Atlas / MCP servers / clay-good / geoprims

geoprimsBLOCK

mcp/clay-good/geoprims

Free, exact, cited calculators for pilots, drone operators, surveyors, and GIS developers: a static website (geoprims.com) and a local MCP server. Runs on your device.

Verdict
BLOCK
Grade
F
Trust score
40 /100
Exposed tools
12 9r · 3w · 0d
Transport
—
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Exact, cited math for maps, flight, drones, and surveying. It runs on your device.

Density altitude before a flight. Ground sample distance for a drone survey. A traverse closure, a UTM conversion, an H3 cell, sunrise at a field site. geoprims answers questions like these in a plain sentence, then shows how it got there.

  • For people: a fast, free website. The answer comes first, with a map or diagram and a "How we got this" panel showing the formula with your numbers and its sources.
  • For AI agents: a local MCP server that runs the same calculators and returns the same results, byte for byte. It has no dependencies and stays offline unless optional verified asset downloads are explicitly enabled. See mcp/README.md.

Why trust it

  • Accurate. Reference methods (Karney geodesics, not haversine), tested against GeographicLib, PROJ, H3, S2, and published worked examples, each held to a per-domain tolerance (1 mm in geodesy, for example) unless the source itself prints coarser.
  • Cited. Every result names its source, edition, and section. The build fails if a source goes out of date. Every citation link is checked monthly, and a dead or moved one opens an issue.
  • Honest. Assumptions like datum, true vs. magnetic north, and rules of thumb show up as warnings, not fine print.
  • Private. No ads, accounts, tracking, or server-side math. Your inputs never leave your device.
  • Auditable. The CycloneDX software bill of materials lists every locked Cargo and npm dependency and its license. The build fails when either lockfile and the inventory disagree.

What it covers

Geodesy, navigation, geometry, aviation, drones, surveying, spatial indexing, raster and terrain, time, and units.

The 8 launch journeys are published as end-to-end workflows with prefilled, linked calculator steps, and the concept library exceeds its initial 25-explainer launch target. The build runs every workflow thr

Read from source at commit f02be4f10852OBSERVED · 2026-10-13
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add geoprims -- npx -y geoprims
claude-desktop
{
  "mcpServers": {
    "geoprims": {
      "command": "npx",
      "args": [
        "-y",
        "geoprims"
      ]
    }
  }
}
03

Exposed tools (12)

9 read · 3 write · 0 destructive.

ToolRiskDescription
catalogreadEvery tool id with title, summary, domain, and stability.
coordinate-conversion-auditreadParses a coordinate in any common notation, converts it to UTM, and converts back to show the round-trip error.
geoprims_convert_unitsreadConvert a value between units with exact definitions, e.g. {value: 100, from:
geoprims_describereadGet manifests for up to 20 tool or workflow ids. A workflow id (workflow.<slug>) gives its inputs, its steps, and the values it fixes. detail
geoprims_pipelinewriteRun up to 20 tools in order without round trips. Each step is {id, args, bind}; bind maps an input JSON Pointer to
geoprims_runwriteRun one tool or workflow by id. For a workflow (workflow.<slug>), args are the workflow\
geoprims_searchreadFind geoprims calculators (geodesy, navigation, aviation, drone, survey, indexing, time, units) by plain words, abbreviations, or tool id. Returns ranked ids with summaries. Numbers in the query fill inputs: prefill on the top result holds args for geoprims_run (
h3-resolution-choicereadPicks the H3 resolution whose average cell area is closest to a target, then shows the cell at a location and its real area there.
photogrammetry-missionwriteFlight height for a target ground sample distance, then trigger interval and line spacing at the chosen overlaps, and the longest exposure that keeps motion blur under half a pixel.
preflight-performancereadPressure altitude, density altitude, and runway wind components for a departure, with the crosswind checked against a limit.
toolreadFull manifest with accuracy, references, worked example, and golden vectors.
traverse-closurereadCloses a traverse from its courses and reports misclosure, its bearing, and precision ratio.
04

