# Zip-Codes.com Location Intelligence: Spatial Analysis, Districts & 14+ Years of Demographics (remote · mcp.zip-codes.com)

Validate & geocode a US address: demographics, districts & schools. Agents can buy credits via MPP.

- Trust score: 71/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `mcp.zip-codes.com`: 71/100 (this document), [markdown](https://verifymcp.io/servers/com-zip-codes-api/mcp.md), [page](https://verifymcp.io/servers/com-zip-codes-api/mcp)

## Channel facts

- Endpoint: `https://mcp.zip-codes.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 57/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 6392 tokens (~532/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 53/100
  - Stability observed for 16 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Zip-Codes.com Location Intelligence: Spatial Analysis… MCP server?

Zip-Codes.com Location Intelligence: Spatial Analysis… is a hosted endpoint at https://mcp.zip-codes.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-zip-codes-api 'https://mcp.zip-codes.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-zip-codes-api": {
      "url": "https://mcp.zip-codes.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-zip-codes-api": {
      "type": "http",
      "url": "https://mcp.zip-codes.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-zip-codes-api]
url = "https://mcp.zip-codes.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-zip-codes-api": {
      "type": "remote",
      "url": "https://mcp.zip-codes.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-zip-codes-api --url 'https://mcp.zip-codes.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-zip-codes-api:
    url: "https://mcp.zip-codes.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-zip-codes-api": {
      "Transport": "http",
      "Url": "https://mcp.zip-codes.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-zip-codes-api -t streamable-http -u 'https://mcp.zip-codes.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-zip-codes-api": {
      "type": "http",
      "url": "https://mcp.zip-codes.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-04 (score 70, 0)

- [cosmetic] “radius_search” reworded the description of “include”
- [cosmetic] “validate_address” reworded the description of “include”
- [cosmetic] “zip_lookup” reworded the description of “include”

### 2026-11-03 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 69, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [functional regression] Schema quality: 5540 → 6314
- [functional] New tool “buy_credits”
- [cosmetic] “distance” added an optional parameter “api_key”
- [cosmetic] “quick_zip” added an optional parameter “api_key”
- [cosmetic] “radius_search” added an optional parameter “api_key”
- [cosmetic] “suggest_places” added an optional parameter “api_key”
- [cosmetic] “validate_address” added an optional parameter “api_key”
- [cosmetic] “zip_lookup” added an optional parameter “api_key”
- [cosmetic] “validate_address” reworded the description of “include”
- [cosmetic] “zip_lookup” reworded the description of “include”

### 2026-10-31 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-27 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-25 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (12)

### `suggest_places` (~475 tokens)

Place search (type-ahead)

Search for a place by partial name, misspelled name, or partial code — the resolver that turns what a person typed into something the other tools can look up. Fuzzy matching is built in: "beverley hills" finds Beverly Hills, "san fransisco" finds San Francisco, and a partial code like "902" finds the ZIP Codes starting with it. Matches US ZIP Codes, cities, USPS city names, counties, metropolitan areas, states, school districts, Canadian FSAs and Canadian postal codes, ranked, with the total number of matches. Reach for this FIRST when the place is vague, misspelled or partial, then pass the resolved code to zip_lookup, radius_search or distance. Restrict the kinds of place with types, or bias results towards a location with near. Coverage is broad rather than deep — it returns names and codes, not the full record.

Input parameters:

- `api_key` (string|null): Your ZIP-Codes.com API key, only when you cannot send it as the X-Api-Key or Authorization: Bearer header (for example a key bought with buy_credits in this conversation). Leave it out to use the fre…
- `country` (string): Restrict to one country. Omit to search both.
- `limit` (integer|null): How many results to return. Defaults to 10; free-tier and demo callers are capped at 15, paid keys reach 500. With a key the credit cost follows the requested limit (up to 15: 1 credit; 50: 2; 150: 3…
- `near` (string|null): Bias results towards somewhere. Accepts 'latitude,longitude', a 5-digit ZIP Code, a 3-character Canadian FSA, or a two-letter state or province abbreviation.
- `q` (string, required): What the user typed. At least one character, at most 200.
- `state` (string|null): Restrict to one US state or Canadian province, as a two-letter abbreviation such as CA, NY or ON.
- `types` (array|null): Restrict to these kinds of place. Omit to search all of them.

