by gaopengbin
AI-powered CesiumJS 3D globe control 49 tools for camera, entities, layers, animation & spatial analysis via Model Context Protocol (MCP). Natural language to 3D GIS.
# Add to your Claude Code skills
git clone https://github.com/gaopengbin/cesium-mcpLast scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server: Middleware bypass via repeated slashes in serveStatic",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "basic-ftp: basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",
"severity": "high"
},
{
"type": "npm-audit",
"message": "dompurify: DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express-rate-limit: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono missing validation of cookie name on write path in setCookie()",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "miniflare: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
"severity": "high"
},
{
"type": "npm-audit",
"message": "undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vitepress: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "wrangler: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-05-30T16:38:39.258Z",
"npmAuditRan": true,
"pipAuditRan": true
}cesium-mcp is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by gaopengbin. AI-powered CesiumJS 3D globe control 49 tools for camera, entities, layers, animation & spatial analysis via Model Context Protocol (MCP). Natural language to 3D GIS. It has 122 GitHub stars.
cesium-mcp failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/gaopengbin/cesium-mcp" and add it to your Claude Code skills directory (see the Installation section above).
cesium-mcp is primarily written in JavaScript. It is open-source under gaopengbin on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh cesium-mcp against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
https://github.com/user-attachments/assets/8a40565a-fcdd-47bf-ae67-bc870611c908
| Module | Role | Status | Links |
|---|---|---|---|
| cesium-mcp-contracts | Transport-neutral names, descriptions, and JSON Schemas for browser tools | New shared layer | source |
| cesium-mcp-bridge | Protocol- and transport-free Cesium command executor (60+ commands) | Mainline, actively iterated | |
| cesium-mcp-webmcp | Native document.modelContext adapter for Cesium tool contracts |
New browser adapter | source |
| examples/webmcp-integration | Focused npm + Vite integration without a chat UI or MCP server | Developer example | example |
| examples/browser-agent | Browser-only AI agent with automatic WebMCP exposure | Recommended | example · live demo |
| cesium-mcp-runtime | MCP server (stdio + HTTP) | Stable + MCP v2 preview | |
| cesium-mcp-dev | CesiumJS API knowledge base for coding assistants | Maintained |
Which one? Personal project or quick try → browser-agent. Let a compatible browser agent discover page-local Cesium tools → WebMCP. Existing web app embedding an AI assistant → bridge + your own function calling. Calling from Claude Desktop / Cursor / Dify → MCP runtime.
flowchart LR
subgraph clients ["AI Drivers (pick one)"]
BA["Browser Agent\n(in the same page)"]
WM["WebMCP Agent\n(browser-provided)"]
FC["Your web app\nfunction calling"]
MCP["Claude / Cursor / Dify\nvia MCP runtime"]
end
CONTRACTS["cesium-mcp-contracts\ntool definitions"]
WEBMCP["cesium-mcp-webmcp\nnative adapter"]
subgraph core ["cesium-mcp-bridge (browser)"]
B["60+ tools\nprotocol-agnostic dispatcher"]
C["CesiumJS Viewer"]
end
CONTRACTS -.-> BA
CONTRACTS -.-> WEBMCP
BA -- "in-page call" --> B
WM -- "document.modelContext" --> WEBMCP
WEBMCP --> B
FC -- "in-page call" --> B
MCP -- "WebSocket / JSON-RPC" --> B
B --> C
style clients fill:#1e293b,stroke:#528bff,color:#e2e8f0
style core fill:#1e293b,stroke:#12B76A,color:#e2e8f0
The bridge remains the execution core, while contracts and protocol adapters stay separate. Pick whichever driver matches your scenario — they all reach the same Cesium command layer. On WebMCP-capable browsers, cesium-mcp-webmcp can expose 61 browser-safe commands in 12 selectable toolsets through document.modelContext without adding an MCP transport or backend server.
Open the live demo and ask—the hosted model is ready without a browser API key:
"Fly to the Eiffel Tower and drop a red marker"
Fork the examples/browser-agent folder to deploy your own.
The browser-agent example automatically registers all 61 browser-safe page tools when document.modelContext is available. Its built-in chat uses automatic toolset routing to keep each normal request at 20 tools or fewer, while still offering explicit core, single-toolset, and all-61 modes:
npm run build -w packages/cesium-mcp-bridge
npm run build -w packages/cesium-mcp-webmcp
npx serve . -l 4173
Open http://localhost:4173/examples/browser-agent/, click Start, then inspect or execute the tools in DevTools → Application → WebMCP. Enable #enable-webmcp-testing and #devtools-webmcp-support in chrome://flags for local testing.
Application developers install the adapter separately. End users only open the integrated website; they do not install npm packages or run an MCP server.
npm install cesium cesium-mcp-bridge cesium-mcp-webmcp
import { CesiumBridge } from 'cesium-mcp-bridge'
import { registerCesiumWebMcp } from 'cesium-mcp-webmcp'
const bridge = new CesiumBridge(viewer)
const registration = await registerCesiumWebMcp(bridge, {
toolsets: 'all',
excludeTools: ['geocode'], // add your own browser geocoder to expose this tool
})
// Later, if the page is unmounted:
registration.unregister()
See the WebMCP adapter API for custom integrations. For a complete npm + Vite application, start from the WebMCP integration example.
npm install cesium-mcp-bridge
import { CesiumBridge } from 'cesium-mcp-bridge';
const bridge = new CesiumBridge(viewer);
// Then: send the bridge's tool schema to any LLM that supports function/tool calling,
// route the model's tool calls to bridge.execute(name, params).
See examples/browser-agent/index.html for a complete loop with OpenAI-compatible APIs.
Install bridge as in Path 2, then start the MCP runtime:
# Stable channel — npm latest (1.143.3)
npx cesium-mcp-runtime
# MCP v2 preview — npm next (1.143.4-next.0)
npx cesium-mcp-runtime@next
# HTTP mode; add @next to use the preview
npx cesium-mcp-runtime --transport http --port 3000
npx cesium-mcp-runtime@next --transport http --port 3000
The next preview serves existing MCP 2025-11-25 clients and the new
2026-07-28 protocol from the same stdio/HTTP entry. It uses the stable
TypeScript SDK v2 and has passed the official server-stateless conformance
scenario (28/28). The npm latest tag remains on 1.143.3, so you can switch
back by removing @next. For matching preview package versions, install
cesium-mcp-bridge@next in the browser application.
MCP client config:
{
"mcpServers": {
"cesium": {
"command": "npx",
"args": ["-y", "cesium-mcp-runtime"]
}
}
}
To test the preview from an MCP client, change the last argument to
"cesium-mcp-runtime@next".
Tools are organized into 12 toolsets. Default mode enables 4 core toolsets (30 tools). Set CESIUM_TOOLSETS=all for everything, or let the AI discover and activate toolsets dynamically at runtime.
Canonical contracts: Tool descriptions default to English; set
CESIUM_LOCALE=zh-CNfor Chinese. Titles, behavior annotations, localized descriptions, defaults, and Runtime input validation all come from the shared JSON Schemas incesium-mcp-contracts.
| Toolset | Tools |
|---|---|
| view (default) | flyTo, setView, getView, zoomToExtent, saveViewpoint, loadViewpoint, listViewpoints, exportScene |
| entity (default) | addMarker, addLabel, addModel, addPolygon, addPolyline, updateEntity, removeEntity, `batchAddE |