Maintainer of this skill?
by gaopengbin
Protocol-agnostic CesiumJS AI control runtime for MCP, WebMCP, function calling, and browser agents.
# Add to your Claude Code skills
git clone https://github.com/gaopengbin/cesium-mcpGuides for using ai agents skills like cesium-mcp.
Last scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server: Middleware bypass via repeated slashes in serveStatic",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "basic-ftp: basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",
"severity": "high"
},
{
"type": "npm-audit",
"message": "dompurify: DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild enables any website to send any requests to the development server and read the response",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express-rate-limit: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono missing validation of cookie name on write path in setCookie()",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "miniflare: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
"severity": "high"
},
{
"type": "npm-audit",
"message": "undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vitepress: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "wrangler: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-05-30T16:38:39.258Z",
"npmAuditRan": true,
"pipAuditRan": true
}See how cesium-mcp compares with popular alternatives.
cesium-mcp is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by gaopengbin. Protocol-agnostic CesiumJS AI control runtime for MCP, WebMCP, function calling, and browser agents. It has 140 GitHub stars.
cesium-mcp failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/gaopengbin/cesium-mcp" and add it to your Claude Code skills directory (see the Installation section above).
cesium-mcp is primarily written in JavaScript. It is open-source under gaopengbin on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh cesium-mcp against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
[!IMPORTANT]
📣 作者正在求职 · 北京
AI 应用开发 · Agent 应用开发 · AI 产品全栈
我是高鹏彬，有约 6 年软件开发经验。如果你们团队正在招人，欢迎联系，也感谢帮忙内推或转发！
📄 查看简历 PDF · ✉️ 联系我
[!TIP] 📣 Built with Cesium MCP? / 谁在使用 Cesium MCP？
Share your project, screenshots, or feedback—work in progress is welcome! / 欢迎分享项目、截图和使用反馈，开发中的作品也欢迎！
Install the hosted map plugin from this repository's Cesium Map Community source:
codex plugin marketplace add gaopengbin/cesium-mcp --ref main
codex plugin add cesium-map@cesium-community
Restart Codex and ask “Open a map of Manhattan.” Uses native host chat, with no local map server or separate model API key. Requires a compatible MCP Apps host. This is a community beta, separate from the OpenAI public directory.
Installation and compatibility · ZIP download · Product website
Select a scene in the map, click an object and choose Ask in Codex to continue with its map context. The host controls chat placement and map expansion.
Actual running screenshot: the development preview is connected to the hosted HTTPS MCP service. The native conversation UI is provided by Codex; it is not pictured here.
| San Francisco · City activity | New York · 3D city blocks | Los Angeles · Hotspots |
|---|---|---|
 |
 |
 |
| Inspect feature values and change classification colors | Select buildings, edit extrusion heights and read back properties | Combine a heatmap, markers and connecting routes |
These covers come from rendered map scenes. Buildings, activity values and heatmap points are demonstration data, not surveyed heights or official statistics. Basemap imagery: Esri and its imagery contributors.
https://github.com/user-attachments/assets/8a40565a-fcdd-47bf-ae67-bc870611c908
| Module | Role | Status | Links |
|---|---|---|---|
| cesium-mcp-contracts | Transport-neutral names, descriptions, and JSON Schemas for browser tools | New shared layer | source |
| cesium-mcp-bridge | Protocol- and transport-free Cesium command executor (60+ commands) | Mainline, actively iterated |  · source |
| cesium-mcp-webmcp | One-package Viewer integration plus the native document.modelContext adapter |
Browser integration | source |
| examples/webmcp-integration | Focused npm + Vite integration without a chat UI or MCP server | Developer example | example |
| examples/browser-agent | Browser-only AI agent with automatic WebMCP exposure | Recommended | example · live demo |
| cesium-mcp-runtime | MCP server (stdio + HTTP) | Stable MCP SDK v2 |  · source |
| cesium-mcp-dev | CesiumJS API knowledge base for coding assistants | Maintained |  · source |
Which one? Personal project or quick try → browser-agent. Let a compatible browser agent discover page-local Cesium tools → WebMCP. Existing web app embedding an AI assistant → bridge + your own function calling. Calling from Claude Desktop / Cursor / Dify → MCP runtime.
flowchart LR
subgraph clients ["AI Drivers (pick one)"]
BA["Browser Agent\n(in the same page)"]
WM["WebMCP Agent\n(browser-provided)"]
FC["Your web app\nfunction calling"]
MCP["Claude / Cursor / Dify\nvia MCP runtime"]
end
CONTRACTS["cesium-mcp-contracts\ntool definitions"]
WEBMCP["cesium-mcp-webmcp\nnative adapter"]
subgraph core ["cesium-mcp-bridge (browser)"]
B["60+ tools\nprotocol-agnostic dispatcher"]
C["CesiumJS Viewer"]
end
CONTRACTS -.-> BA
CONTRACTS -.-> WEBMCP
BA -- "in-page call" --> B
WM -- "document.modelContext" --> WEBMCP
WEBMCP --> B
FC -- "in-page call" --> B
MCP -- "WebSocket / JSON-RPC" --> B
B --> C
style clients fill:#1e293b,stroke:#528bff,color:#e2e8f0
style core fill:#1e293b,stroke:#12B76A,color:#e2e8f0
The bridge remains the execution core, while contracts and protocol adapters stay separate. Pick whichever driver matches your scenario — they all reach the same Cesium command layer. On WebMCP-capable browsers, cesium-mcp-webmcp can expose 61 browser-safe commands in 12 selectable toolsets through document.modelContext without adding an MCP transport or backend server.
CesiumGS's newer AI work is split between cesiumjs-ai-starter-app, a deployable application template, and cesiumjs-skills, development-time guidance for coding agents. The earlier cesium-ai-integrations repository contains the first-generation experiments and community contributions that helped explore this space.
cesium-mcp is an independent runtime and integration toolkit, not a continuation of the earlier WebSocket-only reference architecture. Its reusable Bridge and shared contracts work unchanged across browser-only function calling, native WebMCP, standard MCP over stdio/HTTP, and embedded desktop shells. A local WebSocket bridge is used only when an external MCP host needs to reach a live browser Viewer; it is not required for the hosted demo or page-local integrations.
The project author was an early contributor to CesiumGS/cesium-ai-integrations, contributing the Imagery server, Terrain server, and unified MCP Gateway.