Openstreetmap Mcp Server

What was checked

Plain notes from the hygiene checks.

• Permissions

  Note

  requests shell access. The manifest names this permission.

  PERMISSION_SHELL_DECLARED

  scripts/devcheck.ts, line 156

  * Executes a shell command using child_process.spawn and returns a structured result.

• Install and update

  Concern

  dependencies are not pinned.

  INSTALL_UNPINNED

  package.json, line 92

  @cyanheads/mcp-ts-core

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach registry.npmjs.org. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  framework-skills/add-service/SKILL.md, line 147

  const response = await fetch(`${this.baseUrl}/items/${id}`, { signal: ctx.signal });

  framework-skills/add-tool/SKILL.md, line 669

  const articles = await fetch(input.pmids);

  framework-skills/add-tool/SKILL.md, line 700

  async fetch(pmids: string[], ctx: Context) {

  Show more

  framework-skills/add-tool/SKILL.md, line 720

  return { articles: await ncbi.fetch(input.pmids, ctx) }; // throws bubble unchanged

  framework-skills/api-context/SKILL.md, line 633

  const response = await fetch(url, { signal: ctx.signal });

  framework-skills/api-context/SKILL.md, line 679

  const items = await fetch(input.ids);

  framework-skills/api-context/SKILL.md, line 719

  const items = await fetch(input.ids);

  framework-skills/api-context/SKILL.md, line 849

  const items = await fetch(input.limit);

  Dockerfile, line 166

  HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD bun -e "fetch('http://localhost:'+(process.env.MCP_HTTP_PORT??'3010')+'/healthz').then((r)=>process.exit(

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  framework-skills/api-workers/SKILL.md, line 197

  const apiKey = process.env.MY_API_KEY; // undefined in Workers

  framework-skills/api-workers/SKILL.md, line 201

  return ServerConfigSchema.parse({ apiKey: process.env.MY_API_KEY });

  scripts/devcheck.ts, line 695

  ':(glob)**/.npmrc',

  Show more

  framework-skills/api-workers/SKILL.md, line 258

  const r2Env = { ...env, STORAGE_PROVIDER_TYPE: 'cloudflare-r2' };

  framework-skills/setup/SKILL.md, line 37

  .env.example # Copy to .env and fill in

  scripts/devcheck.ts, line 687

  // `.env.d/`).

  scripts/devcheck.ts, line 693

  ':(glob)**/*.env*',

  scripts/devcheck.ts, line 694

  ':(glob)**/*.env*/**',

  scripts/devcheck.ts, line 696

  ':(glob)**/.netrc',

  scripts/devcheck.ts, line 697

  ':(glob)**/credentials.json',

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  tests/services/overpass/overpass-service.test.ts, line 1

  /**

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 4f9f66f88f8c. requests shell access. The manifest names this permission. dependencies are not pinned. can reach a host that is not written as a fixed address. can reach registry.npmjs.org. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen