mapsmith 0.3.0__tar.gz → 0.4.0__tar.gz

{mapsmith-0.3.0 → mapsmith-0.4.0}/.gitignore

@@ -61,3 +61,8 @@ uv.lock
 
 # The site is generated: `python site/build.py dist` rebuilds it from a real run.
 site/generated/
+
+# Written by `benchmarks/dashboard.py` and by MAPSMITH_DISCOVERY_LOG:
+# both hold the queries somebody typed, so they stay out of the repository.
+dashboard.html
+*.jsonl

mapsmith-0.4.0/.zenodo.json

@@ -0,0 +1,19 @@
+{
+  "upload_type": "software",
+  "title": "MapSmith: geospatial processing for AI agents, with verifiable provenance",
+  "version": "0.4.0",
+  "creators": [
+    {"name": "The MapSmith project"}
+  ],
+  "license": "agpl-3.0-or-later",
+  "access_right": "open",
+  "keywords": [
+    "GIS",
+    "geospatial",
+    "provenance",
+    "reproducibility",
+    "Model Context Protocol",
+    "MCP"
+  ],
+  "description": "<p>An MCP server that gives AI agents professional geoprocessing under a rule the agent cannot bend: every geometry and every number comes from a real engine run, never from the model.</p><p>Each operation that writes a dataset also writes a manifest beside it &mdash; the inputs and their hashes, the exact parameters, the coordinate-system decisions and the reason for each, the engine and its version, the environment that changed the answer, and the deterministic checks that ran. The manifest is written <em>before</em> a failed check raises, so the audit trail survives the error rather than disappearing with it.</p><p>Capabilities are reached through a searchable catalogue rather than a wall of tools, because a caller's ability to pick the right tool degrades long before a catalogue does. The catalogue answers with a set of candidates and the text that distinguishes them, not with a verdict.</p><p>A manifest records what was done; it does <em>not</em> certify that what was done was right. MapSmith says so in its own documentation, and a separate correctness suite exists to measure the difference.</p>"
+}

{mapsmith-0.3.0 → mapsmith-0.4.0}/CHANGELOG.md

@@ -4,9 +4,391 @@ All notable changes to MapSmith are documented here, in the format of
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This project follows
 [semantic versioning](https://semver.org/).
 
