jvkenny/arcgis-online-mcp

**Give Claude (or any MCP agent) your ArcGIS Online or ArcGIS Enterprise portal.**
Search content, read web maps, inspect layers, query and aggregate features, geocode, and, if you
turn it on, edit features, publish layers, build web maps, and manage sharing.
- **Zero dependencies.** Pure Python standard library. Nothing to pip install, nothing to audit but this repo.
- **Read-only by default.** Write tools don't exist until you set ARCGIS_ALLOW_WRITES=true.
- **Works with your login.** OAuth (including SAML/enterprise logins), API keys, built-in accounts, or anonymous.
- **ArcGIS Online and Enterprise.** Point it at any portal URL.
- **Tested against the live service** on Linux, macOS, and Windows, plus a weekly run to catch REST API drift.
---
Install
You need **Python 3.9+** (python3 --version). Pick your client:
Claude Desktop (Chat and Cowork): one click
1. Download **arcgis-online-mcp.mcpb**.
2. Double-click it (or **Settings → Extensions → Install Extension…**).
3. Fill in the settings. Leave everything blank to try it on public data first.
Claude Code: one command
Add credentials with -e, e.g. claude mcp add arcgis -e ARCGIS_CLIENT_ID=abc123 -- uvx ….
Add -s user to make it available in every project.
No uv? Clone instead:
The repo's .mcp.json registers the server automatically. Approve it when Claude Code asks.
Any other MCP client (Codex, Cursor, VS Code, Windsurf, Goose…)
It's a standard stdio server. The command is either
uvx --from git+https://github.com/jvkenny/arcgis-online-mcp arcgis-online-mcp or
python3 /path/to/arcgis-online-mcp/server.py.
Claude Desktop JSON config (instead of the .mcpb)
~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or
%APPDATA%\Claude\claude_desktop_config.json (Windows):
OpenAI Codex (~/.codex/config.toml)
Cursor (~/.cursor/mcp.json) / VS Code (.vscode/mcp.json)
VS Code uses "servers" instead of "mcpServers" and wants "type": "stdio".
Check your setup from a terminal at any time:
---
Sign in
Pick one. If several are set, the first match in this table wins.
| Method | Env vars | Best for | Notes |
|---|---|---|---|
| Existing token | ARCGIS_TOKEN | Scripts that already have one | Expires; no refresh |
| **API key** | ARCGIS_API_KEY | Read-only automation, shared bots | Scoped by the key's privileges; can't own content |
| Built-in account | ARCGIS_USERNAME + ARCGIS_PASSWORD | Personal built-in ArcGIS logins | **Doesn't work with SAML/SSO** |
| **OAuth (recommended for orgs)** | ARCGIS_CLIENT_ID | People in an org, including SAML/SSO | Browser sign-in; tokens refresh automatically |
| Anonymous | *(nothing)* | Public data, Living Atlas, trying it out | Search, query, and geocode public content |
Set ARCGIS_PORTAL_URL for ArcGIS Enterprise (e.g. https://gis.example.gov/portal). It defaults to https://www.arcgis.com.
Setting up OAuth (once per org, about 2 minutes)
1. In ArcGIS Online: **Content → New item → Developer credentials → OAuth 2.0 credentials**.
2. Add the redirect URL **http://127.0.0.1:7071/callback**.
3. Save, then copy the **Client ID**. It isn't a secret, so you can share it with your whole team.
4. Set ARCGIS_CLIENT_ID to that value. In chat, ask Claude to **"sign in to ArcGIS"**. Your browser
opens the normal ArcGIS login page (SSO included), and you're done.
Tokens are cached in ~/.config/arcgis-online-mcp/ (file mode 600) and refresh for two weeks.
Ask Claude to "sign out of ArcGIS" to delete them. Use ARCGIS_REDIRECT_URI to change the port.
> **Keep secrets out of config files.** Use your client's secret storage (the .mcpb stores the API
> key and password in the OS keychain), or launch with a secrets manager, e.g.
> op run --env-file=.env -- claude.