mcp-server

# @ultimaps/mcp

An [MCP](https://modelcontextprotocol.io) server for [Ultimaps](https://ultimaps.com). Ask Claude, Codex or any MCP client for a map and get the image back in the conversation. It covers choropleths from pasted numbers, category maps and pinned locations, for countries, states, provinces, counties, continents and the world.

> "Map US states by population." · "Color the EU members by currency." · "Show France's regions with these unemployment rates: …" · "Pin our five offices on a map of Europe."

No account needed. Without an API key the server uses the keyless tier. Set `ULTIMAPS_API_KEY` for plan quotas and larger or unbranded output.

**Can't run a local command?** In ChatGPT (developer mode), claude.ai or any client that connects to remote MCP servers, add the hosted server instead: `https://api.ultimaps.com/mcp`. In ChatGPT, turn it on in each conversation where you want maps. It has the same three tools and nothing to install. See [Hosted server](#hosted-server). This package is the local version: requests come from your own IP address with your own key, and every image is saved to a file on your computer.

## Tools

| Tool | What it does |
|------|--------------|
| `render_map` | Renders a map as an image (PNG, or SVG with a Pro key), shown inline when it is small enough. Choropleth (numbers), categories (labels) or explicit colors, plus pins, title, legend, theme, labels and extra layers. Region names are matched fuzzily, and every correction or miss is reported with suggestions. `dryRun: true` previews matching and the color plan without rendering. |
| `list_maps` | The map catalog: `{id, title, regionType, layers, regionCount, labels}`, searchable with `query`. |
| `get_map_regions` | One map's region keys and titles, 200 per page, searchable by key, title or alias. |

All three are read-only. Agents rarely need the discovery tools: `render_map` accepts region names, codes and aliases directly.

## Install

Requires Node.js 20 or newer.

### Claude Code

```sh
claude mcp add ultimaps -- npx -y @ultimaps/mcp
# with a key:
claude mcp add ultimaps --env ULTIMAPS_API_KEY=um_live_… -- npx -y @ultimaps/mcp
```

### Codex

```sh
codex mcp add ultimaps -- npx -y @ultimaps/mcp
# with a key:
codex mcp add ultimaps --env ULTIMAPS_API_KEY=um_live_… -- npx -y @ultimaps/mcp
```

Codex writes TOML, not the JSON below. The equivalent entry in `~/.codex/config.toml` (or `.codex/config.toml` in a trusted project):

```toml
[mcp_servers.ultimaps]
command = "npx"
args = ["-y", "@ultimaps/mcp"]
```

### Claude Desktop

Download `ultimaps-<version>.mcpb` from the [latest release](https://github.com/ultimaps/mcp-server/releases/latest) and open it: Claude Desktop installs it in one click and asks for the optional API key. Or add this to `claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "ultimaps": {
      "command": "npx",
      "args": ["-y", "@ultimaps/mcp"],
      "env": { "ULTIMAPS_API_KEY": "" }
    }
  }
}
```

### Cursor

`~/.cursor/mcp.json` (or `.cursor/mcp.json` in a project):

```json
{
  "mcpServers": {
    "ultimaps": { "command": "npx", "args": ["-y", "@ultimaps/mcp"] }
  }
}
```

### VS Code

`.vscode/mcp.json`:

```json
{
  "servers": {
    "ultimaps": { "type": "stdio", "command": "npx", "args": ["-y", "@ultimaps/mcp"] }
  }
}
```

### Hosted server

You don't need this package to use the hosted server. Add the URL to your client:

```sh
claude mcp add --transport http ultimaps https://api.ultimaps.com/mcp
# with a key:
claude mcp add --transport http ultimaps https://api.ultimaps.com/mcp \
  --header "Authorization: Bearer um_live_…"
```

Clients with a config file take the URL alone, for example `~/.cursor/mcp.json`:

