Stadia MapsSAFE
A TypeScript MCP server for interacting with the Stadia Maps APIs
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This is a Model Context Protocol (MCP) server that provides AI assistants with access to Stadia Maps APIs for location services, geocoding, routing, and mapping capabilities.
Capabilities
- Time information anywhere on earth
- Current time
- Time zone info (ID, UTC offset, and whether a special offset like daylight saving/summer time is in effect)
- Geocoding
- Address lookup
- Place search (POIs like restaurants, cafes, etc.)
- Static map image generation (including markers and route overlays)
- Routing & travel time
- Isochrones (reachable range; both time and distance contours)
Use cases
Here are just a few of the ways you can prompt an LLM to make use of the tools:
- "What time is it in Tokyo?"
- "Make me a map showing the walking route from Depoo Turg to the Põhjala Tap Room."
- "Is the Põhjala Tap Room open right now? Use Stadia Maps to get this information."
- "Geocode the addresses in the attached spreadsheet."
Quickstart
Building
We'll use bun for all of our instructions, but you can use npm too.
- Run
bun installto fetch the dependencies. - Then, execute the build script:
bun run build.
The built code should be in the build directory now.
Configuration
This MCP server requires a Stadia Maps API key. Follow the directions here to get your free key. Then, set the API_KEY environment variable when running the server.
Integration Examples
API key in hand, here are a few ways you can use the MCP server.
Claude Desktop
See Claude Desktop Setup for detailed instructions on configuring this MCP server with Claude Desktop. Claude Desktop is a
7dd62eee762dOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add stadiamaps-mcp-server --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env API_KEY=${API_KEY} --env STADIA_MAPS_API_KEY=${STADIA_MAPS_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"stadiamaps-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"API_KEY": "${API_KEY}",
"STADIA_MAPS_API_KEY": "${STADIA_MAPS_API_KEY}"
}
}
}
}Exposed tools (6)
6 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
bulk-geocode | read | Perform multiple address geocoding operations in a single request. Returns results as a JSON list, showing only the first result for each. Using this to geocode POIs is strongly discouraged, as many places with the same name exist; only use this for addresses. ${commonGeocodingDescription} |
geocode | read | Look up a street address, POI, or area. ${commonGeocodingDescription}. Additional info may include Wikipedia ID, population, opening hours, website, and more, subject to availability. |
isochrone | read | Generate isochrone contours showing areas reachable within specified time or distance constraints from a single location. Returns GeoJSON polygons representing the reachable areas. |
route-overview | read | Get high-level routing information between two or more locations. Includes travel time, distance, and an encoded polyline of the route. The result is JSON. |
static-map | read | Generate a PNG map image of an area, optionally including markers and a line (e.g. to draw a route or a boundary) |
time-and-zone-info | read | Get the current time and zone info at any point (geographic coordinates). Output includes includes the standard UTC offset, special offset currently in effect (typically but not always Daylight Saving Time), IANA TZID, and the current timestamp in RFC 28222 format. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (3)
.prettierignore
@anthropic-ai/sdk, @modelcontextprotocol/sdk
@modelcontextprotocol/sdk, @stadiamaps/api, zod, @anthropic-ai/sdk, @types/node, @vitest/ui, msw, typescript
Gates applied: no_behavioural_pass.
7dd62eee762dfull audit observations/trust-audit/mcp-server/stadiamaps__stadia-maps.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 7dd62eee762d | SAFE | B | 89 | first audit |
Questions
What is the Stadia Maps MCP server?
A TypeScript MCP server for interacting with the Stadia Maps APIs
What tools does Stadia Maps expose?
6 in total: 6 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Stadia Maps safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Stadia Maps need?
It reads ANTHROPIC_API_KEY, API_KEY and STADIA_MAPS_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Stadia Maps run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as stadiamaps-mcp-server at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (7dd62eee762d), read on 2026-10-10. The repository is watched and re-audited when it changes.