AtlasFetch
NPM · ATLASFETCH-MCP
Coordinates to places and streets, ZA addresses to points, and routes around your own geofences.
Available components
Last scanned (3 hours ago)
Scores higher than 69% of npm servers
Category Maps and Location
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 30 of 92 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 5 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability59
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3667 tokens (~523/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 31 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 30 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 0.4.3 → 0.4.4 functional
- 28 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 27 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
- 24 Oct 26 0
- Stability: 0.97 → pass security
- 23 Oct 26 0
- Stability: pass → 0.97 functional
- 22 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 21 Oct 26 0
- Malware scan: unverified → pass ▲ security
- Package version: 0.4.2 → 0.4.3 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/atlasfetch-mcp@0.4.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 92 packages
| Packages resolved | 92 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_boundary Add a polygon to a boundary set ~496
Adds ONE polygon to an existing boundary set on this account, so that lookup_location reports when a point falls inside it — delivery zones, service areas, sales territories. Each call creates a new boundary: calling twice with the same name stores two. Before calling: the set must already exist (create_boundary_set). A set matches nothing in lookups until it is switched on and granted to an API key in the dashboard at https://atlasfetch.xyz/dashboard, which this server cannot do. geometry must be a single GeoJSON Polygon — not a MultiPolygon, Feature or FeatureCollection. Positions are [longitude, latitude]. Each ring needs at least 4 positions and must be closed (last position equals the first); extra rings are holes. Self-intersecting shapes are rejected. To store a MultiPolygon, add each part separately. A polygon may have at most 50 points on EVERY plan, the closing one included; more is refused, unbilled, with advice to simplify the shape or split it into several boundaries. Plan limits cap properties per boundary and boundaries per set. WITHOUT YOUR OWN KEY, the shared demo key is on the Public plan: properties only category (zone, area, route, place, other), color (green, blue, red, yellow, purple, orange) and priority (low, medium, high), and one set shared with every demo user, where adding to a full set silently deletes its oldest boundary. Never upload anything private with the demo key. Returns the stored boundary: id, set, name, properties, pointCount and createdAt.
| Name | Type | Req | Description |
|---|---|---|---|
| geometry | object | yes | A GeoJSON Polygon, e.g. {"type":"Polygon","coordinates":[[[18.40,-33.93],[18.40,-33.90],[18.44,-33.90],[18.44,-33.93],[18.40,-33.93]]]}. |
| name | string | yes | Label returned when a looked-up point falls inside this polygon, e.g. "Zone A". |
| properties | object | – | Optional flat key/value pairs returned with every match: keys up to 32 characters, values a string (up to 256 characters), number or boolean. The demo key accepts only category, color and priority, f… |
| set | string | yes | Name of an existing set on this account (see list_boundary_sets). |
No output schema declared.
No examples provided.
create_boundary_set Create a boundary set ~176
Creates an empty named set to hold your own polygons: delivery zones, service areas, sales territories. IMPORTANT, and not a bug: a new set is created unavailable and granted to no key, so it matches nothing until both are changed. Granting is addressed by API key id, and nothing this server can call tells it its own key's id. So this tool can create the set and add boundaries to it, but the FIRST grant has to happen in the dashboard: tell the user to switch the set on and grant it to the key this server uses, at https://atlasfetch.xyz/dashboard.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | A short name, used to reference the set in lookups: 1-32 letters, digits, hyphens or underscores, starting with a letter or digit. |
No output schema declared.
No examples provided.
