GIS Cloud
by GIS Cloud
Read, create, edit and delete maps, layers, features and field-collection forms in a GIS Cloud account from an AI agent. Anthropic lists 55 tools — 24 read, 23 write, 8 delete. One OAuth scope, named mcp, which narrows nothing.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect GIS Cloud via MCP
https://mcp.giscloud.com/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
GIS Cloud Tools & Capabilities (55)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- The one OAuth scope is a wildcard. Both the server's RFC 9728 resource descriptor and its authorization server metadata advertise
scopes_supported: ["mcp"]and nothing else. A scope naming no object and no verb cannot exclude anything: granting it grants whatever the server implements, now and later. The read-only choice GIS Cloud offers at consent is a real control, but it is enforced by GIS Cloud's own permission model, not by the OAuth grant. query_writemakes the verb census incomplete. SQL forwarded to PostGIS reaches operations no tool name describes. Do not read "8 delete tools" as a bound on destructive reach.- The vendor enumerates families, not tool names. Every name matched semantically, none literally, so a rename between the directory and the server would be invisible to this diff.
- Truncate, reports and select appear in the vendor's own description with no tool name behind them. Truncate is destructive, which is exactly where an omission matters most.
- We could not read tool schemas or safety annotations. The endpoint returned 401 to an anonymous request, so no parameter-level detail is published here — including whether
update_mapcan reach a sharing property. - The two-step confirmation is documented, not observed. Verifying it would mean invoking a destructive tool. We did not.
- This connector ships an MCP app widget. Anthropic's directory sets
has_mcp_app: truefor GIS Cloud. A widget runs in the user's browser and acts on the user's click, so no tool audit reaches it. We did not fetch or test it, and its behaviour is unknown. - The RFC 9728 path is a catch-all. Every suffix under
/.well-known/oauth-protected-resource/returned a byte-identical document, including a deliberately bogus control path. The document names the correct resource, so the scope finding stands, but the path is not path-specific. refresh_access_tokenis classified as a write here because it mutates session state. It does not touch geospatial data, so treat the 23-write figure as including one session-management tool.- Personal data is inseparable from the map data. Collector identity and GNSS attributes sit in ordinary layer columns, so a read-only connection still exposes them to any feature query.
Frequently asked questions
Yes. Eight of the 55 tools carry a delete verb, including delete_map, delete_layer, delete_feature and delete_table. GIS Cloud documents a two-step confirmation for destructive actions, where the first call returns a plain-language summary such as the layer name and its feature count, and nothing changes until you approve it. We could not verify that gate on the wire.
No tool in the listing does. GIS Cloud makes a map public by granting read permission to the anonymous user, which is the permissions endpoint on the REST API. No tool among the 55 names a permission, share, public or anonymous operation, so the publish boundary falls outside the connector's tool surface. That is a real boundary, not an inferred one.
Yes, wherever a form was built with them. GIS Cloud documents hidden form items, invisible to the collector, that automatically record the collector's Username, Latitude, Longitude, Altitude, Speed, GPS Heading, Accuracy, Device ID and time on every submission. These land in ordinary layer columns, which list_features and query_read return like any other attribute.
Anthropic's directory lists 55 on 2026-08-23. Our split of those names is 24 read, 23 write and 8 delete. The count understates the reachable surface, because query_write forwards SQL to the underlying PostGIS database, and the operations SQL reaches are not bounded by any tool name in the list.
Exactly one, named mcp. The server's RFC 9728 descriptor and its authorization server metadata both advertise that single scope. It names no object and no verb, so it is a wildcard that cannot exclude anything. GIS Cloud's own documentation describes a read-only or read-and-write choice on the consent screen, which is a separate control from the OAuth scope.
Yes. bulk_update_features updates many features in one call, update_feature changes one, and query_write forwards SQL that can rewrite rows directly. Field-collected records are often irreplaceable, since re-collection means sending a crew back. GIS Cloud flags bulk updates as destructive and gates them behind its confirmation step.
It publishes capability families, not tool names. GIS Cloud's AI Connectors article groups the surface into maps, layers, features, tables, forms, queries, files, bookmarks and account. Every family maps onto directory tool names, but the article also names truncate, select and reports, and no tool in the listing carries those verbs.
GIS Cloud states the assistant inherits exactly your permissions and that read is the baseline, with writing and deleting gated at authorisation. Choosing read-only at the consent screen is the strongest control available here, because the single mcp OAuth scope does not separate reading from writing on its own.
Sources
- GIS Cloud AI Connectors (MCP) article (retrieved 2026-08-23). The nominated documentation URL, and the winner of a four-route probe:
llms.txt,llms-full.txtand both.mdsuffixes all returned 404 on the same host. · retrieved 2026-08-23 - GIS Cloud form items reference, hidden Device/user and Location items (retrieved 2026-08-23) · retrieved 2026-08-23
- GIS Cloud Share and Publish (retrieved 2026-08-23) · retrieved 2026-08-23
- GIS Cloud sharing a map in Map Editor, layer permissions (retrieved 2026-08-23) · retrieved 2026-08-23
- GIS Cloud Mobile Data Collection user management (retrieved 2026-08-23) · retrieved 2026-08-23
- GIS Cloud REST API reference, permissions model and Truncate table (retrieved 2026-08-23).
developers.giscloud.com/rest, linked from the GIS Cloud Developers Center, is a 301 to this URL. · retrieved 2026-08-23 - Live OAuth posture check: anonymous
initializetohttps://mcp.giscloud.com/mcpreturned HTTP 401 withwww-authenticate: Bearer resource_metadata="https://mcp.giscloud.com/.well-known/oauth-protected-resource"; RFC 9728 descriptor and authorization server metadata athttps://mcp.giscloud.com/.well-known/oauth-authorization-serverboth read (2026-08-23) · retrieved 2026-08-23 manual.giscloud.com/robots.txt— permits the documentation path; noContent-Signaldirective present (retrieved 2026-08-23) · retrieved 2026-08-23- Anthropic Connectors Directory entry — , read from our directory snapshot dated 2026-08-23 · retrieved 2026-08-23
- GIS Cloud support — <mailto:support@giscloud.com> · Privacy
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Analytics
- Developer
- GIS Cloud
- Tools
- 55
- Domain
- mcp.giscloud.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.