ExplorationMaps

io.github.coltongriffithPublished by GitHub account coltongriffithv1.1.1Updated Oct 24, 2026

Mining claim search and professional mineral exploration maps from public registries.

VerifiedStreamable HTTPWeb executableLocation & LifestyleWeb Search & Scraping

Overview

AI-generated overview

Remote MCP server for searching public mineral-claim registries and generating branded, shareable mineral exploration maps.

What you can do
Search public mineral-claim registries by holder, exact claim number, claim name or geographic bounding box, with claim-name search limited to British Columbia and US BLM jurisdictions; results include claim number, name, holder, status, expiry, area and centroid. Create a branded mineral exploration map from registry claims and get back a shareable URL, supplying search terms, location or exact claim numbers. Look up supported map types, registry jurisdictions, overlays, search modes and styles to check whether a mapping request can be fulfilled.
When to use it
Useful when you need to look up who holds a mineral claim or where claims sit, or when you want a quick investor-ready map of a project's claims without opening the web app. Also handy for checking whether a given jurisdiction or map style is supported before requesting a map.
Requirements
A remote streamable HTTP endpoint at explorationmaps.com; no authentication, environment variables or headers are declared. Network access to the service is required.
Before you install
Creating a map produces a shareable public URL, so anything passed in may become publicly viewable. The server asks for published facts and branding and warns against inventing owner details; verify claim data against official registries, since US BLM boundaries are generalized representations, not legal surveys.

Installation

In SourceWeft

  1. Open ExplorationMaps in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.coltongriffith%2Fexplorationmaps/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "explorationmaps": {
      "type": "http",
      "url": "https://www.explorationmaps.com/mcp/server"
    }
  }
}

README

Exploration Maps

Browser-based map builder for mineral exploration: search provincial claim registries, import drill/geology data, style investor-ready maps, and export them as PNG/SVG/PDF. Live at explorationmaps.com.

Stack

  • Frontend: React 18 + Vite 5 single-page app (src/), Leaflet map engine
  • Backend: Supabase (auth, Postgres, RLS) + Vercel serverless functions (api/)
  • Static marketing content: generated blog + company pages under public/ (see scripts/generate-blog.js and scripts/pseo/)

Requirements

  • Node 20+ (Vite 5 requirement; dev/CI verified on Node 20/22)
  • npm (a package-lock.json is committed — use npm ci for reproducible installs)

Development

bash
npm ci                 # install exactly the locked dependenciescp .env.example .env   # fill in the VITE_ variables (see below)npm run dev            # Vite dev server on http://localhost:5173

The serverless functions under api/ run on Vercel. For full-stack local work use vercel dev; with plain npm run dev the claims search and analytics endpoints are absent (the UI degrades gracefully).

Commands

CommandWhat it does
npm run devVite dev server
npm run buildGenerates the blog, builds to dist/, copies the admin shell
npm testVitest run (CI mode)
npm run test:watchVitest watch mode
npm run pseo:fixturepSEO company-pages pipeline against fixture data

Environment variables

Documented in .env.example. Summary:

Public (VITE_ — compiled into the client bundle, never secret):

  • VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY — Supabase project + anon key (production-required; without them auth/cloud features disable themselves)
  • VITE_ADMIN_EMAIL — controls admin dashboard visibility only; real authorization is server-side (admin_users table + is_admin())

Server-only secrets (set in Vercel, never referenced by client code):

  • SUPABASE_SERVICE_ROLE_KEY — used by /api/track for analytics ingestion. Production-required once migration 20260710000004 is applied.
  • ADMIN_API_SECRET — optional; unlocks the claims-API diagnostic modes in production via the x-admin-secret header.
  • SUPABASE_URL / SUPABASE_ANON_KEY — optional server-side aliases; the VITE_-prefixed values are used as fallbacks by api/claims.js (Quebec) and api/track.js.
  • STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_MONTHLY_ID, STRIPE_PRICE_YEARLY_ID — Pro-subscription billing (see docs/billing.md). Until set, billing endpoints return 503 and all plan checks fail open — safe to deploy the code before configuring Stripe.

