# AtlasFetch (npm · atlasfetch-mcp)

Reverse geocode a coordinate to country, region and municipality, and match your own geofences.

- Trust score: 70/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-21

## Components

- npm · `atlasfetch-mcp`: 70/100 (this document), [markdown](https://verifymcp.io/servers/xyz-atlasfetch-atlasfetch/atlasfetch-mcp.md), [page](https://verifymcp.io/servers/xyz-atlasfetch-atlasfetch/atlasfetch-mcp)

## Channel facts

- Registry: `npm`
- Package: `atlasfetch-mcp`
- Version: `0.1.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-21.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 95 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 3 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1170 tokens (~292/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 17/100
  - Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 5 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the AtlasFetch MCP server?

AtlasFetch runs locally as an npm package, launched with npx -y atlasfetch-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add xyz-atlasfetch-atlasfetch -- npx -y atlasfetch-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "xyz-atlasfetch-atlasfetch": {
      "command": "npx",
      "args": [
        "-y",
        "atlasfetch-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "xyz-atlasfetch-atlasfetch": {
      "command": "npx",
      "args": [
        "-y",
        "atlasfetch-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add xyz-atlasfetch-atlasfetch -- npx -y atlasfetch-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "xyz-atlasfetch-atlasfetch": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "atlasfetch-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add xyz-atlasfetch-atlasfetch --command npx --arg -y --arg atlasfetch-mcp
```

### Hermes

```yaml
mcp_servers:
  xyz-atlasfetch-atlasfetch:
    command: "npx"
    args: ["-y", "atlasfetch-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "xyz-atlasfetch-atlasfetch": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "atlasfetch-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add xyz-atlasfetch-atlasfetch -t stdio -c npx -a -y atlasfetch-mcp
```

### Other

```json
{
  "mcpServers": {
    "xyz-atlasfetch-atlasfetch": {
      "command": "npx",
      "args": [
        "-y",
        "atlasfetch-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 69, +11)

- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → 0.85

### 2026-09-17 (score 58, +9)

- [security regression] Known CVEs: pass → unverified
- [security regression] Tool safety: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [security improvement] Source repository: fail → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Schema quality: 198 → 292
- [functional regression] Security disclosure: unverified → fail
- [functional regression] Dependency health: 0.85 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.03
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.1.1 → 0.1.4
- [functional] Package version: 0.1.1 → 0.1.3
- [functional] Package version: 0.1.1 → 0.1.2

### 2026-09-16 (score 49)

First indexed and scored.

## MCP tools (4)

### `lookup_location` (~398 tokens)

Look up the boundaries containing a coordinate

Reverse geocode a coordinate to the administrative areas that contain it — country,
region (state or province) and municipality — as names plus ISO 3166 codes, and match it
against boundary sets the account has uploaded, in the same call.

Use for: which country, region or municipality a point is in; geofence checks against your
own polygons; tagging data with region codes.
Do NOT use for: street addresses or postcodes (this is not forward geocoding, and results
stop at the municipality), routing, distances, or fetching boundary geometry.

Caveats worth repeating to the user: municipal is the finest unit AVAILABLE, not a
consistent kind of thing — Los Angeles returns a city, rural Kansas returns a county, so
do not assume it names a city. A layer that matched nothing comes back null. The errors
array is always present: a boundary set that is unavailable or not granted to this key is
skipped and reported there, while the call itself still succeeds.

One call is one billed lookup however many layers, sets or grid codes it touches, and a
call that matches nothing still bills.

Input parameters:

- `base` (array): Which reference layers to resolve. Defaults to all three.
- `encode` (array): Also return the point as an H3 cell index and/or Google Plus Code. Output only — neither can be used AS a location, because both name areas rather than points.
- `h3res` (integer): H3 resolution 0-15. 9 is about 400 m across.
- `lat` (number, required): Latitude, -90 to 90.
- `lng` (number, required): Longitude, -180 to 180.
- `pluslen`: Plus Code length. 9 is not a valid length. 10 is about 14 m.
- `sets` (array): Names of the boundary sets on this account to match against. Defaults to none.

### `list_boundary_sets` (~54 tokens)

List the boundary sets on this account

Lists the boundary sets on this account with their boundary counts and the API keys (id and label) each is granted to. A set only matches during a lookup when it is available AND granted to the key making the call.