-## [Unreleased]
+## [0.4.0] — 2026-08-31
 
-Nothing yet.
+### Added
+
+- **The caller chooses the geoprocessing stack once, at the start, and it is
+  never swapped underneath them.** `MAPSMITH_STACK` takes `opensource` (the
+  default: GDAL, GeoPandas, DuckDB, Whitebox) or `esri`, which routes to ArcPy
+  on a machine that has a licence for it. The rule that makes the choice worth
+  making is what happens at the edges: when the chosen stack cannot do
+  something, MapSmith says which of three things is true — the tool does not
+  exist, this licence tier does not include it, or it would need an online
+  service — and falls back only where the caller asked for a fallback, naming
+  the substitution in the manifest. An engine quietly replaced by another is a
+  result whose provenance record is true and whose number came from software
+  nobody chose.
+- **Citation metadata** (`CITATION.cff`). Every release from here on is
+  archived and assigned a DOI, so the file is a release artifact: a test fails
+  if its version is not the version being released, or if its release date is
+  in the future.
+- **A manifest can now say which configuration produced the numbers**
+  (`environment`, section 3.8 of the manifest specification). The field existed
+  in the published specification and in the schema, and nothing in MapSmith
+  could produce it — a whole section describing something the reference
+  implementation could not do.
+
+  What made it concrete: a GeoTIFF and the `.aux.xml` beside it can declare
+  different georeferencing, and GDAL prefers the sidecar by documented design,
+  because that is how somebody overrides georeferencing they know to be wrong.
+  Both readings are the library behaving exactly as written. On one fixture the
+  same file gives 40,000 m² or 160,000 m² and an origin a hundred kilometres
+  apart, and until now nothing MapSmith wrote could say which of the two it
+  read. There is nothing upstream to fix and everything to state.
+
+  So: `describe_dataset` reports both sources when a raster has two, and the
+  nine operations that read a raster's grid directly refuse instead, naming
+  both and saying how to choose. The terrain and sampling operations are not
+  covered yet and the README says so rather than implying otherwise; the
+  terrain engine stops on the same file for a different reason, because its own
+  reading of the grid disagrees with GDAL's, and its message names neither the
+  sidecar nor the way out. That split is the multi-layer refusal (#29)
+  applied to a second axis — the format's default answers a question the caller
+  never asked, and a manifest could not honestly say which data produced the
+  numbers. Describing is different from computing: a file with two
+  georeferencings is a thing to be told about.
+
+  The field is filled where a manifest becomes a file rather than in
+  `verify.audited`, and the difference matters: seventeen writers of fifty-seven
+  build their record by hand and never reach `audited`, and they are
+  concentrated in raster — exactly where georeferencing decides the numbers.
+  Empty when there is nothing to say, because a field that appears on every
+  operation is a field its reader learns to skip.
+- **Redaction now reads dictionary keys, not only values.** Adding a field that
+  holds environment variables exposed a gap that was never about that field:
+  `{"AWS_SECRET_ACCESS_KEY": "AKIA…"}` passed through untouched, because the
+  scanner looks for `name=value` *inside a string* and in a dictionary the name
+  is the key. That was true of every dictionary a manifest carries. Bare `key`
+  stays off the list on purpose — `sort_key` and `primary_key` are ordinary
+  field names, and a mask that fires on those teaches its reader to distrust it.
+- **`select_features` and `extract_layer`: two remedies MapSmith was already
+  recommending without offering.** The mixed-geometry warning said *select the
+  features the question is about*; the multi-layer refusal said *extract the
+  layer you mean into its own dataset*. Both then handed over a `run_sql`
+  incantation, which is a long way round for "keep the lines". Now they name an
+  operation, and the hints were rewritten to do so — an error message that
+  points at a longer route than the one that exists is a defect of its own,
+  because it is the only thing a blocked caller reads.
+  - `select_features` keeps features by geometry family (`line` keeps
+    MultiLineString too), by exact geometry type, or by an attribute condition
+    (`field_equals`, `field_in`, `field_between`, inclusive at both ends).
+    Deliberately no expression language: that is `run_sql` with extra steps and
+    its own way of going wrong. Filter values arriving as text against a numeric
+    column are **converted and recorded**, and the conversion tries `int` before
+    `float` because it has to: `float("9007199254740993")` is 9007199254740992,
+    so going through float would return **the row next to** the one asked for —
+    one feature kept, every check green, and a manifest naming a number nobody
+    typed. OSM ids, BIGINT keys and cadastral references all live past 2^53.
+    Five more inputs are refused rather than answered with an empty dataset,
+    because an empty dataset with a complete manifest reads as a finding:
+    `"high"` against an integer column, `"nan"` (which `float()` accepts and
+    which equals nothing, including itself), `"inf"`, `field_equals` with no
+    value, and a range whose minimum is above its maximum. Matching nothing for
+    a reason that is not one of those is reported as a warning, with the hint
+    that a typo and a genuinely empty result look identical.
+  - A **family selection says what it could not keep**. `line` keeps
+    MultiLineString because a MultiLineString is line-shaped — and by the same
+    argument a GeometryCollection holding a polygon is a polygon to everybody
+    except its type name, so dropping it without a word would be that care
+    applied to half the problem. Types no family covers, and null geometries,
+    are counted in a non-critical check that names them.
+  - `extract_layer` copies one named layer out of a multi-layer container. The
+    refusal it resolves (issue #29) stays exactly as strict; what changes is