Architecture notes

Tenure Monitor (/tenure-monitor)

Watches a saved portfolio of B.C. mineral tenures: days remaining against each claim's good-to-date, email reminders, change detection, and one-click hand-off into the map editor. Read-only with respect to government transactions — it never touches MTO on a user's behalf.

  • Data: a mirror of DataBC's MTA_ACQUIRED_TENURE_SVW layer, loaded by scripts/tenure-sync/ from GitHub Actions (nightly full + twice-daily targeted). A partial or failed government response aborts without writing, so a bad day at the province cannot damage stored portfolios.
  • Reminders: scripts/tenure-alerts/, daily. De-duplication is a unique database constraint rather than application logic.
  • Deadlines are computed in America/Vancouver throughout (src/utils/tenureDates.js), never in the browser's timezone.
  • Developer docs: docs/tenure-monitor.md. User help: docs/tenure-monitor-help.md.

Serverless APIs (api/)

  • api/claims.js — multi-province claims search proxy (BC WFS, ArcGIS provinces ON/SK/MB/NL/YT, Quebec via a self-hosted Supabase table). Full pagination with honest meta: { totalKnown, returned, truncated, pagesFetched, provider }; rate-limited; CORS-restricted; sanitized errors.
  • api/bc-claims.js — BC-only WFS proxy (nearby-claims bbox + legacy search).
  • api/tenure-search.js — Tenure Monitor search over the Exploration Maps mirror of the B.C. mineral tenure registry (tenure number, pasted list, owner name, client number, map extent, geometry). Anonymous-safe, rate-limited, and every response states when the mirror was last synchronized. Reads with the ANON key under the public-read policy, never the service role.
  • api/track.js — all analytics ingestion (page views, live-presence pings, product/search events, landing clicks, leads). Enforces an event-name allowlist, payload size/depth limits, and session-id shape; derives geo from edge headers (never the body); resolves user identity from a verified Supabase access token; writes with the service role; rate-limits per IP. Without SUPABASE_SERVICE_ROLE_KEY it accepts-and-drops so analytics can never break the app. Identified automated browsers are dropped before any write. Admin reports also exclude admin accounts and browsers marked internal; opening the admin dashboard marks that browser, while ?em_internal=1 and ?em_internal=0 provide an explicit set/clear control.
  • api/stripe-checkout.js / api/stripe-portal.js / api/stripe-webhook.js — Pro-subscription billing (Stripe Checkout + customer portal + the signature-verified webhook that syncs public.user_plans). Grandfathered accounts (pre-launch) are never downgraded. See docs/billing.md.
  • api/_lib/ — shared helpers (pagination, request guards, esri→GeoJSON); the underscore path means Vercel does not expose them as endpoints.

Shared maps

Share links are /map/<id> where <id> is a client-generated crypto.randomUUID() (a 122-bit random token). Reads go through the get_shared_map(share_id) RPC — table-level SELECT is revoked, so shared_maps cannot be enumerated from the public client. Old links keep working: the id remains the lookup key.

Authentication & admin

Supabase auth (magic-link default, password fallback). Admin access is a row in public.admin_users checked by is_admin() inside SECURITY DEFINER reporting functions; all definer functions have a pinned search_path and explicit execute grants. To add an admin:

sql
insert into public.admin_users (user_id, note)select id, 'added by <you>' from auth.users where email = '<email>';

Local project storage

src/utils/projectStorage.js: projects + the working draft live in localStorage, deflate-compressed (gz1: prefix), with a schema version and deterministic migrations. Corrupted records are preserved under a .recovery key (never auto-deleted) and surfaced with manual export/discard helpers. Writes return structured results — the UI never claims success on a failed write. On sign-in, local projects migrate to the cloud with per-project status + retry (src/utils/cloudMigration.js).

Import formats

CSV (RFC 4180 via Papa Parse; auto-detected lat/long columns, plus azimuth, dip and length for drill traces), GeoJSON (validated), zipped shapefiles, loose .shp/.dbf/.prj/.shx sets (the .prj is honored — projected files are reprojected to WGS84 via proj4), KML, KMZ (bounded: entry count, uncompressed size, path traversal), and georeferenced images (.png/.jpg/.gif/.webp with a world file or typed-in edges, lat/long or UTM; resampled to 2048 px and stored in the project). Published tile ({z}/{x}/{y}) and WMS services can be added as layers under Reference Overlays.

