by gaopengbin
Protocol-agnostic CesiumJS AI control runtime for MCP, WebMCP, function calling, and browser agents.
# Add to your Claude Code skills
git clone https://github.com/gaopengbin/cesium-mcpLast scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server: Middleware bypass via repeated slashes in serveStatic",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "basic-ftp: basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",
"severity": "high"
},
{
"type": "npm-audit",
"message": "dompurify: DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express-rate-limit: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono missing validation of cookie name on write path in setCookie()",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "miniflare: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
"severity": "high"
},
{
"type": "npm-audit",
"message": "undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vitepress: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "wrangler: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-05-30T16:38:39.258Z",
"npmAuditRan": true,
"pipAuditRan": true
}See how cesium-mcp compares with popular alternatives.
cesium-mcp is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by gaopengbin. Protocol-agnostic CesiumJS AI control runtime for MCP, WebMCP, function calling, and browser agents. It has 137 GitHub stars.
cesium-mcp failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/gaopengbin/cesium-mcp" and add it to your Claude Code skills directory (see the Installation section above).
cesium-mcp is primarily written in JavaScript. It is open-source under gaopengbin on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh cesium-mcp against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
[!IMPORTANT]
📣 作者正在求职 · 北京
AI 应用开发 · Agent 应用开发 · AI 产品全栈
我是高鹏彬,有约 6 年软件开发经验。如果你们团队正在招人,欢迎联系,也感谢帮忙内推或转发!
📄 查看简历 PDF · ✉️ 联系我
[!TIP] 📣 Built with Cesium MCP? / 谁在使用 Cesium MCP?
Share your project, screenshots, or feedback—work in progress is welcome! / 欢迎分享项目、截图和使用反馈,开发中的作品也欢迎!
https://github.com/user-attachments/assets/8a40565a-fcdd-47bf-ae67-bc870611c908
| Module | Role | Status | Links |
|---|---|---|---|
| cesium-mcp-contracts | Transport-neutral names, descriptions, and JSON Schemas for browser tools | New shared layer | source |
| cesium-mcp-bridge | Protocol- and transport-free Cesium command executor (60+ commands) | Mainline, actively iterated | |
| cesium-mcp-webmcp | One-package Viewer integration plus the native document.modelContext adapter |
Browser integration | source |
| examples/webmcp-integration | Focused npm + Vite integration without a chat UI or MCP server | Developer example | example |
| examples/browser-agent | Browser-only AI agent with automatic WebMCP exposure | Recommended | example · live demo |
| cesium-mcp-runtime | MCP server (stdio + HTTP) | Stable MCP SDK v2 | |
| cesium-mcp-dev | CesiumJS API knowledge base for coding assistants | Maintained |
Which one? Personal project or quick try → browser-agent. Let a compatible browser agent discover page-local Cesium tools → WebMCP. Existing web app embedding an AI assistant → bridge + your own function calling. Calling from Claude Desktop / Cursor / Dify → MCP runtime.
flowchart LR
subgraph clients ["AI Drivers (pick one)"]
BA["Browser Agent\n(in the same page)"]
WM["WebMCP Agent\n(browser-provided)"]
FC["Your web app\nfunction calling"]
MCP["Claude / Cursor / Dify\nvia MCP runtime"]
end
CONTRACTS["cesium-mcp-contracts\ntool definitions"]
WEBMCP["cesium-mcp-webmcp\nnative adapter"]
subgraph core ["cesium-mcp-bridge (browser)"]
B["60+ tools\nprotocol-agnostic dispatcher"]
C["CesiumJS Viewer"]
end
CONTRACTS -.-> BA
CONTRACTS -.-> WEBMCP
BA -- "in-page call" --> B
WM -- "document.modelContext" --> WEBMCP
WEBMCP --> B
FC -- "in-page call" --> B
MCP -- "WebSocket / JSON-RPC" --> B
B --> C
style clients fill:#1e293b,stroke:#528bff,color:#e2e8f0
style core fill:#1e293b,stroke:#12B76A,color:#e2e8f0
The bridge remains the execution core, while contracts and protocol adapters stay separate. Pick whichever driver matches your scenario — they all reach the same Cesium command layer. On WebMCP-capable browsers, cesium-mcp-webmcp can expose 61 browser-safe commands in 12 selectable toolsets through document.modelContext without adding an MCP transport or backend server.
CesiumGS's newer AI work is split between cesiumjs-ai-starter-app, a deployable application template, and cesiumjs-skills, development-time guidance for coding agents. The earlier cesium-ai-integrations repository contains the first-generation experiments and community contributions that helped explore this space.
cesium-mcp is an independent runtime and integration toolkit, not a continuation of the earlier WebSocket-only reference architecture. Its reusable Bridge and shared contracts work unchanged across browser-only function calling, native WebMCP, standard MCP over stdio/HTTP, and embedded desktop shells. A local WebSocket bridge is used only when an external MCP host needs to reach a live browser Viewer; it is not required for the hosted demo or page-local integrations.
The project author was an early contributor to CesiumGS/cesium-ai-integrations, contributing the Imagery server, Terrain server, and unified MCP Gateway. Those experiments informed this project's multi-protocol architecture, while the implementation, release lifecycle, and roadmap remain independent.
Open the live demo and ask—the hosted model is ready without a browser API key:
"Fly to the Eiffel Tower and drop a red marker"
Fork the examples/browser-agent folder to deploy your own.
The browser-agent example automatically registers all 61 browser-safe page tools when document.modelContext is available. Its built-in chat uses automatic toolset routing to keep each normal request at 20 tools or fewer, while still offering explicit core, single-toolset, and all-61 modes:
npm run build -w packages/cesium-mcp-bridge
npm run build -w packages/cesium-mcp-webmcp
npx serve . -l 4173
Open http://localhost:4173/examples/browser-agent/, click Start, then inspect or execute the tools in DevTools → Application → WebMCP. Enable #enable-webmcp-testing and #devtools-webmcp-support in chrome://flags for local testing.
Application developers install the adapter separately. End users only open the integrated website; they do not install npm packages or run an MCP server.
npm install cesium-mcp-webmcp
import { registerCesiumViewerWebMcp } from 'cesium-mcp-webmcp/viewer'
const registration = await registerCesiumViewerWebMcp(viewer, {
toolsets: 'all',
excludeTools: ['geocode'], // add your own browser geocoder to expose this tool
})
// Later, if the page is unmounted:
registration.unregister()
See the WebMCP adapter API for custom integrations. For a complete npm + Vite application, start from the WebMCP integration example.
npm install cesium-mcp-bridge
import { CesiumBridge } from 'cesium-mcp-bridge';
const bridge = new CesiumBridge(viewer);
// Then: send the bridge's tool schema to any LLM that supports funct