Trust audit

BLOCKgrade F · trust 40/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryFAIL
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (6 observation(s))
Network
declared (10 observation(s))
Shell
declared (3 observation(s))
Dependencies
pinned
Secrets in source
found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104
core/vectors/drone.power.max-payload.jsonl
drone.power.max-payload.jsonl
Why it matters. member named after an attack tool
Fix. remove or justify
HIGHInventory / provenance · inv.suspicious_name · CWE-1104
core/vectors/drone.power.payload-impact.jsonl
drone.power.payload-impact.jsonl
Why it matters. member named after an attack tool
Fix. remove or justify
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
core/crates/gp-base/src/template.rs:242
fn eval(e: &Expr, s: &dyn Scope) -> Option<Val> {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
core/crates/gp-base/src/template.rs:245
Expr::Abs(x) => eval(x, s).map(|v| Val {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
core/crates/gp-base/src/template.rs:250
let (a, b) = (eval(a, s)?, eval(b, s)?);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/data/nadcon5/20160901/as62_nad83_1993_as.grid
as62_nad83_1993_as.grid
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/data/nadcon5/20160901/gu63_nad83_1993_guamcnmi.grid
gu63_nad83_1993_guamcnmi.grid
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/data/nadcon5/20160901/nad27_nad83_1986_alaska.grid
nad27_nad83_1986_alaska.grid
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/data/nadcon5/20160901/nad27_nad83_1986_conus.grid
nad27_nad83_1986_conus.grid
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/data/nadcon5/20160901/pr40_nad83_1986_prvi.grid
pr40_nad83_1986_prvi.grid
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
core/crates/gp-aviation/src/ifr.rs:248
title: "Missed approach to the ZHZ beacon, holding on the inbound track of 234°",
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
core/crates/gp-aviation/src/ifr.rs:250
source: "TC AIM RAC 10.2 example 2: proceed directly to the beacon, make a right turn and hold on an inbound track of 234°",
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
core/crates/gp-units/src/lib.rs:365
when: "Use this for a radio or clock frequency that has to move between prefixes -- a 2.4 GHz link in MHz, an emergency frequency of 121.5 MHz in kHz, a 433 MHz beacon in Hz -- or for an oscillator dr
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/web/scripts/benchmark.mjs:38
if (port) resolveOrigin(`http://127.0.0.1:${port}`);
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
apps/web/src/lib/mathml.mjs:14
const re = /\s*(?:(\d+(?:\.\d+)?(?:e[-−]?\d+)?)|([A-Za-zΑ-Ωα-ω][A-Za-z0-9Α-Ωα-ω′']*[0-4ij+−nk0-9]*)|(\S))/gy;
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
core/crates/gp-aviation/src/airspeed.rs:309
"1⁄2ρV2 = 0.7·p·M2",
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
core/crates/gp-aviation/src/coldtemp.rs:272
model: "ΔH = (−ΔT_std ÷ L0) · ln(1 + L0·H ÷ (T0 + L0·H_aerodrome)), with L0 = −0.0019812 K/ft, T0 = 288.15 K, ΔT_std the airport temperature minus ISA at its elevation, and H the height above the airp
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
core/crates/gp-aviation/src/coldtemp.rs:385
"ΔT = temperature − (15 − 0.0019812 × elevation)",
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
core/crates/gp-aviation/src/coldtemp.rs:391
"ΔH = (−ΔT ÷ L0) · ln(1 + L0·H ÷ (T0 + L0·H_aerodrome))",
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
worker/test/github-mirror.test.mjs:59
token: 'fine-grained-test-token',
LOWInventory / provenance · inv.hidden_file · CWE-1104
openspec/changes/add-aviation-suite/.openspec.yaml
.openspec.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
openspec/changes/add-drone-suite/.openspec.yaml
.openspec.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
openspec/changes/add-flight-and-drone-planning-tools/.openspec.yaml
.openspec.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
openspec/changes/add-geodesy-suite/.openspec.yaml
.openspec.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
openspec/changes/add-glanceable-and-field-ux/.openspec.yaml
.openspec.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose

Gates applied: no_behavioural_pass.

Audited 2026-10-13 · audit v0.4.1 · source sha f02be4f10852full audit observations/trust-audit/mcp-server/clay-good__geoprims.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-13f02be4f10852BLOCKF40first audit
06

Questions

What is the geoprims MCP server?

Free, exact, cited calculators for pilots, drone operators, surveyors, and GIS developers: a static website (geoprims.com) and a local MCP server. Runs on your device.

What tools does geoprims expose?

12 in total: 9 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is geoprims safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (40/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does geoprims need?

No credential environment variables were found in its source, so it appears to need none.

How current is this page?

The grade is for one exact copy of the source (f02be4f10852), read on 2026-10-13. The repository is watched and re-audited when it changes.

Advertisement