### `create_boundary_set` (~165 tokens)

Create a boundary set

Creates an empty named set to hold your own polygons: delivery zones, service areas,
sales territories.

IMPORTANT, and not a bug: a new set is created unavailable and granted to no key, so it
matches nothing until both are changed. Granting is addressed by API key id, and the only
endpoint that lists key ids needs a browser session — which this server does not have. So
this tool can create the set and add boundaries to it, but CANNOT make it queryable. Tell
the user to finish that at https://atlasfetch.xyz/dashboard.

Input parameters:

- `name` (string, required): A short name, used to reference the set in lookups: 1-32 letters, digits, hyphens or underscores, starting with a letter or digit.

### `add_boundary` (~493 tokens)

Add a polygon to a boundary set

Adds ONE polygon to an existing boundary set on this account, so that lookup_location
reports when a point falls inside it — delivery zones, service areas, sales territories.
Each call creates a new boundary: calling twice with the same name stores two.

Before calling: the set must already exist (create_boundary_set). A set matches nothing in
lookups until it is switched on and granted to an API key in the dashboard at
https://atlasfetch.xyz/dashboard, which this server cannot do.

geometry must be a single GeoJSON Polygon — not a MultiPolygon, Feature or
FeatureCollection. Positions are [longitude, latitude]. Each ring needs at least 4
positions and must be closed (last position equals the first); extra rings are holes.
Self-intersecting shapes are rejected. To store a MultiPolygon, add each part separately.

Plan limits cap vertices per polygon (every position counts, including the closing one),
properties per boundary and boundaries per set; a limit hit is refused with a message naming
it. WITHOUT YOUR OWN KEY, the shared demo key is on the Public plan: at most 5 positions per
polygon (a closed quadrilateral), properties only category (zone, area, route, place,
other), color (green, blue, red, yellow, purple, orange) and priority (low, medium, high),
and one set shared with every demo user, where adding to a full set silently deletes its
oldest boundary. Never upload anything private with the demo key.

Returns the stored boundary: id, set, name, properties, pointCount and createdAt.

Input parameters:

- `geometry` (object, required): A GeoJSON Polygon, e.g. {"type":"Polygon","coordinates":[[[18.40,-33.93],[18.40,-33.90],[18.44,-33.90],[18.44,-33.93],[18.40,-33.93]]]}.
- `name` (string, required): Label returned when a looked-up point falls inside this polygon, e.g. "Zone A".
- `properties` (object): Optional flat key/value pairs returned with every match: keys up to 32 characters, values a string (up to 256 characters), number or boolean. The demo key accepts only category, color and priority, f…
- `set` (string, required): Name of an existing set on this account (see list_boundary_sets).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/xyz-atlasfetch-atlasfetch/atlasfetch-mcp#diagnostics

## Score history

- 2026-09-21: 70
- 2026-09-20: 70
- 2026-09-19: 69
- 2026-09-18: 69
- 2026-09-17: 58
- 2026-09-16: 49

## Common questions

### What is the AtlasFetch MCP server?

AtlasFetch is an MCP server listed in the public MCP registry as xyz.atlasfetch/atlasfetch. Reverse geocode a coordinate to country, region and municipality, and match your own geofences. This page covers its npm package (atlasfetch-mcp).

### Is the AtlasFetch MCP server safe to use?

AtlasFetch scores 70 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the AtlasFetch MCP server expose?

AtlasFetch exposes 4 tools: lookup_location, list_boundary_sets, create_boundary_set, add_boundary. Their descriptions and schemas cost roughly 1,110 tokens of context every time the server is loaded.

### Is the AtlasFetch MCP server still maintained?

AtlasFetch is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the AtlasFetch MCP server under?

AtlasFetch declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/atlasfetch-mcp
- Socket report: https://socket.dev/npm/package/atlasfetch-mcp
- Repository: https://github.com/atlasfetch-dev/atlasfetch-mcp
- Website: https://atlasfetch.xyz/
- Changelog RSS feed: https://verifymcp.io/servers/xyz-atlasfetch-atlasfetch/atlasfetch-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/xyz-atlasfetch-atlasfetch/atlasfetch-mcp.json
- HTML version of this page: https://verifymcp.io/servers/xyz-atlasfetch-atlasfetch/atlasfetch-mcp