Skip to content

gmaps.dev

by gmaps.dev · remote · no sign-in to list tools · v1.0.0 · published by dev.gmaps

Find businesses by what they are and where they are, collect a whole city, and export the list.

Deletes · 4Changes · 5
CompareRegistry entry

18 tools: 4 can delete or cancel things, 5 change things and 9 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http gmaps https://api.gmaps.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnsearch_places

    The server marks "search_places" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":true}; The name "search_places" says "search": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

18 tools

Deletes or cancels 4Claude Code: deny
  • cancel_collectionStop a collection you no longer want.No findings

    Why it is in this group

    • The name "cancel_collection" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Stop a collection you no longer want. One that has not started yet stops at once and costs nothing. One already running keeps the places that have arrived and the credits they cost; the search in flight finishes, and nothing new starts. A collection that has already ended cannot be cancelled. Needs an API key. Costs no credits.

    Annotations the server declares

    • title: Cancel a collection
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
  • delete_webhookStop sending to an endpoint and forget it, along with the record of what we sent there.No findings

    Why it is in this group

    • The name "delete_webhook" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Stop sending to an endpoint and forget it, along with the record of what we sent there. To pause one instead, set enabled to false. That keeps the secret, so you do not have to change your code to turn it back on. Needs an API key and a paid plan. Costs no credits.

    Annotations the server declares

    • title: Delete a webhook endpoint
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
  • test_webhookSend a "ping" to one of your endpoints now, so you can check your code reads it and the signature checks out before a real collection depends on it.No findings

    Why it is in this group

    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Send a "ping" to one of your endpoints now, so you can check your code reads it and the signature checks out before a real collection depends on it. Answers straight away with the delivery; read the deliveries list a moment later to see what your server said. Needs an API key and a paid plan. Costs no credits.

    Annotations the server declares

    • title: Send a test event
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
  • update_webhookChange which events an endpoint receives, rename it, or switch it off and on.No findings

    Why it is in this group

    • The name "update_webhook" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Change which events an endpoint receives, rename it, or switch it off and on. This is how an endpoint comes back after we stopped sending to it: fix your server, then set enabled to true. The failure count starts again from zero. Whatever you leave out stays as it was. Needs an API key and a paid plan. Costs no credits.

    Annotations the server declares

    • title: Change a webhook endpoint
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
Changes things 5Claude Code: ask
  • create_collectionSearch a whole area, square by square, and collect up to maxPlaces of the places in it.No findings

    Why it is in this group

    • The name "create_collection" says "create": a word for a change.
    Description, as the server wrote it
    Search a whole area, square by square, and collect up to maxPlaces of the places in it. Answers straight away with the collection, then works through the area in the background. Read the collection again to see how far it has got. Starting one costs nothing: each new place costs one credit as it arrives, and saved places cost nothing. Needs an API key.

    Annotations the server declares

    • title: Start a collection
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • create_exportGet a link to a collection's places as one file: csv, json or xlsx.No findings

    Why it is in this group

    • The name "create_export" says "create": a word for a change.
    Description, as the server wrote it
    Get a link to a collection's places as one file: csv, json or xlsx. The file has the places the collection holds now, even if it is still running. The link opens without an API key for 24 hours, so share it only with people who should see the file. Needs an API key. Costs no credits.

    Annotations the server declares

    • title: Export a collection
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
  • create_webhookTell us where to POST when a collection ends, instead of asking us every few seconds whether it is done.No findings

    Why it is in this group

    • The name "create_webhook" says "create": a word for a change.
    Description, as the server wrote it
    Tell us where to POST when a collection ends, instead of asking us every few seconds whether it is done. The answer shows the signing secret once and never again. Store it, then check every request against it. The body carries counts and a link to the places, never the places themselves. Needs an API key and a paid plan. Costs no credits.

    Annotations the server declares

    • title: Add a webhook endpoint
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • quote_collectionSee what collecting an area would cost before you start it: how much of it we have searched recently, how many places we have saved there (those cost nothing), how many searches ar…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    See what collecting an area would cost before you start it: how much of it we have searched recently, how many places we have saved there (those cost nothing), how many searches are left to run, and the most it can cost in credits. Needs an API key. Costs no credits and starts nothing.

    Annotations the server declares

    • title: Quote a collection
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • search_placesFind places by what they are and where they are, such as bakeries in Curitiba.1 finding

    Why it is in this group

    • The name "search_places" says "search": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "search_places" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":true}; The name "search_places" says "search": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Find places by what they are and where they are, such as bakeries in Curitiba. Places we saved from earlier searches come back at once, for free. If they do not fill `limit`, a collection starts to find the rest and the answer includes it: each new place costs one credit as it arrives, and it stops at `limit`, so a search never costs more than `limit` credits. Search again later, or read the collection, to get the new ones; with `wait`, the answer waits up to 60 seconds for them. Needs an API key.