### `zip_lookup` (~816 tokens)

ZIP Code lookup

The full record for a postal code — the main location-intelligence tool. Takes a US ZIP Code, a US ZIP+4, a Canadian FSA, a Canadian postal code, or a latitude,longitude pair, and returns the city, state or province, county, whether it spans more than one county, area codes, elevation, metro area and postal details (metro.msa and metro.pmsa are legacy 1999 definitions; the current metro area, the CBSA, comes with census). A ZIP+4 also returns its delivery-segment street ranges, and coordinates reverse-geocode to the code containing the point. Optional enrichments add timezone, census geography, congressional and state legislative districts (for the current year or any TIGER/Line year served), school districts, demographics, Medicare geography and American Community Survey estimates for every release served, all in one schema per year; for Canadian codes, Statistics Canada geography and federal electoral districts (statcan). Use quick_zip instead when only the code and its place are needed — same inputs, about half the payload, no enrichments beyond timezone. Without an API key the core identity fields are returned and everything else is withheld, with each withheld path named.

Input parameters:

- `acs_years` (array|null): Alias, kept for clients that learned it before include took year flags: ACS release years for the bare acs_ profiles in include (acs_social with acs_years [2015, 2024] is acs_social_2015 plus acs_soc…
- `api_key` (string|null): Your ZIP-Codes.com API key, only when you cannot send it as the X-Api-Key or Authorization: Bearer header (for example a key bought with buy_credits in this conversation). Leave it out to use the fre…
- `code` (string, required): A US ZIP Code, ZIP+4, Canadian FSA, or Canadian postal code. For example 90210, 90210-1234, M5V, or M5V 2T6.
- `include` (array|null): Enrichments, spelled as the REST API's /v2/zip include flags. Each multiplies the credit cost: base times (1 + number of enrichments). census, cd (congressional district) and state_leg are US Census…

### `zip_facts` (~82 tokens)

ZIP Code facts

Statistics about US ZIP Codes and Canadian postal codes: how many exist, how they break down by type, delivery point and carrier route totals, per-state tables, and ranked lists such as the ZIP Codes with the most carrier routes. Every figure is generated from a stored query against the source data, with the date it was measured. Costs nothing and needs no key.

### `quick_zip` (~331 tokens)

Quick ZIP / ZIP+4 / reverse geocode

The fast, small answer for a postal code. Takes a US ZIP Code, a US ZIP+4, a Canadian FSA, a Canadian postal code, or a latitude,longitude pair, and returns the code's city, state or province, county, and whether it spans more than one county. Given a ZIP+4 it also returns the street ranges making up that delivery segment; given coordinates it reverse-geocodes to the code containing the point. zip_lookup accepts exactly the same inputs and returns the same ZIP+4 detail — choose this one when the answer only needs to be the code and its place, because the payload is about half the size and only the timezone enrichment is available here. Use zip_lookup for census, demographic, district or American Community Survey enrichments.

Input parameters:

- `api_key` (string|null): Your ZIP-Codes.com API key, only when you cannot send it as the X-Api-Key or Authorization: Bearer header (for example a key bought with buy_credits in this conversation). Leave it out to use the fre…
- `code` (string, required): A US ZIP Code, ZIP+4, Canadian FSA, Canadian postal code, or a latitude,longitude pair. For example 90210, 90210-1234, M5V, M5V 2T6, or 34.10,-118.41.
- `include` (array|null): Enrichments to add. Only timezone is available on this tool; use zip_lookup for census, district, demographic and ACS enrichments.

