Security

This page is the prose version of SECURITY.md.

The short version: there is no credential to steal by default, nothing this server can write, and the one thing worth thinking about is that your location queries travel to public services.

Trust model

This server holds no credentials by default — it talks to public, read-only OpenStreetMap services. All 11 tools are read-only and carry the MCP readOnlyHint annotation; the server cannot modify OpenStreetMap data, because the editing API is simply not wired up. There is no write mode to switch off.

The only optional secret is ORS_API_KEY, an OpenRouteService key. Compromising it lets an attacker consume the key owner's free-tier request quota — nothing more. It grants no access to any data of yours.

Where your data goes

The one real consideration: location queries are sent to the configured public services. A geocode of your home address, a route from your hotel, a POI search around where you are right now — each is an HTTPS request to Nominatim, OSRM, Overpass, Valhalla, Photon or OpenRouteService, subject to those operators' logging and privacy practices.

Do not use this server for locations you would not put in a third-party web request. For sensitive use, self-host the services and point the *_BASE_URL variables at your instances — every backend supports it, and the configuration page covers the details.

API-key handling

ORS_API_KEY is treated as radioactive from the moment it is read:

• It is deleted from process.env before anything else happens — before any configuration validation can throw — so a caller that catches a ConfigError and keeps running does not keep the key readable in /proc/<pid>/environ or inherited by child processes.
• It is redacted from error messages before they reach the model context.
• The server refuses to start with a key set and a cleartext non-loopback ORS_BASE_URL, because the key travels in an Authorization header.
• Invalid configuration values are not echoed in error messages — a key pasted into the wrong variable would otherwise land verbatim in the MCP host's log.

Untrusted content

OpenStreetMap data is user-contributed: place names, addresses and tags are written by millions of mappers, and a tag value can contain anything — including text that reads like instructions to a model. Every tool result carrying OSM-sourced content is therefore explicitly marked as untrusted data, not instructions, so the model treats a POI named "ignore all previous instructions" as a badly named POI.

Upstream error bodies get the same caution: they are truncated, and HTML error pages are dropped entirely before anything reaches the model context.

Network posture

• The server speaks stdio and never listens on a port.
• Redirects are never followed — a redirect would replay request headers (including the ORS Authorization header) at whatever host it names.
• Every request times out (30 s; 40 s for Overpass, whose queries also carry their own server-side 25 s budget).
• Responses are size-capped before they are buffered.

Being a good citizen is also a security property

The client-side rate limits, the Overpass concurrency cap, the identifying User-Agent and the response cache exist to honor the published usage policies of shared community infrastructure — but they double as protection for you: they make it impossible for a confused or manipulated model to turn this server into a request cannon fired from your IP address.

Reporting a vulnerability

Use private vulnerability reporting. Do not open a public issue for an unpatched vulnerability, and do not include real credentials, tokens, hostnames or private configuration in a report. You can expect an initial response within a week; fixes ship as a new release with a CHANGELOG note. Only the latest release and the current main branch receive security fixes.