geocode_address Geocode an address to a coordinate (South Africa) ~1,010
Turn ONE address into a point, with an honest account of how much of it was found. Built for deliveries. South Africa today; more countries as their data loads. 1 lookup per address, found or not. Send either q (one line) or address (housenumber, street, suburb, city, postcode, unit) — never both. If the address is already split, send it split: it matches better. READ precision BEFORE using the point. "address" means the house was found; "interpolated" means it was estimated between the numbers either side; "intersection" means a street corner ("Cnr Main Rd and Belmont Rd", "Bree & Strand Streets"), at the point where the two meet, with the second street in matched.crossStreet; "site" means a named site — a shopping centre, office park, complex or estate, hospital, school, airport or hotel — at a point inside it, named in matched.site; "street" means the right street but NOT the house; "locality" means only the suburb or town. NEVER present a street- or locality-level point as a door: a driver sent there will be at the wrong house. In South Africa most answers are street-level, because OpenStreetMap has house numbers on about 13% of street names — that is the data being honest, not a failure. What to do with an answer — the result line says which applies: - address, interpolated, intersection or site, not ambiguous, confidence 0.5 or more: dispatch. For a site, pass on the unit or shop number from the original address ("Shop 12") — the answer does not include it, and the driver needs it. - street: ask the recipient for a pin or a landmark. - ambiguous, or locality: ask the customer before dispatching. When the advice is to ask the customer, ASK — do not pick one. result.alternatives holds up to 4 other candidates the answer was chosen from, and the result line lists them with the suburb each lies in and its distance and direction from the first, because they often share a street name AND a town (five "Long Street, Cape Town"s: City Centre, Observatory, Maitl…
| Name | Type | Req | Description |
|---|---|---|---|
| address | object | – | The address already split into parts. Needs at least a street. Use instead of q. |
| base | array | – | Administrative layers to resolve at the found point. |
| country | string | – | ISO 3166-1 alpha-2, e.g. "ZA". A hard filter: only that country is searched. |
| q | string | – | The whole address on one line, e.g. "25 Adderley Street, Cape Town". |
| region | string | – | ISO 3166-2 ("ZA-WC") or a name ("Western Cape"). A preference, not a filter. |
| sets | array | – | Boundary sets on this account to match at the found point, e.g. delivery zones. |
| streetGeometry | string | – | The matched street’s line, trimmed to about 250 m. Only if something will draw it. |
No output schema declared.
No examples provided.
get_route Route between coordinates, optionally avoiding your own zones ~883
A driving, cycling, walking or truck route from the first location to the last, via any in between, with distance, duration and turn-by-turn steps. COST: a route is 10 LOOKUPS on the standard plans, not one (a custom plan may charge less; X-Lookups-Remaining is always the truth). Everything it returns is included in that, so do not call it in a loop to compare options without saying so. Durations are FREE-FLOW: the road network at its own speed limits, with NO live or historical traffic. Never present one as an arrival time in traffic — for that, say a traffic-aware service (Google, Mapbox) is needed. The route line is NOT returned unless routeGeometry is set, because an encoded polyline is thousands of characters that no one reads. Ask for it only when something will draw it. Locations are SNAPPED to the nearest routable road, and locations[] in the response says how far each one moved. A large snapDistanceMeters means the answer starts somewhere else than asked — worth repeating to the user. avoidSets and exposureSets name BOUNDARY SETS on the account (list_boundary_sets), not ad-hoc shapes. avoid routes around every zone in those sets; exposure leaves the route alone and reports how far it ran inside each zone. A zone containing one of the locations cannot be avoided for that route: it is skipped and reported in avoid.skipped. Along very many exposure zones (over 1,000, or over 5 s to measure) exposure is skipped: it comes back empty with a note in errors, and the route is still answered and billed. TRUCKS (Pro only): a truck over 9 t, or with no weightTonnes, is capped at 80 km/h, as South African law caps goods vehicles; a lighter truck keeps car speeds. The vehicle’s height, width, length, weight, axle load and hazmat are checked against road limits where OpenStreetMap records them, which is not everywhere — a good start, not a legal clearance. Limits by plan: 2 locations and 1 alternative on the free plans, up to 25 and 2 on Pro; alternatives need exa…
| Name | Type | Req | Description |
|---|---|---|---|
| alternatives | integer | – | Also return up to this many other routes. Exactly 2 locations only. Plan-capped. |
| avoidSets | array | – | Names of boundary sets on this account to route AROUND. Every zone in them is excluded. |
| exposureSets | array | – | Names of boundary sets to MEASURE against: the route is unchanged, and the answer says how many metres of it ran inside each zone. |
| geometry | string | – | DEPRECATED: use routeGeometry, which takes the same values. Removed in 1.0. |
| language | string | – | Language for the step instructions, e.g. "en-GB", "de-DE", "fr-FR". Defaults to en-US. |
| locations | array | yes | Origin, any stops in order, then destination. 2 on the free plans, up to 25 on Pro. |
| mode | string | – | Travel mode. Defaults to car. "truck" is Pro only; see TRUCKS above. |
| routeGeometry | string | – | The route line. Defaults to none. Ask for polyline6 or geojson only when something will draw it: it is long, and an assistant cannot read it usefully. |
| steps | boolean | – | Turn-by-turn steps per leg. Defaults to true here; set false for distance and time only. |
| vehicle | object | – | Truck dimensions and load. Only with mode "truck"; rejected otherwise. Give weightTonnes: without it the truck is treated as heavy (over 9 t) and capped at 80 km/h. |
No output schema declared.
