npm - @urbankitstudio/mcp-atlas - Versions diffs - 0.1.5 → 0.1.6 - Mend

@urbankitstudio/mcp-atlas 0.1.5 → 0.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/LICENSE CHANGED Viewed

@@ -1,21 +1,21 @@
-MIT License
-Copyright (c) 2026 Leo Yong
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+Copyright (c) 2026 Leo Yong
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md CHANGED Viewed

@@ -1,158 +1,156 @@
-# @urbankitstudio/mcp-atlas
-[![mcp-atlas MCP server](https://glama.ai/mcp/servers/LEOyrh/mcp-atlas/badges/card.svg)](https://glama.ai/mcp/servers/LEOyrh/mcp-atlas)
-Query 155 verified US county parcel ArcGIS REST endpoints for owner, APN, and address lookup via the Model Context Protocol (MCP).
-An [MCP](https://modelcontextprotocol.io) server that gives AI assistants direct access to UrbanKit Studio's atlas of manually verified county parcel GIS services. Ask Claude or Cursor to find the ArcGIS REST endpoint for any covered county, get the exact owner-search query URL, and look up parcel data — without needing to know anything about ArcGIS REST API conventions.
-**Coverage:** 155 counties across all 50 US states.
----
-## Quick start
-### Claude Desktop
-Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
-```json
-{
-  "mcpServers": {
-    "mcp-atlas": {
-      "command": "npx",
-      "args": ["-y", "@urbankitstudio/mcp-atlas"]
-    }
-  }
-}
-```
-### Cursor
-Add to `.cursor/mcp.json` in your project root (or `~/.cursor/mcp.json` globally):
-```json
-{
-  "mcpServers": {
-    "mcp-atlas": {
-      "command": "npx",
-      "args": ["-y", "@urbankitstudio/mcp-atlas"]
-    }
-  }
-}
-```
-### Install globally (optional)
-```sh
-npm install -g @urbankitstudio/mcp-atlas
-```
-Then use `mcp-atlas` as the command instead of `npx -y @urbankitstudio/mcp-atlas`.
----
-## Tools
-### `list_counties`
-Lists all counties with a verified parcel REST endpoint.
-| Parameter | Type | Required | Description |
-|-----------|------|----------|-------------|
-| `state` | string | No | Two-letter abbreviation (`IL`) or full name (`Illinois`) |
-**Example prompt:** "List all covered counties in Illinois"
-**Example output:**
-```
-ST | County               | Slug                     | Coverage
---------------------------------------------------------------------
-IL | Kane                 | kane-county              | owner+APN
-IL | Cook                 | cook-county              | APN only
-IL | DuPage               | dupage-county            | owner+APN
-...
-```
----
-### `find_county`
-Fuzzy-matches a county by name or 5-digit FIPS code. Returns endpoint URLs, searchable field names, owner field, sample query, and license info.
-| Parameter | Type | Required | Description |
-|-----------|------|----------|-------------|
-| `query` | string | Yes | County name (`Kane`), name+state (`Kane IL`), or FIPS (`17089`) |
-**Example prompt:** "Find the parcel endpoint for Kane County Illinois"
----
-### `get_parcel_endpoint`
-Returns the full ArcGIS REST URL, layer index, searchable fields, owner field, and a ready sample `?where=…&f=json` query for a specific county.
-| Parameter | Type | Required | Description |
-|-----------|------|----------|-------------|
-| `state` | string | Yes | Two-letter abbreviation or full name |
-| `county` | string | Yes | County name (`Kane` or `Kane County`) |
-**Example prompt:** "Give me the ArcGIS REST endpoint for Cook County Illinois"
----
-### `build_owner_query`
-Constructs the exact ArcGIS REST query URL using the county's verified owner/taxpayer field. Uses `UPPER(field) LIKE UPPER('%NAME%')` — case-insensitive partial match.
-| Parameter | Type | Required | Description |
-|-----------|------|----------|-------------|
-| `state` | string | Yes | Two-letter abbreviation or full name |
-| `county` | string | Yes | County name |
-| `owner_name` | string | Yes | Owner/taxpayer name (partial match) |
-**Example prompt:** "Build an ArcGIS query for properties owned by 'Smith' in Kane County IL"
-**Example output:**
-```
-County:       Kane, Illinois
-Owner field:  TaxName
-WHERE clause: UPPER(TaxName) LIKE UPPER('%SMITH%')
-Query URL:
-https://gistech.countyofkane.org/arcgis/rest/services/KanePINList/MapServer/0/query
-  ?where=UPPER(TaxName)%20LIKE%20UPPER('%25SMITH%25')
-  &outFields=PIN,TaxName,SiteAddress,SiteCity,MailingAddress
-  &returnGeometry=false&f=json&resultRecordCount=25
-```
----
-## Example conversation
-> **User:** I'm doing due diligence on properties in Kane County, Illinois. Can you find all parcels owned by "Blackstone"?
-> **Claude (using mcp-atlas):**
-> 1. Calls `get_parcel_endpoint` → gets the `gistech.countyofkane.org` URL and confirms the owner field is `TaxName`
-> 2. Calls `build_owner_query` with `owner_name=Blackstone` → returns a ready fetch URL
-> 3. Optionally fetches the URL and formats the parcel results
----
-## Atlas coverage
-The atlas is maintained by [UrbanKit Studio](https://urbankitstudio.com/parcel-atlas). All endpoints are manually verified. Counties with an owner/taxpayer field support full name-based lookups; PIN-only counties support APN/parcel-number queries.