Claim registries

Canada: BC (WFS), Ontario/Saskatchewan/Manitoba/Newfoundland & Labrador/Yukon (official ArcGIS services), Quebec (weekly-synced Supabase mirror). United States: federal BLM MLRS claims for 11 western states, behind VITE_ENABLE_US_CLAIMS — federal claims only, no state-managed tenure (Alaska state claims not included); boundaries are generalized BLM representations, not legal surveys. See docs/us-claims.md for the data source, field mapping, and the post-deploy verification checklist.

Database migrations

Timestamped, additive migrations live in supabase/migrations/. The legacy supabase-*.sql files in the repo root are the historical hand-run setup scripts — they document existing production state; new changes go in supabase/migrations/ only.

Apply order matters — two migrations are deploy-coupled:

StepActionWhen
120260710000001_shared_map_lookup_rpc.sqlAny time (additive)
220260710000003_live_pings_read_lockdown.sqlAny time (the deployed app never reads live_pings)
320260710000005_admin_authorization.sqlAny time (additive; seeds the current admin)
4Deploy the frontend (uses get_shared_map + /api/track) and set SUPABASE_SERVICE_ROLE_KEY in Vercel—
520260710000002_shared_maps_lockdown.sqlOnly after step 4
620260710000004_analytics_ingest_lockdown.sqlOnly after step 4

Each migration header includes rollback instructions. After applying, verify RLS as an anonymous client, a normal authenticated user, and the admin — verification queries are embedded in ...000005.

20260901000001_shared_rate_limit.sql is additive and can be applied any time, but until it is, the cross-instance rate limiter in api/_lib/guard.js has nothing to call and fails open (only the per-instance limiter applies). The send-welcome edge function must also be redeployed (supabase functions deploy send-welcome) to pick up its lead-row check.

Deployment & rollback

Pushes to main deploy via Vercel (npm run build → dist/, plus api/ functions). Rollback = redeploy the previous Vercel deployment (instant); if a deploy-coupled migration was applied after the deploy being rolled back, also run the rollback SQL from that migration's header.

Testing

Vitest + React Testing Library (tests/, config in vitest.config.js). Coverage focuses on regression protection: save/autosave race conditions, claims request ordering/cancellation, provider pagination, shapefile projection + CSV/GeoJSON parsing, storage failure/corruption handling, local→cloud migration retries, API hardening, ArcGIS geometry conversion, and shared-map access.

Source: README.md at commit d10e03c

Tools

3

preview_exploration_map

Create a mineral exploration map preview

Create a branded mineral exploration map from public registry claims and return a shareable URL. Provide at least one of search, location or claim_numbers. For a specific project, search its claims first and pass exact claim_numbers. Supply published facts and branding when known; never invent ownership, targets, grades or coordinates. Supports separate neighbouring claims, a project callout, locator inset, and map basemap selection. Drill and NI 43-101 layouts require user-supplied data or qualified review; this tool does not generate drill results. Free use allows 10 previews per hour; allowance in the result reports how many remain.

Parametersinsetstyletitlesearchbasemapcompanyincludebrandinglocationmap_typesubtitleneighbours+6 more

search_mineral_claims

Search mineral claims and tenure

Search public mineral-claim registries by holder, exact claim number, claim name, or geographic bounding box; provide query, bbox, or both. Claim-name search is available for British Columbia and US BLM jurisdictions. Returns claim number as a string, name, holder, status, expiry, area and centroid when the registry supplies them. Cluster results geographically before selecting a specific project. Results are informational, not a legal title opinion or survey.

Parametersbboxlimitquerysearch_typejurisdictionrequired

get_mapping_capabilities

Get ExplorationMaps mapping capabilities

Return the map types, mineral-registry jurisdictions, context overlays, search modes, and styles supported by ExplorationMaps. Use this when deciding whether ExplorationMaps can fulfill a mapping request or when a jurisdiction is unclear.

Takes no parameters.

Version history

2
  1. v1.1.1LatestSep 23, 2026
  2. v1.0.0Sep 21, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.