### `city_name_rules` (~90 tokens)

City name rules

How USPS names a ZIP Code, and which of those names may be used on mail. Each ZIP Code has exactly one preferred city name plus alternates, and some alternates are NOT valid for addressing — for 08088 NJ, SHAMONG is valid while SHAMONG TOWNSHIP is not. Returns the rules, the counts and a worked example. Costs nothing and needs no key.

### `buy_credits` (~376 tokens)

Buy credits

Buy a credit pack with a wallet that pays MPP (Machine Payments Protocol) challenges, such as Stripe Link. The credits go on the account or prepaid card of the API key you send. Without a key, the purchase makes a prepaid card: a new API key holding the credits, in the result's api_key; pass it as api_key on later calls, and keep it (it is shown again only while the card is unused, for 24 hours). Name the pack by pack, price_usd or credits (the packs: https://api.zip-codes.com/pricing.json). The first call answers Payment Required (-32042) with a challenge for that pack and charges nothing; a wallet that pays it sends the same call again with its credential and gets the purchase back: its purchase_id, the credits added and a receipt. The same payment sent again is never charged twice. A payment still clearing reads processing, with no credits yet: send the same call again later. Without a wallet, ask your human to buy at https://www.zip-codes.com/api/pricing. By paying you accept the Terms of Service: https://www.zip-codes.com/api/tos

Input parameters:

- `api_key` (string|null): Your ZIP-Codes.com API key, only when you cannot send it as the X-Api-Key or Authorization: Bearer header (for example a key bought with buy_credits in this conversation). Leave it out to use the fre…
- `credits` (integer|null): The pack's credits, for example 6250.
- `pack` (string|null): The pack name from pricing.json, any case, for example Mini.
- `price_usd` (number|null): The pack's price in US dollars, for example 5.

### `radius_search` (~875 tokens)

Radius search

Find every US ZIP Code and Canadian postal area within a radius of a centre point, with the distance to each. The centre takes a US ZIP Code, a US ZIP+4, a Canadian FSA, a Canadian postal code, or a latitude,longitude pair; a ZIP+4 searches from its parent ZIP, and coordinates are used as the point itself, so the centre comes back with no code. Centroid mode measures centre to centre and reaches 500 miles; spatial mode intersects real boundaries, reports how much of each area falls inside, and reaches 250 miles. Set a minimum radius to search a ring rather than a circle. summary.total_count is the number of matches returned; when the list is cut, summary.total_available is the number in the radius and a notice says so. ACS statistics always cover the whole radius. They are aggregates of the ZIP Codes' estimates: est and pct only, with no margin of error or Census column; for one ZIP Code's estimate with its margin of error, use zip_lookup. timezone and ACS come back with the search itself; only census and district data need zip_lookup per ZIP. Without an API key the count and a sample of matches are returned and the rest is withheld; free-tier keys are capped at 100 miles centroid and 50 spatial.

Input parameters:

- `acs_years` (array|null): Alias, kept for clients that learned it before include took year flags: ACS release years for the bare acs_ profiles in include (acs_social with acs_years [2015] is acs_social_2015). Prefer the year…
- `api_key` (string|null): Your ZIP-Codes.com API key, only when you cannot send it as the X-Api-Key or Authorization: Bearer header (for example a key bought with buy_credits in this conversation). Leave it out to use the fre…
- `code` (string, required): Centre point: a US ZIP Code, ZIP+4, Canadian FSA or postal code, or a latitude,longitude pair.
- `include` (array|null): Enrichments, spelled as the REST API's /v2/radius include flags; each multiplies the credit cost. timezone lands on each match. acs_PROFILE (current release) and acs_PROFILE_YYYY return aggregate sta…
- `limit` (integer|null): Maximum number of matches to return, up to 100, which is also the default. A larger value is reduced to 100 and the result says so in notices. When the list is cut, summary.total_available is the num…
- `max` (string, required): Radius in miles, as a number or a string. Up to 500 in centroid mode or 250 in spatial mode; exceeding the cap is an error rather than being reduced. May also be 'auto' to pick a radius from local po…
- `min` (number|null): Minimum radius in miles, to exclude the middle and search a ring. Must be less than max. Defaults to 0.
- `mode` (string): How to measure. centroid measures centre to centre and is the default when omitted; spatial intersects actual boundaries and adds how much of each area lies inside, at a lower maximum radius.

### `about_data` (~66 tokens)

About this data

Where this server's data comes from: for each dataset the authority behind it, the edition served where the source publishes editions (TIGER/Line, ACS, ZCTA), how often a new release is taken, and a ready-made citation string. Costs nothing and needs no key.

### `distance` (~260 tokens)

Distance between two places

Distance between two places, in miles and kilometres, plus the compass bearing from the first to the second. Each end takes a US ZIP Code, a US ZIP+4, a Canadian FSA, a Canadian postal code, or a latitude,longitude pair, and the two ends can be different kinds — a US ZIP to a Canadian postal code works, and so does a code to a coordinate. Time zone for both ends is included. This is a straight-line distance, not a driving route. Without an API key the distance itself is returned and the geography behind it is withheld.

Input parameters:

- `api_key` (string|null): Your ZIP-Codes.com API key, only when you cannot send it as the X-Api-Key or Authorization: Bearer header (for example a key bought with buy_credits in this conversation). Leave it out to use the fre…
- `from` (string, required): Origin: a ZIP Code, ZIP+4, Canadian FSA or postal code, or latitude,longitude. For example 90210, M5V 2T6, or 34.10,-118.41.
- `to` (string, required): Destination, in any of the same forms as the origin.

### `validate_address` (~927 tokens)

Validate a US address

Validate and standardise a US street address and return its ZIP+4. US ONLY — unlike the postal-code tools, this does not cover Canada. Send the address on one line in mailing order: number and street, then any unit (APT 4, STE 900, #9), then city, state and ZIP. It tolerates ordinary slips (a misspelling, a missing ZIP, state or directional), but it is not a puzzle to solve: a unit placed after the city or ZIP ("Pensacola FL #9") is ambiguous, a unit or a floor. Send what the user gave you, in proper order, once. If it does not match, report that; do not keep trying rewrites. Returns the address in USPS standard form split into its parts, the 5-digit ZIP and the +4 add-on, a confidence level of high, medium or low (low: the +4 may be withheld), and the county, carrier route, congressional district and census block group for the match, all for one credit. `include` appends more, one credit each: coordinates, the census geographies the address sits inside, its congressional and state legislative districts (now or as of any TIGER/Line year served), its school district, its time zone, and American Community Survey profiles for its census tract. The congressional district already in `details` is USPS's own code for the record; the `cd` append is the mapped district, with its number, name and the congress it belongs to. Always read `notices`. ZIP_CORRECTED means the match is in a different ZIP than the one supplied. SECONDARY_NEEDED means the building has multiple units and an apartment or suite number should be requested. SECONDARY_NOT_VERIFIED means a supplied unit could not be confirmed against known ranges. PARTIAL_MATCH means some details are unverified. A failed match returns success false, sometimes with no notice explaining why, so check success rather than assuming the data block is populated. Without an API key the standardised address is returned with the +4 masked.

Input parameters:

- `address` (string, required): The address on one line. A city and state, or a ZIP Code, helps but neither is required — '1600 Pennsylvania Ave NW, Washington DC' and '1600 Pennsylvania Ave NW 20500' both resolve. Between 9 and 30…
- `api_key` (string|null): Your ZIP-Codes.com API key, only when you cannot send it as the X-Api-Key or Authorization: Bearer header (for example a key bought with buy_credits in this conversation). Leave it out to use the fre…
- `include` (array|null): Data to append to the match, spelled exactly as the REST API's /v2/address include flags, each costing one extra credit. 'coordinates' adds the latitude and longitude. 'census' adds the county, count…

### `county_reference` (~181 tokens)

County reference

US counties and county equivalents — all 3,235 of them — with their Census and USPS names, which disagree for over a hundred, plus ANSI code, legal type, land and water area, and USPS delivery footprint. Filter by state to get every county in that state: without a filter only the first 25 are returned, and they are FIPS-ordered, so an unfiltered call answers with Alabama rather than with whatever was asked about. Costs nothing and needs no key.