-Full coverage map: https://urbankitstudio.com/parcel-atlas
----
-## Data
-Atlas data is embedded in the package (no network calls at startup). The underlying `@urbankitstudio/atlas` SDK is also published separately for programmatic use.
----
-## License
-MIT — © Leo Yong / UrbanKit Studio
+# @urbankitstudio/mcp-atlas
+Query 155 verified US county parcel ArcGIS REST endpoints for owner, APN, and address lookup via the Model Context Protocol (MCP).
+An [MCP](https://modelcontextprotocol.io) server that gives AI assistants direct access to UrbanKit Studio's atlas of manually verified county parcel GIS services. Ask Claude or Cursor to find the ArcGIS REST endpoint for any covered county, get the exact owner-search query URL, and look up parcel data — without needing to know anything about ArcGIS REST API conventions.
+**Coverage:** 155 counties across all 50 US states.
+---
+## Quick start
+### Claude Desktop
+Add to `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows):
+```json
+{
+  "mcpServers": {
+    "mcp-atlas": {
+      "command": "npx",
+      "args": ["-y", "@urbankitstudio/mcp-atlas"]
+    }
+  }
+}
+```
+### Cursor
+Add to `.cursor/mcp.json` in your project root (or `~/.cursor/mcp.json` globally):
+```json
+{
+  "mcpServers": {
+    "mcp-atlas": {
+      "command": "npx",
+      "args": ["-y", "@urbankitstudio/mcp-atlas"]
+    }
+  }
+}
+```
+### Install globally (optional)
+```sh
+npm install -g @urbankitstudio/mcp-atlas
+```
+Then use `mcp-atlas` as the command instead of `npx -y @urbankitstudio/mcp-atlas`.
+---
+## Tools
+### `list_counties`
+Lists all counties with a verified parcel REST endpoint.
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `state` | string | No | Two-letter abbreviation (`IL`) or full name (`Illinois`) |
+**Example prompt:** "List all covered counties in Illinois"
+**Example output:**
+```
+ST | County               | Slug                     | Coverage
+--------------------------------------------------------------------
+IL | Kane                 | kane-county              | owner+APN
+IL | Cook                 | cook-county              | APN only
+IL | DuPage               | dupage-county            | owner+APN
+...
+```
+---
+### `find_county`
+Fuzzy-matches a county by name or 5-digit FIPS code. Returns endpoint URLs, searchable field names, owner field, sample query, and license info.
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `query` | string | Yes | County name (`Kane`), name+state (`Kane IL`), or FIPS (`17089`) |
+**Example prompt:** "Find the parcel endpoint for Kane County Illinois"
+---
+### `get_parcel_endpoint`
+Returns the full ArcGIS REST URL, layer index, searchable fields, owner field, and a ready sample `?where=…&f=json` query for a specific county.
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `state` | string | Yes | Two-letter abbreviation or full name |
+| `county` | string | Yes | County name (`Kane` or `Kane County`) |
+**Example prompt:** "Give me the ArcGIS REST endpoint for Cook County Illinois"
+---
+### `build_owner_query`
+Constructs the exact ArcGIS REST query URL using the county's verified owner/taxpayer field. Uses `UPPER(field) LIKE UPPER('%NAME%')` — case-insensitive partial match.
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `state` | string | Yes | Two-letter abbreviation or full name |
+| `county` | string | Yes | County name |
+| `owner_name` | string | Yes | Owner/taxpayer name (partial match) |
+**Example prompt:** "Build an ArcGIS query for properties owned by 'Smith' in Kane County IL"
+**Example output:**
+```
+County:       Kane, Illinois
+Owner field:  TaxName
+WHERE clause: UPPER(TaxName) LIKE UPPER('%SMITH%')
+Query URL:
+https://gistech.countyofkane.org/arcgis/rest/services/KanePINList/MapServer/0/query
+  ?where=UPPER(TaxName)%20LIKE%20UPPER('%25SMITH%25')
+  &outFields=PIN,TaxName,SiteAddress,SiteCity,MailingAddress
+  &returnGeometry=false&f=json&resultRecordCount=25
+```
+---
+## Example conversation
+> **User:** I'm doing due diligence on properties in Kane County, Illinois. Can you find all parcels owned by "Blackstone"?
+> **Claude (using mcp-atlas):**
+> 1. Calls `get_parcel_endpoint` → gets the `gistech.countyofkane.org` URL and confirms the owner field is `TaxName`
+> 2. Calls `build_owner_query` with `owner_name=Blackstone` → returns a ready fetch URL
+> 3. Optionally fetches the URL and formats the parcel results
+---
+## Atlas coverage
+The atlas is maintained by [UrbanKit Studio](https://urbankitstudio.com/parcel-atlas). All endpoints are manually verified. Counties with an owner/taxpayer field support full name-based lookups; PIN-only counties support APN/parcel-number queries.
+Full coverage map: https://urbankitstudio.com/parcel-atlas
+---
+## Data
+Atlas data is embedded in the package (no network calls at startup). The underlying `@urbankitstudio/atlas` SDK is also published separately for programmatic use.
+---
+## License
+MIT — © Leo Yong / UrbanKit Studio

package/SECURITY-NOTES.md ADDED Viewed

@@ -0,0 +1,66 @@
+# Security notes — @urbankitstudio/mcp-atlas
+Known advisories in this package's dependency tree, why they are where they are,
+and what was decided. Written down so an audit does not have to re-derive it and
+does not re-raise a closed question.
+Last reviewed: **2026-08-05**, against `@modelcontextprotocol/sdk@1.30.0`.
+## Two HIGH advisories, both upstream and both unreachable here
+`npm audit` reports four advisories, two of them HIGH. Both come from the MCP
+SDK's own dependency tree, not from anything this package requires directly:
+| Advisory | Path | Reachable from this server? |
+|---|---|---|
+| `fast-uri` host confusion (GHSA-v2hh-gcrm-f6hx, -7p8r-x3mc-p8w7, -4c8g-83qw-93j6) | `sdk → ajv → fast-uri` | Loaded, but **no attack surface** — see below |
+| `ip-address` SSRF / trust bypass (GHSA-mwp4-54f8-5fhr, -4xrf-jv44-h6hh, -22jq-vg5j-6vgg) | `sdk → express-rate-limit → ip-address` | **No** — never loaded |
+### Why `ip-address` is not loaded
+`express-rate-limit` is imported only by the SDK's OAuth handlers
+(`dist/esm/server/auth/handlers/{authorize,register,revoke,token}.js`). Those
+serve the HTTP transports. This server uses `StdioServerTransport`, and
+`dist/esm/server/index.js` contains no reference to `auth/handlers` — verified by
+grep against the installed package, not inferred from the dependency graph.
+### Why `fast-uri` has no attack surface here
+This one *is* loaded: `server/index.js` imports `AjvJsonSchemaValidator`, which
+imports `ajv`, which uses `fast-uri` for `format: "uri"` validation. So unlike
+`ip-address` it genuinely executes.
+It still has nowhere to go. The advisories describe host confusion when parsing a
+URI — dangerous when a parsed host then drives an outbound request, which is the
+SSRF shape. This server:
+- declares **no** `format: "uri"`, `"url"` or `"hostname"` in any tool schema, so
+  nothing routes untrusted input through the vulnerable parser, and
+- makes **no `fetch()` calls at all** — it answers from atlas data bundled at
+  publish time, so there is no request for a confused host to redirect.
+## Why this is not fixed here
+It cannot be. `overrides` in a published package apply to that package's own
+installs, not to consumers, who resolve the SDK's transitive tree themselves.
+Raising a version here would clean up a local `npm audit` and change nothing for
+anyone who installs this package — the appearance of a fix rather than a fix.
+The real remedy is upstream: the SDK bumping `ajv` and `express-rate-limit`, or
+moving its HTTP/OAuth dependencies to optional so stdio consumers never install
+them.
+## What was actually done
+The declared range moved from `^1.29.0` to `^1.30.0`. This raises the floor and
+keeps the package current per the SOAK-AND-ROT policy; it does **not** resolve
+the advisories above, and 1.30.0 was measured to leave both HIGHs in place.
+Worth being precise about, because it was initially recorded the other way round:
+a tooling sweep reported that 1.30.0 "closes 2 HIGH SSRF-class CVEs." Installing
+1.30.0 and re-running `npm audit` shows both still present. The bump is hygiene,
+not a security fix, and it should not be cited as one.
+Note also that `^1.29.0` already permitted 1.30.0, so consumers installing before
+this change were resolving to it anyway. The floor bump prevents a consumer
+pinning something older; it does not deliver a newer SDK to anyone.

