow the same shape — command: "npx", args: ["-y", "@showmeonmap/mcp"], plus the SHOWMEONMAP_BASE_URL + SHOWMEONMAP_API_KEY env. For local dev against a checkout, drop the key and set SHOWMEONMAP_BASE_URL=http://localhost:3000.
The package is a client; you also need a backend. From a checkout of the main repo:
SMO_DISABLE_AUTH=1 SMO_DISABLE_CREDIT_GATE=1 SMO_DISABLE_RATE_LIMIT=1 npm run dev
(In production, point SHOWMEONMAP_BASE_URL at the hosted backend instead.)
Ask Claude Desktop things like:
build_map, returns a map_id + structured responsemutate_map, applies a filterLayer opmutate_map with setBasemapoutOfScope triggers; Claude can fall back to build_mapclarification with candidatesV1 — natural-language tools (3): build_map, mutate_map, get_state.
V2 — direct-op tools (18): add_layer, filter_layer, clear_filters, remove_layer, rename_layer, restyle_layer, set_camera, set_time, set_basemap, select_within, subset_to_selection, query_features, add_annotation, remove_annotation, tag, undo, redo, report_blocker.
Every tool returns a three-channel envelope:
{
"ok": true,
"map_id": "…",
"version": 5,
"structured": { "workspace": {…}, "mapPlan": {…} },
"shareable_url": "http://localhost:3000/m/…",
"metadata": { "title": "…", "layer_count": 2, "last_updated": "…" },
"next_actions": [
{ "label": "Filter to features where name is not empty", "argsTemplate": { "instruction": "…" } }
],
"outOfScope": { "reason": "…" },
"clarification": { "question": "…", "candidates": [ … ] }
}
The calling agent reasons over structured, surfaces shareable_url to its end user for interactive drill-down, and uses next_actions as typed hints for follow-up tool calls.
For the full Op catalog and predicate grammar that the V2 tools accept, fetch the MCP resource at showmeonmap://docs/workspace-ops-spec — agents should not guess these shapes.
| Var | Default | Purpose |
|---|---|---|
SHOWMEONMAP_BASE_URL | http://localhost:3000 | Where the ShowMeOnMap HTTP API lives |
SHOWMEONMAP_API_KEY | (unset) | Your personal smo_live_… key — identifies you and spends your credits. Required against production; optional for a local dev checkout running with auth bypasses |
MCP_BLOCKER_LOG_PATH | reports/agent-blockers/<today>.ndjson (in the backend's cwd) | Where report_blocker tool calls are appended |
MCP_RATIONALE_LOG_PATH | reports/mcp-rationale/<today>.ndjson | Where typed-op rationales are persisted |
If you have the main repo cloned and want to run the unbuilt source:
npm --prefix packages/mcp-server install
npm --prefix packages/mcp-server run build
node packages/mcp-server/dist/index.js
The integration test (requires backend on localhost:3000):
npx tsx packages/mcp-server/__tests__/stdio-roundtrip.test.ts
Spawns a fresh server process, exercises initialize → tools/list → every tool over NDJSON-framed JSON-RPC, asserts envelope shape. Exits 0 with a "skipping" notice if the backend isn't reachable.
map_id → workspace mapping lives in the server process; restarts lose state. Phase I-3 (in the parent repo's plan) wires D1 persistence so shareable_url actually resolves across sessions.shareable_url points at the app's /m/<id> viewer, but workspaces aren't yet persisted in the gallery. Until I-3, share the raw structured response.https://showmeonmap.com/api/mcp (streamable HTTP, stateless). The standalone Node HTTP entry (packages/mcp-server/src/http.ts) remains for self-hosting a checkout.smo_live_…, minted at showmeonmap.com). The key travels as a bearer on every backend call and bills the key's owner.@modelcontextprotocol/sdkFAQs
MCP server for ShowMeOnMap — geospatial visualization tools for any MCP-speaking agent (Claude Desktop, Cursor, Zed, ChatGPT Apps SDK)
The npm package @showmeonmap/mcp receives a total of 44 weekly downloads. As such, @showmeonmap/mcp popularity was classified as not popular.
We found that @showmeonmap/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.