Input parameters:

- `limit` (integer|null): Cap the number of counties returned. Defaults to 25 when no state is given, or to all of them when one is.
- `state` (string): Two-letter US state or territory code. Returns EVERY county in that state, so no limit is needed — Texas is the largest at 254. Omit to browse all states.

### `metro_area_reference` (~215 tokens)

Metro area reference

US metropolitan and micropolitan statistical areas (CBSAs) — all 935. Of those only 393 are metropolitan; the rest are micropolitan and are NOT metro areas, so do not treat a CBSA count as a metro count. Each carries its divisions, parent combined area, land area and delivery footprint, plus the CMS Medicare labor market area, which is a DIFFERENT geography that shares the same code space. Filter by state to get every area in that state: without a filter only the first 25 are returned, alphabetically, so an unfiltered call answers with Aberdeen. Costs nothing and needs no key.

Input parameters:

- `limit` (integer|null): Cap the number of areas returned. Defaults to 25 when no state is given, or to all areas in the state when one is.
- `state` (string): Two-letter US state or territory code. Returns every area that includes that state — an area can span several, so it is matched against the area's whole state list. Omit to browse all states.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-zip-codes-api/mcp#diagnostics

## Score history

- 2026-11-05: 71
- 2026-11-04: 70
- 2026-11-03: 70
- 2026-11-02: 69
- 2026-11-01: 69
- 2026-10-31: 69
- 2026-10-30: 68
- 2026-10-29: 68
- 2026-10-28: 67
- 2026-10-27: 67
- 2026-10-26: 66
- 2026-10-25: 66
- 2026-10-24: 65
- 2026-10-23: 65
- 2026-10-22: 64
- 2026-10-21: 64
- 2026-10-20: 63

## Common questions

### What is the Zip-Codes.com Location Intelligence: Spatial Analysis… MCP server?

Zip-Codes.com Location Intelligence: Spatial Analysis… is an MCP server listed in the public MCP registry as com.zip-codes/api. Validate & geocode a US address: demographics, districts & schools. Agents can buy credits via MPP. This page covers its hosted endpoint (https://mcp.zip-codes.com/mcp).

### Is the Zip-Codes.com Location Intelligence: Spatial Analysis… MCP server safe to use?

Zip-Codes.com Location Intelligence: Spatial Analysis… scores 71 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Zip-Codes.com Location Intelligence: Spatial Analysis… MCP server expose?

Zip-Codes.com Location Intelligence: Spatial Analysis… exposes 12 tools: suggest_places, zip_lookup, zip_facts, quick_zip, city_name_rules, and 7 more. Their descriptions and schemas cost roughly 4,694 tokens of context every time the server is loaded.

### Does the Zip-Codes.com Location Intelligence: Spatial Analysis… MCP server require authentication?

No. We connected to Zip-Codes.com Location Intelligence: Spatial Analysis… without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Zip-Codes.com Location Intelligence: Spatial Analysis… MCP server still maintained?

Zip-Codes.com Location Intelligence: Spatial Analysis… is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://mcp.zip-codes.com/mcp
- Repository: https://github.com/ZIP-Codes-API/zip-codes-mcp
- Website: https://www.zip-codes.com/api/mcp
- Changelog RSS feed: https://verifymcp.io/servers/com-zip-codes-api/mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-zip-codes-api/mcp.json
- HTML version of this page: https://verifymcp.io/servers/com-zip-codes-api/mcp