
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@ultimaps/mcp
Advanced tools
MCP server that turns data into map images: choropleth, category and pin maps of the world, countries, states, counties and ZIP codes.
An MCP server for Ultimaps. Ask Claude, Codex or any MCP client for a map and get the image back in the conversation. It covers choropleths from pasted numbers, category maps and pinned locations, for countries, states, provinces, counties, continents and the world.
"Map US states by population." · "Color the EU members by currency." · "Show France's regions with these unemployment rates: …" · "Pin our five offices on a map of Europe."
No account needed. Without an API key the server uses the keyless tier; set ULTIMAPS_API_KEY for plan quotas and larger or unbranded output.
| Tool | What it does |
|---|---|
render_map | Renders a map as an image (PNG, or SVG with a Pro key), shown inline when it is small enough. Choropleth (numbers), categories (labels) or explicit colors, plus pins, title, legend, theme, labels and extra layers. Region names are matched fuzzily, and every correction or miss is reported with suggestions. dryRun: true previews matching and the color plan without rendering. |
list_maps | The map catalog: {id, title, regionType, layers, regionCount, labels}, searchable with query. |
get_map_regions | One map's region keys and titles, 200 per page, searchable by key, title or alias. |
All three are read-only. Agents rarely need the discovery tools: render_map accepts region names, codes and aliases directly.
Requires Node.js 20 or newer.
claude mcp add ultimaps -- npx -y @ultimaps/mcp
# with a key:
claude mcp add ultimaps --env ULTIMAPS_API_KEY=um_live_… -- npx -y @ultimaps/mcp
codex mcp add ultimaps -- npx -y @ultimaps/mcp
# with a key:
codex mcp add ultimaps --env ULTIMAPS_API_KEY=um_live_… -- npx -y @ultimaps/mcp
Codex writes TOML, not the JSON below. The equivalent entry in ~/.codex/config.toml (or .codex/config.toml in a trusted project):
[mcp_servers.ultimaps]
command = "npx"
args = ["-y", "@ultimaps/mcp"]
Add this to claude_desktop_config.json:
{
"mcpServers": {
"ultimaps": {
"command": "npx",
"args": ["-y", "@ultimaps/mcp"],
"env": { "ULTIMAPS_API_KEY": "" }
}
}
}
~/.cursor/mcp.json (or .cursor/mcp.json in a project):
{
"mcpServers": {
"ultimaps": { "command": "npx", "args": ["-y", "@ultimaps/mcp"] }
}
}
.vscode/mcp.json:
{
"servers": {
"ultimaps": { "type": "stdio", "command": "npx", "args": ["-y", "@ultimaps/mcp"] }
}
}
| Variable | Default | Purpose |
|---|---|---|
ULTIMAPS_API_KEY | none (keyless) | API key from Studio → Workspace → API. An invalid key is an error and never falls back to keyless. |
ULTIMAPS_API_URL | https://api.ultimaps.com | Point at a local API during development (http://localhost:3001). Plain http is only accepted for localhost. |
| Keyless | Free key | Pro key | |
|---|---|---|---|
| Renders | 30/hour, 5/minute | 500/month, 50/day, 10/minute | 5,000/month, 1,000/day, 30/minute |
| Output | PNG up to 1600 px, attribution | PNG up to 1600 px at scale 2 (a 3200 px raster), attribution | PNG up to 4000 px at scale 4, SVG, no attribution |
All keys in a workspace share the monthly quota. The daily and per-minute caps are per key, so a free key stops at 50 renders a day long before the month runs out.
Dry runs skip the monthly quota but still count against rate limits. When five or fewer keyless renders remain in the hour, the result says so.
<tmpdir>/ultimaps-mcp/ and the path is in the result, so in a terminal client the file is the thing you can actually open. Nothing is re-rendered or resampled on your behalf.layer_unavailable), a link to open the map in Ultimaps Studio for editing, and the render id for support.structuredContent with the same report as data, described by the tool's outputSchema.From the repo root:
pnpm install
pnpm --filter @ultimaps/mcp test # unit + in-process protocol tests
pnpm --filter @ultimaps/mcp build # → dist/
pnpm -w schema:emit # regenerate src/generated from the API's OpenAPI contract
pnpm -w schema:check # drift gate (lives in the API test suite)
From packages/mcp, against a local API:
ULTIMAPS_API_URL=http://localhost:3001 node scripts/smoke.mjs # end-to-end over stdio, spends real render units
src/generated/render-request.schema.json is emitted by packages/api/scripts/emitToolSchemas.ts and must never be edited by hand. Tool and property descriptions live in src/descriptions.ts. Arguments are never validated locally: the API is additive-only, and its 400s carry suggestions.
pnpm -w schema:check. If it fails, run pnpm -w schema:emit and commit.version in package.json, server.json (both version fields) and manifest.json.pnpm --filter @ultimaps/mcp publish --access public. prepublishOnly runs the drift gate, type-check, tests and build. Publish from a fully installed checkout of the monorepo, with pnpm on PATH: the drift gate is a jest test inside packages/api, so it cannot run from an unpacked tarball or a partial install.pnpm --filter @ultimaps/mcp bundle, then attach ultimaps-<version>.mcpb to the docs page. Bundling re-checks that step 2 reached all four version fields, and test/packaging.test.ts checks the same thing on every test run. The .mcpb is gitignored and is never rebuilt for you, so rebuild it after the last source edit or it ships a different tool schema than npm does.mcp-publisher publish to update the MCP registry entry (server.json, namespace com.ultimaps).The package publishes a bin and nothing else. import '@ultimaps/mcp' is not
supported and fails by name, because dist/index.js starts a stdio server when
it loads.
MIT © Ultimaps. See LICENSE.
FAQs
MCP server that turns data into map images: choropleth, category and pin maps of the world, countries, states, counties and ZIP codes.
The npm package @ultimaps/mcp receives a total of 65 weekly downloads. As such, @ultimaps/mcp popularity was classified as not popular.
We found that @ultimaps/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.