+    that the way out is now one call whose manifest names the layer, the
+    container and the layers left behind.
+- **A bounding box that spans the planet for data two degrees wide** is now
+  reported with the sentence that makes it readable (`antimeridian.py`).
+  RFC 7946 §3.1.9 splits a geometry at the antimeridian, so the bounds computed
+  from its coordinates come out as the ordinary west-to-east form spanning the
+  world; §5.2 defines the crossing form as the one with west greater than east.
+  Nothing in a planar geometry library can produce the second from the first,
+  so `describe_dataset` reported `(-180, -17.5, 180, -16.5)` for a Fijian survey
+  zone — arithmetically correct, and the wrong answer to the question anybody
+  asked. The plain box is still returned unchanged; when the data crosses, a
+  `true_extent`, a width and a note saying what a filter on the plain box would
+  select come with it. Distinguishing a real crossing from a dataset that
+  genuinely covers the world needs a geometry probe, not arithmetic: a single
+  global rectangle has only ±180 as longitudes and they wrap onto one value.
+  Detection deliberately carries **no threshold on the plain span**: the first
+  version required 350° before looking further, which only ever fires on data
+  split exactly at ±180 — the well-formed case. Buoys at 170°E and 140°W span
+  310° and were reported in silence. What replaces it is a rule with a meaning:
+  a crossing layer reads narrower when the seam is treated as continuous *and*
+  occupies less than half the world going the short way, so points scattered at
+  -179, -90, 0, 90 and 179 are global data rather than a crossing. Only
+  degree-based geographic systems are considered — EPSG:4807 is geographic in
+  grads, where wrapping at 360 means nothing.
+
+- **`locate_extreme_cell`** answers where the lowest or highest value of a
+  raster is, as a coordinate. No operation could be asked that before, which is
+  why MapSmith reported `unsupported` twice on Argleton's `grid-registration`
+  family — the one whose whole question is whether a system knows where its own
+  cells are. Nodata is excluded rather than competing for the minimum, and a tie
+  is reported rather than broken in silence: two cells at the same extreme is a
+  plateau, a flat pond or a saturated sensor, and naming one of them is a
+  confident answer to a question about a region.
+
+- **Ten more operations, and this time the gap they fill is a shape rather
+  than a subject.** Of sixty-one catalogue entries, three produced an `answer`
+  and none of them took a vector layer — so the commonest question in GIS, *how
+  much land is there*, had no operation for anybody holding parcels, and a
+  search declaring it came back empty. Four operations close that:
+  `summarize_field` (totals, averages and extremes of an attribute, per group if
+  asked), `spatial_autocorrelation` (global Moran's I — whether the map holds a
+  pattern at all, which is the question to ask before `hot_spots` shows where),
+  `nearest_neighbour_index` (Clark-Evans R, with the study area treated as the
+  decision it is rather than taken silently from the points' own extent), and
+  `compare_layers` (what actually changed between two versions of a delivery).
+  None of them writes a file, so none carries a manifest: there is no artefact
+  to attach one to, and inventing a file to have something to sign would be
+  worse than the gap.
+
+  Three answer requests from the discovery benchmark that neither labeller could
+  place. `contour_lines` turns a surface into isolines. `least_cost_path` routes
+  across a cost raster where `network_shortest_path` needs roads — charging per
+  unit of DISTANCE, so a diagonal step costs sqrt(2) and not 1, which is the
+  difference between a route a person would walk and a staircase.
+  `transform_by_control_points` puts a survey on real ground by fitting a
+  transform from points known in both systems: *"my traverse is sitting in the
+  middle of the river"* has an answer, and the answer that matters is the
+  residual, which is in the manifest per control point with the worst one named.
+  An exactly determined fit says in words that its zero residual is evidence of
+  nothing.
+
+  And three that existed only inside other operations, which means they existed
+  only for whoever already knew where to look: `snap_layer`, `points_along_lines`
+  (chainage, what `elevation_profile` does before it reads a surface) and
+  `line_intersections`.
+
+  All ten are catalogue-only. The exposed tool list stays at 28, because that is
+  the count with a ceiling and capability is the count without one.
+
+- **MapSmith can record its own discovery cases, and deliberately does not
+  learn from them.** Set `MAPSMITH_DISCOVERY_LOG=<path>` and every catalogue
+  search is written as one JSON line together with the operation run after it:
+  the query, the facets declared, which engine ranked it, every candidate
+  delivered, and where in that list the chosen one sat.
+  `benchmarks/log_to_cases.py` turns those lines into rows shaped like the
+  discovery benchmark and flags the two worth reading — a choice the ranking did
+  not put first, and a search nothing followed.
+
+  The figures MapSmith publishes rest on 155 requests written by two language
+  models, which is the best set obtainable without users and is not what users
+  ask. This closes that gap without closing a feedback loop: a ranker trained on
+  what callers pick learns from an ordering it produced, and the pinned model
+  revision is what makes a search reproducible a year later. So the log produces
+  benchmark rows for a person to accept or discard, and the improvement lands in
+  the catalogue text as a reviewable diff. Off unless the variable is set; holds
+  queries and operation names but never dataset paths or arguments; confined by
+  `MAPSMITH_WORKSPACE` like any other path MapSmith writes; never leaves the
+  machine.
+
+- **Ten operations, chosen by measurement rather than by taste.** The discovery
+  benchmark holds 155 requests written by other model families; twenty-one of
+  them were marked `none` by BOTH independent labellers, meaning the catalogue
+  could not serve them at all. Grouped, those twenty-one are six families, and
