QGISBLOCK
Connect QGIS to AI agent through the Model Context Protocol (MCP)
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Connect QGIS to any AI agent that speaks the Model Context Protocol (MCP), so the agent drives QGIS directly: manage layers, edit features, run processing algorithms, render maps, and more.
125 MCP tools covering layer management, feature editing, processing, rendering, styling, layout & atlas authoring, cross-layer SQL, plugin development, and system management. Compatible with QGIS 3.28–4.x. Model and client agnostic: any MCP client works, among them Claude Code, Codex CLI, Gemini CLI, Qwen Code, Kimi Code CLI, GitHub Copilot CLI, opencode, LM Studio, Claude Desktop, Cursor, VS Code, Windsurf, Zed, and more.
Architecture
AI agent ←→ MCP Server (FastMCP) ←→ TCP socket ←→ QGIS Plugin (QTimer) ←→ PyQGIS API
- QGIS Plugin (
qgis_mcp_plugin/) - Runs inside QGIS. Non-blocking TCP socket server that processes JSON commands within QGIS's event loop. - MCP Server (
src/qgis_mcp/server.py) - Runs outside QGIS. Exposes QGIS operations as MCP tools via FastMCP.
Installation
No clone needed. Requires QGIS 3.28+ and uv.
1. Install the QGIS plugin
In QGIS: Plugins > Manage and Install Plugins > search QGIS MCP > Install.
Restart QGIS and click Start Server in the QGIS MCP dock widget.
2. Connect your coding agent
Claude Code
claude mcp add -s user qgis -- uvx --from https://github.com/nkarasiak/qgis-mcp/archive/refs/heads/main.zip qgis-mcp-server
Scope reference:
Codex CLI
codex mcp add qgis -- uvx --from https://github.
122a1f6ad799OBSERVED · 2026-10-06Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add qgis-mcp --env QGIS_MCP_TOKEN=${QGIS_MCP_TOKEN} -- uvx qgis-mcp{
"mcpServers": {
"qgis-mcp": {
"command": "uvx",
"args": [
"qgis-mcp"
],
"env": {
"QGIS_MCP_TOKEN": "${QGIS_MCP_TOKEN}"
}
}
}
}Exposed tools (14)
1 read · 13 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
add_field | write | params = { |
add_layout_scalebar | write | return await _send( |
add_layout_table | write | return await _send( |
add_map_theme | write | return await _send( |
add_table_join | write | params = { |
commit_edits | write | await ctx.info(f |
create_layer_group | write | params = { |
create_layout | write | return await _send( |
create_memory_layer | write | params = { |
move_layer_to_group | write | return await _send( |
redo_edits | read | return await _send( |
rename_field | write | return await _send( |
save_style_qml | write | return await _send( |
start_editing | write | return await _send( |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (6)
Upload is not publication. Every version goes through a two-step flow: upload confirmation email, then an async security scan. Passing the scan only makes the version *available for manual approval* b
exec(compiled, namespace) # nosec B102 - intentional: MCP execute_code tool
sys.settrace(self._deadline_tracer(started + budget))
sys.settrace(previous_trace)
.flake8
exec(compile(script, "replay.py", "exec"), {})Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
122a1f6ad799full audit observations/trust-audit/mcp-server/nkarasiak__qgis.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-06 | 122a1f6ad799 | BLOCK | D | 69 | first audit |
Questions
What is the QGIS MCP server?
Connect QGIS to AI agent through the Model Context Protocol (MCP)
What tools does QGIS expose?
14 in total: 1 read-only, 13 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is QGIS safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does QGIS need?
It reads QGIS_MCP_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does QGIS run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as qgis-mcp.
How current is this page?
The grade is for one exact copy of the source (122a1f6ad799), read on 2026-10-06. The repository is watched and re-audited when it changes.