    Annotations the server declares

    • title: Search for places
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
Only reads 9Claude Code: allow
  • get_attributionsList the projects credited by gmaps.dev, with their licenses and notices.No findings

    Why it is in this group

    • The name "get_attributions" says "get": a word for reading.
    Description, as the server wrote it
    List the projects credited by gmaps.dev, with their licenses and notices. No API key needed. Costs no credits.

    Annotations the server declares

    • title: List the open-source projects we build on
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_collectionSee where a collection has got to: how much of the area is searched, how many places have arrived, and what it has cost so far.No findings

    Why it is in this group

    • The name "get_collection" says "get": a word for reading.
    Description, as the server wrote it
    See where a collection has got to: how much of the area is searched, how many places have arrived, and what it has cost so far. Read it again whenever you want an update. Needs an API key. Costs no credits.

    Annotations the server declares

    • title: Read a collection
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_coverageSee how much of an area we have already searched for a term, when we last searched it, and how many places we have saved there.No findings

    Why it is in this group

    • The name "get_coverage" says "get": a word for reading.
    Description, as the server wrote it
    See how much of an area we have already searched for a term, when we last searched it, and how many places we have saved there. Use it to decide whether to collect again or just read the saved places. Needs an API key. Costs no credits and starts nothing.

    Annotations the server declares

    • title: Check an area's coverage
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_exportRead an export you made, with its download link, while the link still works.No findings

    Why it is in this group

    • The name "get_export" says "get": a word for reading.
    Description, as the server wrote it
    Read an export you made, with its download link, while the link still works. After 24 hours, or once the collection's places are deleted, it answers 404: make a new export from the collection. Needs an API key. Costs no credits.

    Annotations the server declares

    • title: Read an export
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_placeRead one saved place, by our id, Google's cid, Google's place ID, or a Google Maps link to it.No findings

    Why it is in this group

    • The name "get_place" says "get": a word for reading.
    Description, as the server wrote it
    Read one saved place, by our id, Google's cid, Google's place ID, or a Google Maps link to it. It never searches: a place we have not saved answers 404, and searching its area with search_places brings it in. Needs an API key. Costs no credits.

    Annotations the server declares

    • title: Look up a place
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_usageSee this month's credits: what your plan includes, what you have used, what is left today and this month, and the same totals for each API key.No findings

    Why it is in this group

    • The name "get_usage" says "get": a word for reading.
    Description, as the server wrote it
    See this month's credits: what your plan includes, what you have used, what is left today and this month, and the same totals for each API key. Needs an API key. Costs no credits.

    Annotations the server declares

    • title: Get credit usage
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • list_collectionsYour collections, newest first, with the total so you know how many more there are.No findings

    Why it is in this group

    • The name "list_collections" says "list": a word for reading.
    Description, as the server wrote it
    Your collections, newest first, with the total so you know how many more there are. Filter by status to find the ones still running. Needs an API key. Costs no credits.

    Annotations the server declares

    • title: List your collections
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • list_webhook_deliveriesWhat we sent to one endpoint, newest first: which event, whether it arrived, how many tries it took, and what your server answered.No findings

    Why it is in this group

    • The name "list_webhook_deliveries" says "list": a word for reading.
    Description, as the server wrote it
    What we sent to one endpoint, newest first: which event, whether it arrived, how many tries it took, and what your server answered. This is where to look when an event never showed up. Kept for 7 days. Needs an API key and a paid plan. Costs no credits.

    Annotations the server declares

    • title: List an endpoint's deliveries
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • list_webhooksEvery endpoint you have added, newest first, with whether it is still receiving events and why we stopped if it is not.No findings

    Why it is in this group

    • The name "list_webhooks" says "list": a word for reading.
    Description, as the server wrote it
    Every endpoint you have added, newest first, with whether it is still receiving events and why we stopped if it is not. Secrets are not shown again after the endpoint is created. Needs an API key and a paid plan. Costs no credits.

    Annotations the server declares

    • title: List your webhook endpoints
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http gmaps https://api.gmaps.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__gmaps__get_attributions",
      "mcp__gmaps__get_place",
      "mcp__gmaps__list_collections",
      "mcp__gmaps__get_collection",
      "mcp__gmaps__get_export",
      "mcp__gmaps__get_coverage",
      "mcp__gmaps__get_usage",
      "mcp__gmaps__list_webhooks",
      "mcp__gmaps__list_webhook_deliveries"
    ],
    "ask": [
      "mcp__gmaps__search_places",
      "mcp__gmaps__create_collection",
      "mcp__gmaps__quote_collection",
      "mcp__gmaps__create_export",
      "mcp__gmaps__create_webhook"
    ],
    "deny": [
      "mcp__gmaps__cancel_collection",
      "mcp__gmaps__update_webhook",
      "mcp__gmaps__delete_webhook",
      "mcp__gmaps__test_webhook"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as gmaps. Review it before you use it.