+  these ten cover four of them:
+
+  `sample_raster_at_points`, `elevation_profile` and `line_of_sight` read a
+  surface at a place, along a line, and between two positions. Every one counts
+  the positions it could not read and puts that count in the manifest, because a
+  null that reads as a value is how a nodata of -9999 ends up in an average.
+  `line_of_sight` requires an explicit answer on earth curvature: over 30 km the
+  planet drops 62 m net of refraction, and there is no way to guess whether the
+  caller has a rooftop survey or a radio link.
+
+  `network_shortest_path` and `service_area` route over a line network the caller
+  supplies. The failure they are built around is not a wrong number, it is a
+  disconnected graph: two street segments a millimetre apart are one junction on
+  the ground and two nodes in a naive build, so the route detours or is reported
+  impossible and nothing raises. `tolerance` therefore has no default, and every
+  manifest carries the component count, the merged-endpoint count and how far
+  each end snapped to the network. `service_area` cuts the last segment where the
+  budget runs out — a ten-minute walk ends where the walk ends, not at the next
+  junction — and it is a network operation rather than a buffer because a circle
+  includes the far bank of a bridgeless river and excludes the house 900 m away
+  along a straight road.
+
+  `viewshed` maps what a set of stations can see. **Its output is a COUNT of
+  stations, not a 0/1 flag**, which contradicts Whitebox's own documentation:
+  the help says "a Boolean raster, containing 1's and 0's", and measured on 2.0.6
+  with two stations on flat ground every cell comes back 2.0. Second time this
+  library's prose has described the reverse of what its code does, after the D8
+  pointer table.
+
+  `hot_spots`, `smooth_rates`, `aggregate_to_threshold` and `thin_points` are for
+  the moment before somebody publishes a map of noise. Getis-Ord Gi* with a
+  Benjamini-Hochberg correction, because at 0.05 over 300 districts about fifteen
+  hot spots appear from nothing and they will be somewhere. Empirical-Bayes rates,
+  because a choropleth of raw rates over small populations is a map of population
+  size. Disclosure-control aggregation that refuses rather than publishing the one
+  island it could not merge. And deterministic point thinning that says in the
+  manifest that it removed data.
+
+- **A dashboard for the whole project** (`benchmarks/dashboard.py`), written
+  as one self-contained HTML file: no CDN, no fonts, no analytics, works with
+  the network off. Six panels — what exists, whether every operation can
+  actually be found, the retrieval figures and the degradation curve, Argleton's
+  traps and what each engine does with them, the open questions answered by
+  clicking, and a trend appended on each generation.
+
+  It exists because the numbers were spread across a report nobody reruns, a
+  test that prints a curve nobody reads, and a suite in another repository. The
+  tuning panel is the point: an operation nothing reaches does not exist, and
+  this says which ones, at what rank, with words alone and with the facets a
+  caller would declare.
+
+  Two things it caught immediately, both about itself. It drew ten working
+  operations as unreachable by collapsing "the search declined because the two
+  rankers shared nothing" into "not found" — three outcomes, one label. And the
+  MapSmith adapter appeared as `adapters.mapsmith:Adapter` because the label was
+  read from an import path. With those apart: 51 of 61 operations found by words
+  alone, 55 in the top three once facets are declared, none unreachable.
+
+### Fixed
+
+- **A DEM whose rows run south to north no longer produces a slope eight times
+  too steep.** A GeoTIFF's geotransform may have a positive fifth element,
+  meaning row 0 is the southern edge — NetCDF, GRIB and HDF index latitude
+  upwards, so a straight conversion produces one. whitebox-workflows cannot
+  express that and does not say so: it discards the georeferencing and reads the
+  grid as unit cells at the origin. MapSmith answered **45 degrees where the
+  ground is 5.71**, wrote the output raster at the origin at a tenth of the
+  site's size, and **passed all five of its own checks** — `crs_matches` among
+  them, because the coordinate system survived and only the geotransform did
+  not.
+
+  Such a file is now rewritten north-up before the engine sees it, the same
+  mechanism already used for the TIFF predictor, and the rewrite is disclosed in
+  the manifest. Behind that is the general guard: MapSmith now compares the
+  engine's idea of the grid with GDAL's and **refuses** if they differ for any
+  other reason, because a number computed on a grid nobody can reconcile carries
+  a correct-looking CRS on top of it and nothing downstream can tell.
+
+  Found by [Argleton](https://argleton.org) trap 026.
+
+- **Measuring a layer that holds more than one kind of geometry now says so.**
+  A GeoPackage layer may declare its type as GEOMETRY and hold whatever it likes;
+  only the shapefile enforced one type per file, which is why mixed layers
+  arrive exactly when data is converted out of shapefiles. `length` on a polygon
+  is its perimeter — true, and the right answer to a question nobody asked — so
+  a pipe network with a treatment plant in the same layer totalled **3000 m
+  where the pipe is 2000**.
+
+  `measure_length` and `measure_area` now carry a non-critical check naming the
+  geometry types present, with the remedy. It is not an error: measuring a mixed
+  layer is a legitimate request and MapSmith cannot know which features the
+  question was about. What it can do is refuse to let the total arrive without
+  the sentence — especially here, where **every individual row is still
+  correct**, so a spot check of the data confirms the data.
+
+  Found by Argleton trap 027.
+
+- **MapSmith now reads `AREA_OR_POINT`, everywhere at once.** GeoTIFF records
+  which of two conventions a grid uses — `RasterPixelIsArea`, where a value
+  describes the cell it fills, and `RasterPixelIsPoint`, where it is a sample at
+  a grid node — and they differ by half a pixel. Every USGS elevation product is
+  point-registered. **No line of MapSmith read the tag.** Every place that
