Atlas / MCP servers / r3tr0eth / r3tr0eth-emap

r3tr0eth-emapCAUTION

mcp/r3tr0eth/emap-labs

emap/labs — infraestructura de inteligencia geográfica: datasets, evals y RAG geoespacial para Euskadi (ES/EU)

Verdict
CAUTION
Grade
B
Trust score
89 /100
Exposed tools
5 5r · 0w · 0d
Transport
streamable-http
License
Apache-2.0
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

INFRAESTRUCTURA DE INTELIGENCIA GEOGRÁFICA · EUSKADI → EUROPA

[](https://github.com/r3tr0eth/emap-labs/actions/workflows/evals.yml) [](LICENSE) [](#licencias) [](releases/RELEASE-NOTES.md) [](https://doi.org/10.5281/zenodo.21282784)

Laboratorio de datos e IA detrás de emap: datasets urbanos versionados, búsqueda semántica, RAG geoespacial y benchmarks de retrieval en español y euskera. emap es el producto y el primer consumidor de todo lo que sale de aquí.

EN: Open geographic-retrieval benchmark (Spanish/Basque) and versioned urban mobility datasets for the Basque Country. Reproducible in three commands.

Benchmark · MCP · Reproducir · Datasets · Ética · Citar

Benchmark de retrieval ES/EU

Corpus dorado actual de 162 casos de búsqueda geográfica hiperlocal sobre 22 capas (fuentes, aseos, parking, transporte, DEA, farmacias, bibliotecas, cimas...) en español y euskera: 85 development, 29 held-out sellados y 48 challenge. Incluye 24 casos de abstención (answerable: false — el retriever que inventa, falla). El euskera se coteja con Itzuli, el traductor neuronal del Gobierno Vasco — no es euskera artificial de traducción automática sin revisar.

Última tabla histórica versionada (k=5, 2026-08-05; no reejecutada en el sprint 2026-08-27):

Read from source at commit 55e9c090bd28OBSERVED · 2026-10-13
02

Exposed tools (5)

5 read · 0 write · 0 destructive.

ToolRiskDescription
explain_placereadContexto de un punto: barrio/municipio y servicios cercanos (rail,
nearby_poisreadPOIs más cercanos de una capa concreta. Capas: fountains (fuentes),
plan_hikereadEl monte en transporte público: cimas de Euskadi (2.825, OSM)
plan_routereadRuta real entre dos puntos con la infraestructura propia de emap
search_placesreadBúsqueda semántica local en español o euskera (
03

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (12 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (9)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
mcp/deploy.sh:59
curl -sf http://127.0.0.1:8084/health | head -c 400
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
mcp/deploy.sh:61
curl -s -o /tmp/emap-mcp-init.json -w "initialize_http=%{http_code}\n" -X POST http://127.0.0.1:8084/mcp \
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
mcp/nginx.example.conf:9
#       proxy_pass http://127.0.0.1:8084;
MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
mcp/README.md:52
| Health (local al proceso) | `GET http://127.0.0.1:8084/health` | ✅ desde 0.1.1 |
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
mcp/README.md:85
.venv/bin/python mcp/smoke.py --base http://127.0.0.1:8084
INFOInventory / provenance · inv.oversize · CWE-1104
evals/data/pois-euskadi/fountains.json
evals/data/pois-euskadi/fountains.json
Why it matters. 2073658 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
evals/data/pois-euskadi/sports.json
evals/data/pois-euskadi/sports.json
Why it matters. 4628232 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
evals/data/processed/madrid/pois/fountains.json
evals/data/processed/madrid/pois/fountains.json
Why it matters. 2113961 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-13 · audit v0.4.1 · source sha 55e9c090bd28full audit observations/trust-audit/mcp-server/r3tr0eth__emap-labs.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1355e9c090bd28CAUTIONB89first audit
05

Questions

What is the r3tr0eth-emap MCP server?

emap/labs — infraestructura de inteligencia geográfica: datasets, evals y RAG geoespacial para Euskadi (ES/EU)

What tools does r3tr0eth-emap expose?

5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is r3tr0eth-emap safe to connect to an agent?

With care. The audit graded it B (89/100) and found 9 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does r3tr0eth-emap need?

No credential environment variables were found in its source, so it appears to need none.

How does r3tr0eth-emap run?

It speaks streamable-http, so it runs as a service you connect to over the network.

How current is this page?

The grade is for one exact copy of the source (55e9c090bd28), read on 2026-10-13. The repository is watched and re-audited when it changes.

Advertisement