Google Maps Grounding MCP
v1.0.0Google Maps Grounding Lite MCP for location search, weather, and routes via mcporter.
⭐ 6· 3.9k·12 current·12 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Google Maps grounding via mcporter) align with declared requirements: mcporter binary and GOOGLE_MAPS_API_KEY are exactly what this skill needs to call the Maps Grounding MCP. The primary credential is appropriate and no unrelated credentials or config paths are requested.
Instruction Scope
SKILL.md stays on-topic (how to enable the Maps API, add the API key, configure mcporter, and call the listed tools). Two operational points to note: (1) it suggests using `gcloud beta services enable ...` but gcloud is not listed in required binaries; (2) the example uses `mcporter config add ... --system`, which writes system-level configuration (may require elevated privileges and affects global mcporter config). Neither is inconsistent with the purpose, but both are operational details the user should be aware of.
Install Mechanism
The install spec installs the mcporter npm package (public registry) which is a typical mechanism for a CLI. This is a moderate-risk, expected install method; there are no downloads from arbitrary URLs or extract steps. The package and publisher should be validated before installation, but the mechanism itself is appropriate for the stated function.
Credentials
Only GOOGLE_MAPS_API_KEY is required and declared as the primary credential — this is proportionate to a Maps-based skill. No extra secrets or unrelated environment variables are requested.
Persistence & Privilege
always:false and normal autonomous invocation are fine. The only persistence-related concern is the SKILL.md recommendation to run `mcporter config add ... --system` which creates system/global mcporter configuration; this may require higher privileges and will store the API key in a config header. The skill does not request persistent platform-level privileges or alter other skills.
Assessment
This skill appears coherent, but take these precautions before installing: 1) Verify the mcporter npm package and its maintainer (installing npm packages runs third-party code). 2) Prefer installing mcporter per-user rather than system-wide; avoid `--system` unless you intend global config and understand permissions. 3) Restrict your GOOGLE_MAPS_API_KEY in Cloud Console (enable only the required APIs, set HTTP referrer or IP restrictions, and set application restrictions) to limit blast radius if the key is leaked. 4) Ensure you have node/npm available and that installing mcporter fits your environment policy. 5) Be aware the config step stores the API key in mcporter headers—check where config files are written and who can read them. 6) Monitor usage/billing and quota limits for the Maps preview APIs. If you want lower risk, ask the skill author for a per-user config example (no --system) and the mcporter package repo URL to review source before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97c4455z0je3nn32n0fp2pppd80025f
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🗺️ Clawdis
Binsmcporter
EnvGOOGLE_MAPS_API_KEY
Primary envGOOGLE_MAPS_API_KEY
Install
Install mcporter (npm)
Bins: mcporter
npm i -g mcporter