+  turned a cell index into a coordinate did what `rasterio.xy` does, which is to
+  answer as if the file were area-registered: half a cell, 15 m on a 30 m DEM,
+  systematic, and with nothing in any output to say so.
+
+  That is the shape of #28 again — "open a vector file" as six copies of one
+  decision, four of them missing a branch — so the fix has the same shape as its
+  fix. `mapsmith/grid.py` is now the only place that decides where a value sits,
+  a test fails if a second copy appears, and every operation that converts
+  between cells and coordinates records the registration in its manifest,
+  including the ordinary case: a manifest that mentions the convention only when
+  it is unusual leaves a reader unable to tell *area* from *nobody looked*.
+
+  What changed behind that: sampling reads at the nodes on a point-registered
+  grid, so `sample_raster_at_points`, `elevation_profile` and `line_of_sight`
+  stop being half a cell off; `least_cost_path` starts, routes and ends on the
+  right cells; `contour_lines` applies its half-cell correction in the direction
+  the registration calls for, where an unconditional one put a USGS DEM's
+  contours a **whole** cell out; `zonal_statistics` offsets the zones for the
+  coverage computation so each cell is weighted around its own sample, and hands
+  back the caller's own geometry; and every raster MapSmith writes carries the
+  input's registration forward, where `profile.copy()` had been silently
+  converting point to area on the way out.
+
+  Found by building [Argleton](https://argleton.org) trap 024, which measures
+  exactly this and which MapSmith could not attempt. It can now, and it answers
+  both halves of the pair — the trap at 412090 and its clean twin at 412105,
+  fifteen metres apart, from files that differ in one metadata tag.
+
+- **Whitebox places contour vertices half a cell from where they belong, and
+  MapSmith now corrects it.** Measured on the installed 2.0.6 with a planar ramp:
+  the contour for height 3 came back on the WEST EDGE of the column holding 3
+  rather than at its centre. On a 30 m DEM that is 15 m of horizontal error on
+  every contour — plausible, well-formed and wrong, which is the third time this
+  library's behaviour has diverged from its description here after the TIFF
+  predictor and the D8 pointer table.
+
+  The correction is verified rather than trusted: the DEM is read back at the
+  finished vertices and the elevation must equal the height each line claims, so
+  a future library version that fixes its own registration fails a critical
+  check instead of being silently double-corrected. `contour_lines` also ships
+  with Whitebox's default smoothing filter OFF, because a contour whose vertices
+  have been moved to look better no longer passes through the elevation it
+  names — smoothing is available, recorded in the manifest, and demotes that
+  check to non-critical, because then the output is a drawing rather than a
+  measurement.
+
+- **A search whose facets leave nothing now says which declaration did it.**
+  Zero surviving candidates fell into the hand-over branch and came back as
+  `status: "choose"` with an empty list and the sentence "0 operations survive
+  what you declared, which is few enough to read" — nonsense as prose, and read
+  by an agent as *MapSmith cannot do this*. It was false in the case that found
+  it: "how much land is in each of these parcels" with `produces="answer"` left
+  nothing, while `measure_area` computes exactly that and declares
+  `dataset:vector` because it writes the areas into a column. That case is now
+  `status: "none_apply"`, listing each declaration with the number of operations
+  that would survive without it, smallest first. Arithmetic, not ranking. Found
+  by the discovery log above on its first recorded session.
+
+### Changed
+
+- **`dataset_inputs` is a new facet, and a new REQUIRED field of the published
+  catalogue-entry specification.** How many datasets the caller is holding: 0, 1
+  or 2. It exists because the ten operations above broke discovery and it is the
+  thing that fixed it — measured, on the 118 independent requests: the surviving
+  set for the commonest facet combination went from 26 candidates to 34, over the
+  threshold at which the whole set is handed over, and `delivered` fell from 100%
+  to 45% with found@3 from 48% to 36%. With arity declared the median set is 9,
+  found@3 is 60% and delivered is back to 100%.
+
+  It is the right *kind* of facet, which is the part that generalises: a fact
+  about the caller's own situation rather than a guess about our taxonomy, and
+  derivable from each operation's signature so
+  `test_the_declared_arity_matches_the_binding` checks the declaration against
+  the code instead of trusting it.
+
+### Security
+
+- **A statement that says `INSTALL` or `LOAD` is now refused in both modes, and
+  this is a breaking change for SQL that names an extension.** Until 0.4.0 only
+  the *implicit* forms were off, and an audit before this tag used `run_sql` in
+  the default mode to install DuckDB's `aws` extension and read the host's real
+  cloud credentials back through a tool result. An `INSTALL` is an HTTPS fetch of
+  a native binary executed in the server's process, on a statement written by a
+  model, so it is not a thing to do by default in either mode.
+
+  Extensions already loaded keep working, `spatial` included: MapSmith loads it
+  through the Python API before the configuration is locked, so no statement has
+  to ask for it. **What breaks** is SQL that says `LOAD spatial` or acquires
+  another extension. To allow specific ones, name them where the agent cannot
+  reach: `MAPSMITH_ALLOW_EXTENSIONS=postgres,azure` in the environment of the
+  process that starts the server — named extensions rather than a switch,
+  because "allow everything" is how a geoprocessing server ends up holding a
+  credential reader.
+
+  [SECURITY.md](SECURITY.md) carries the account, including why none of the four
+  layers that already existed saw it, and the fact that this is the second
+  promise in that file the code contradicted. Both were found by auditing before
+  a release rather than reported from outside, and both are recorded rather than
+  quietly corrected.
 