package/dist/server.js CHANGED Viewed

@@ -51,7 +51,7 @@ function formatCountySummary(c) {
             return [
                 `  URL: ${ep.url}`,
                 `  Service: ${ep.serviceType}/layer ${ep.layerIndex}`,
-                `  Status: ${ep.status}`,
+                `  Status: ${ep.status} (verified ${ep.lastVerified})`,
                 `  Searchable fields: ${searchable || "none"}`,
                 `  Owner field: ${ownerField ?? "none (PIN-only county)"}`,
                 `  License: ${ep.license}`,
@@ -79,7 +79,7 @@ const server = new McpServer({ name: "mcp-atlas", version: "0.1.0" }, {
 // ---------------------------------------------------------------------------
 server.registerTool("list_counties", {
     title: "List covered counties",
-    description: "Returns all counties in the UrbanKit Atlas that have a verified ArcGIS REST parcel endpoint. Pass a state abbreviation (e.g. 'IL') or state name (e.g. 'Illinois') to filter by state. Omit state to list all ~155 counties.",
+    description: `Returns all counties in the UrbanKit Atlas that have a verified ArcGIS REST parcel endpoint. Pass a state abbreviation (e.g. 'IL') or state name (e.g. 'Illinois') to filter by state. Omit state to list all ~${atlas.totals.counties} counties.`,
     inputSchema: {
         state: z
             .string()

package/package.json CHANGED Viewed

@@ -1,60 +1,61 @@
-{
-  "name": "@urbankitstudio/mcp-atlas",
-  "version": "0.1.5",
-  "mcpName": "io.github.LEOyrh/mcp-atlas",
-  "description": "Query 155 verified US county parcel ArcGIS REST endpoints for owner, APN, and address lookup via the Model Context Protocol (MCP).",
-  "keywords": [
-    "mcp",
-    "mcp-server",
-    "parcel",
-    "gis",
-    "arcgis",
-    "county",
-    "apn",
-    "address-to-parcel",
-    "property-data",
-    "real-estate",
-    "esri"
-  ],
-  "homepage": "https://urbankitstudio.com/parcel-atlas",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/LEOyrh/mcp-atlas.git"
-  },
-  "bugs": {
-    "url": "https://github.com/LEOyrh/urbankitstudio/issues"
-  },
-  "author": "Leo Yong <leoyrhbiz@gmail.com>",
-  "license": "MIT",
-  "type": "module",
-  "main": "./dist/server.js",
-  "types": "./dist/server.d.ts",
-  "bin": {
-    "mcp-atlas": "dist/server.js"
-  },
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc --noEmit",
-    "smoke": "node test/smoke.mjs",
-    "prepublishOnly": "npm run typecheck && npm run build && npm run smoke"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@urbankitstudio/atlas": "^0.5.0"
-  },
-  "devDependencies": {
-    "@types/node": "^26.0.0",
-    "typescript": "^5.8.3"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "engines": {
-    "node": ">=18"
-  }
-}
+{
+  "name": "@urbankitstudio/mcp-atlas",
+  "version": "0.1.6",
+  "description": "Query 155 verified US county parcel ArcGIS REST endpoints for owner, APN, and address lookup via the Model Context Protocol (MCP).",
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "parcel",
+    "gis",
+    "arcgis",
+    "county",
+    "apn",
+    "address-to-parcel",
+    "property-data",
+    "real-estate",
+    "esri"
+  ],
+  "homepage": "https://urbankitstudio.com/parcel-atlas",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/LEOyrh/urbankitstudio.git",
+    "directory": "packages/mcp-atlas"
+  },
+  "bugs": {
+    "url": "https://github.com/LEOyrh/urbankitstudio/issues"
+  },
+  "author": "Leo Yong <leoyrhbiz@gmail.com>",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/server.js",
+  "types": "./dist/server.d.ts",
+  "bin": {
+    "mcp-atlas": "dist/server.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "SECURITY-NOTES.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "smoke": "node test/smoke.mjs",
+    "prepublishOnly": "npm run typecheck && npm run build && npm run smoke"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@urbankitstudio/atlas": "^0.5.1"
+  },
+  "devDependencies": {
+    "@types/node": "^26.0.0",
+    "typescript": "^5.8.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}