Mapbox MCP Runtime Patterns

Integration patterns for Mapbox MCP Server in AI applications and agent frameworks. Covers runtime integration with pydantic-ai, mastra, LangChain, and custo...

This package appears to contain legitimate Mapbox MCP integration patterns and runnable examples, but there are a few mismatches and operational risks to consider before using it: - Credentials: The manifest lists no required env vars, but examples and SKILL.md require MAPBOX_ACCESS_TOKEN (and many examples also reference OPENAI_API_KEY and HF_TOKEN). Do not run examples until you confirm which tokens are needed and provide them securely (use least-privilege tokens, rotate them, and avoid pasting long-lived secrets into shared shells). - Running code from npm/npx: Self-hosting instructions use `npm install` / `npx @mapbox/mcp-server` and example code spawns child processes. `npx` will fetch and execute code from the npm registry; only run this in trusted environments and consider pinning package versions or using verified releases. - Agent system prompts: Examples include system_prompt and prompt templates that control agent behavior. This is normal for agent integrations, but review them to ensure they don't grant the agent overly broad or unsafe instructions (especially if you plan to allow autonomous agent runs). - Manifest/document mismatch: Ask the publisher to update registry metadata to declare required environment variables (MAPBOX_ACCESS_TOKEN and any LLM tokens used) so the skill's requirements are explicit. - Operational safety: If you will self-host the MCP server, verify the `@mapbox/mcp-server` package integrity (use package-lock, pin versions, run in isolated environments / containers). If you only need hosted MCP, prefer using the documented hosted endpoint (https://mcp.mapbox.com/mcp) with a scoped token. If you want, I can: (1) list exact files/lines that reference each token or npx usage, (2) suggest a minimal, safe checklist for running the examples in an isolated environment, or (3) draft questions to ask the skill author to clarify the missing metadata.

Type: OpenClaw Skill Name: mapbox-mcp-runtime-patterns Version: 1.0.0 The skill bundle provides legitimate integration patterns and code examples for the Mapbox MCP Server across various AI frameworks, including Pydantic AI, CrewAI, LangChain, and Mastra. The code correctly implements tool calling via the official Mapbox hosted endpoints (mcp.mapbox.com) and provides standard patterns for local execution using npx. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found; the instructions and code logic are entirely consistent with the stated purpose of providing geospatial capabilities to AI agents.