 ## [0.3.0] — 2026-08-29
 
@@ -75,7 +457,7 @@ are in `Changed` and one of them affects anybody passing `category=`.
   with a tool of its own: `measure_length`, `join_table`, `aggregate_weighted`,
   `parse_coordinates`, `point_on_surface`, `hull_layer`, `validate_geometry`,
   `count_in_polygons`, `focal_statistics` and `extract_streams`. The catalogue is
-  at 51 operations (49 available, 2 planned) behind 28 tools.
+  at 74 operations (72 available, 2 planned) behind 28 tools.
 - **Overlay and dissolve declare their semantics in the manifest.** Dropped
   lower-dimension pieces from an overlay are named rather than silently absent,
   and a dissolve's aggregation is recorded with the group count verified in

mapsmith-0.4.0/CITATION.cff

@@ -0,0 +1,31 @@
+cff-version: 1.2.0
+message: "If you use MapSmith in your work, please cite it as below."
+title: "MapSmith: geospatial processing for AI agents, with verifiable provenance"
+type: software
+authors:
+  - name: "The MapSmith project"
+repository-code: "https://github.com/mapsmith-ai/MapSmith"
+url: "https://mapsmith.dev"
+license: AGPL-3.0-or-later
+version: "0.4.0"
+date-released: "2026-08-31"
+keywords:
+  - GIS
+  - geospatial
+  - provenance
+  - reproducibility
+  - Model Context Protocol
+  - MCP
+abstract: >-
+  An MCP server that gives AI agents professional geoprocessing under a rule
+  the agent cannot bend: every geometry and every number comes from a real
+  engine run, never from the model. Each operation that writes a dataset also
+  writes a manifest beside it — the inputs and their hashes, the exact
+  parameters, the coordinate-system decisions and the reason for each, the
+  engine and its version, and the deterministic checks that ran — and the
+  manifest is written before a failed check raises, so the audit trail survives
+  the error. Capabilities are reached through a searchable catalogue rather
+  than a wall of tools, because a caller's ability to pick the right tool
+  degrades long before a catalogue does. A manifest records what was done; it
+  does not certify that what was done was right, and MapSmith says so in its
+  own documentation rather than leaving a reader to find out.