```json
{
  "mcpServers": {
    "ultimaps": { "url": "https://api.ultimaps.com/mcp" }
  }
}
```

The hosted server sends a key as an `Authorization` header, not as `ULTIMAPS_API_KEY`. In ChatGPT and claude.ai you can't set headers, so renders there use the anonymous tier: PNG up to 1600 px with attribution, up to 30 per hour per conversation. Every render also comes back as an image link that expires after 30 days. Images too large for the conversation, and all SVGs, come back only as the link. ChatGPT doesn't show images returned by tools, so the link is how you see the map there.

## Configuration

| Variable | Default | Purpose |
|----------|---------|---------|
| `ULTIMAPS_API_KEY` | none (keyless) | API key from [Studio → Workspace → API](https://studio.ultimaps.com/account/workspace/api). An invalid key is an error and never falls back to keyless. |
| `ULTIMAPS_API_URL` | `https://api.ultimaps.com` | Point at a local API during development (`http://localhost:3001`). Plain http is only accepted for localhost. |

## Limits

| | Keyless | Free key | Pro key |
|---|---|---|---|
| Renders | 30/hour, 5/minute | 500/month, 50/day, 10/minute | 5,000/month, 1,000/day, 30/minute |
| Output | PNG up to 1600 px, attribution | PNG up to 1600 px at scale 2 (a 3200 px raster), attribution | PNG up to 4000 px at scale 4, SVG, no attribution |

All keys in a workspace share the monthly quota. The daily and per-minute caps are per key, so a free key stops at 50 renders a day long before the month runs out.

Dry runs skip the monthly quota but still count against rate limits. When five or fewer keyless renders remain in the hour, the result says so.

## What a render returns

- **The image**, inline, when it is small enough (781 KB for PNG, 98 KB for SVG). The default 1200 px width usually fits. Every render is also written to `<tmpdir>/ultimaps-mcp/` and the path is in the result, so in a terminal client the file is the thing you can actually open. Nothing is re-rendered or resampled on your behalf.
- **A text report**: auto-corrected and unmatched region keys with suggestions, the resolved choropleth plan, warnings (such as `layer_unavailable`), a link to open the map in Ultimaps Studio for editing, and the render id for support.
- **An embeddable image URL** for keyless PNG renders whose whole spec fits a ~2,000-character URL, so small datasets only. The URL carries the spec, not the image, and renders keyless, so it is not offered when a key is set.
- **`structuredContent`** with the same report as data, described by the tool's `outputSchema`.

## Privacy Policy

This server runs on your machine, has no telemetry of its own and talks only to the Ultimaps API (`https://api.ultimaps.com`, or the `ULTIMAPS_API_URL` you set). The full Ultimaps privacy policy is at [ultimaps.com/privacy-policy](https://ultimaps.com/privacy-policy/).

**What is sent to Ultimaps.** Tool calls are ordinary HTTPS requests to the Ultimaps API, so they arrive from your IP address with an `ultimaps-mcp/<version>` user agent. `render_map` sends the whole map request: region keys and values, pins, title and styling. If you set `ULTIMAPS_API_KEY`, it is sent with render requests only.

**What Ultimaps keeps.** Each render request is logged: the request content, the map and outcome, timing, your IP address and user agent, and for keyed requests which key and workspace made it. This lets support look up a render id, lets the "Open in Studio" link rebuild your map, and counts usage. The request content is kept for 30 days and the IP address and user agent for 90 days. What remains is a usage record, tied to your workspace when a key was used. Ultimaps uses a third-party error-monitoring service that may receive details of a failed request. Ultimaps does not sell this data or use it for advertising.

**What stays on your machine.** Every rendered image is written to `<tmpdir>/ultimaps-mcp/` and this server never deletes it. What your MCP client keeps, including tool results in your conversation, is governed by its own privacy policy.

**Shareable links.** The embeddable image URL offered for small keyless renders contains the full map request. Anyone with the link can read it.

**The hosted server.** The server at `https://api.ultimaps.com/mcp` runs on Ultimaps' servers, not yours, so the section above about your machine doesn't apply to it. The full privacy policy covers it.

Questions or deletion requests: [support@ultimaps.com](mailto:support@ultimaps.com), quoting the render id.

## Development

```sh
npm install
npm run typecheck
npm test           # unit + in-process protocol tests
npm run build      # → dist/
```

End-to-end over stdio against a real API (spends render units from your tier):

```sh
npm run build
node scripts/smoke.mjs
```

`src/generated/render-request.schema.json` is generated from the Ultimaps API contract; do not edit it by hand. Tool and property descriptions live in `src/descriptions.ts`. Arguments are never validated locally: the API is additive-only, and its 400 responses carry suggestions.

Issues and pull requests are welcome. Releases are cut by the Ultimaps team, and accepted changes ship with the next release.

The package publishes a `bin` and nothing else. `import '@ultimaps/mcp'` is not
supported and fails by name, because `dist/index.js` starts a stdio server when
it loads.

## License

MIT © Ultimaps. See [LICENSE](./LICENSE).