Google MapSAFE
18 Google Maps tools and 3 Agent Skills for place search, routes, travel planning, and local SEO—via MCP or standalone CLI.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Stop rebuilding place search, routing, and location workflows for every AI app.
@cablate/mcp-google-map turns Google Maps Platform into 18 read-only agent tools and three focused Skills. An agent can find real places, verify routes, compare options, build practical itineraries, or audit local search visibility—through MCP or a standalone CLI.
You choose the integration model: Codex or Claude Code Plugin when you want Skills without MCP setup, stdio for desktop MCP clients, or Streamable HTTP for shared and remote deployments.
English · 繁體中文
Why use it?
Giving an agent a raw Maps API is only the beginning. Useful answers often require several dependent calls: resolve a place, preserve its identity, search around it, check opening details, calculate travel time, and explain what was actually verified. This project packages that work into one consistent interface.
- Move from lookup to outcome. Atomic tools handle geocoding, place details, directions, weather, air quality, and maps. Composite tools explore areas, compare candidates, optimize stops, and measure local rankings.
- **Use the same capabilities with or with
e4e7534fe8b3OBSERVED · 2026-10-01Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-google-map --env GOOGLE_MAPS_API_KEY=${GOOGLE_MAPS_API_KEY} -- npx -y @cablate/[email protected]Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
current_api_key | read | Returns the current request |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (10)
console.log(` API Key: ${API_KEY ? "✅ provided" : "⚠️ not set (some tests skipped)"}`);import { PlacesSearcher } from "../../services/PlacesSearcher.js";import { getCurrentApiKey } from "../../utils/requestContext.js";import { PlacesSearcher } from "../../services/PlacesSearcher.js";import { getCurrentApiKey } from "../../utils/requestContext.js";import { PlacesSearcher } from "../../services/PlacesSearcher.js";"url": "http://127.0.0.1:3000/mcp"
"url": "http://127.0.0.1:3000/mcp"
const endpoint = `http://127.0.0.1:${address.port}/mcp`;@googlemaps/google-maps-services-js, @googlemaps/places, @modelcontextprotocol/sdk, @types/yargs, cross-env, dotenv, express, yargs
Gates applied: no_behavioural_pass.
e4e7534fe8b3full audit observations/trust-audit/mcp-server/cablate__google-map.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-01 | e4e7534fe8b3 | SAFE | B | 89 | first audit |
Questions
What is the Google Map MCP server?
18 Google Maps tools and 3 Agent Skills for place search, routes, travel planning, and local SEO—via MCP or standalone CLI.
What tools does Google Map expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Google Map safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Google Map need?
It reads GOOGLE_MAPS_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Google Map run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @cablate/mcp-google-map at 0.0.69.
How current is this page?
The grade is for one exact copy of the source (e4e7534fe8b3), read on 2026-10-01. The repository is watched and re-audited when it changes.