No examples provided.
list_boundary_sets List the boundary sets on this account ~66
Lists the boundary sets on this account with their boundary counts and the API keys (id and label) each is granted to. A set only matches during a lookup when it is available AND granted to the key making the call. On the shared demo key, grantedKeys is always empty.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
lookup_location Look up the boundaries containing a coordinate ~704
Reverse geocode a coordinate to the administrative areas that contain it — country, region (state or province) and municipality — as names plus ISO 3166 codes, optionally the nearest street, and matches from boundary sets the account has uploaded: all in one call. Use for: which country, region or municipality a point is in; which street a point is on (add "street" to base); geofence checks against your own polygons; tagging data with region codes. For the other direction, an address to a coordinate, use geocode_address. For a route, a travel distance or a travel time, use get_route — 10 lookups on the standard plans to this one’s 1. Do NOT use for place search by name or for fetching boundary geometry. Caveats worth repeating to the user: municipal is the finest unit AVAILABLE, not a consistent kind of thing — Los Angeles returns a city, rural Kansas returns a county, so do not assume it names a city. A layer that matched nothing comes back null. The errors array is always present: a boundary set that is unavailable or not granted to this key is skipped and reported there, while the call itself still succeeds. STREETS (opt-in via base, worldwide). base.street is ALWAYS three answers, for 5 m, 20 m and unlimited in that order, each with radiusMeters, streetNumber, streetName, postcode and distanceMeters. A numbered address within the radius wins over a nearer street (for the unlimited entry the address must still be within 20 m); otherwise the nearest named street; unnamed roads never answer. Two different nulls: base.street === null means there is no street data for the point’s country, while an entry whose fields are null means nothing was within that radius — never report them the same way. streetNumber and postcode are STRINGS (44A, 12-14, 0181), house numbers are rare outside well-mapped areas. Street geometry comes back only when streetGeometry is set — leave it off unless something will draw the line. One call is one billed lookup however many layers, se…
| Name | Type | Req | Description |
|---|---|---|---|
| base | array | – | Which reference layers to resolve. Defaults to country, region and municipal. "street" is opt-in: add it explicitly to get the nearest street. |
| encode | array | – | Also return the point as an H3 cell index and/or Google Plus Code. Output only — neither can be used AS a location, because both name areas rather than points. |
| h3res | integer | – | H3 resolution 0-15. 9 is about 400 m across. |
| lat | number | yes | Latitude, -90 to 90. |
| lng | number | yes | Longitude, -180 to 180. |
| pluslen | – | – | Plus Code length. 9 is not a valid length. 10 is about 14 m. |
| sets | array | – | Names of the boundary sets on this account to match against. Defaults to none. |
| streetGeometry | string | – | Give each street answer the line of the street it names, trimmed to about 250 m either side of the point. Implies the street layer. Off by default, and leave it off unless something will draw it: a l… |
No output schema declared.
No examples provided.
update_boundary Move or reshape a boundary, keeping its name and properties ~215
Replace the shape of ONE existing boundary. Its id, name, properties and set stay as they are, so every lookup that matches it keeps returning the same properties. Use this to fix or move a zone. Do NOT delete it and add it again: that gives it a new id and loses the properties unless they are re-sent. Name the boundary by set and name; this finds its id. If a set holds two boundaries with that name, the answer lists their ids and asks for one. The new shape gets the same checks as add_boundary, including the 50-point cap (refused, unbilled). Only boundaries on this account can be changed.
| Name | Type | Req | Description |
|---|---|---|---|
| geometry | object | yes | The new shape: a GeoJSON Polygon. |
| id | string | – | The boundary’s id (a UUID), when it is known. Use this or name. |
| name | string | – | The boundary’s name. Use this or id. |
| set | string | yes | The set the boundary is in. |
No output schema declared.
No examples provided.
How do I install the AtlasFetch MCP server?
AtlasFetch runs locally as an npm package, launched with npx -y atlasfetch-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · atlasfetch-mcp
claude mcp add xyz-atlasfetch-atlasfetch -- npx -y atlasfetch-mcp
What is the AtlasFetch MCP server?
AtlasFetch is an MCP server listed in the public MCP registry as xyz.atlasfetch/atlasfetch. Coordinates to places and streets, ZA addresses to points, and routes around your own geofences. This page covers its npm package (atlasfetch-mcp).
Is the AtlasFetch MCP server safe to use?
AtlasFetch scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the AtlasFetch MCP server expose?
AtlasFetch exposes 7 tools: lookup_location, geocode_address, list_boundary_sets, create_boundary_set, add_boundary, and 2 more. Their descriptions and schemas cost roughly 3,550 tokens of context every time the server is loaded.
Is the AtlasFetch MCP server still maintained?
AtlasFetch is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the AtlasFetch MCP server under?
AtlasFetch declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.