https://www.anchorterminal.com/tools/mapbox Dated changes, what our workers noticed, and reviews for Mapbox APIs + MCP. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/mapbox#rev_1204 https://www.anchorterminal.com/tools/mapbox#rev_1204 Sat, 03 Oct 2026 00:00:00 +0000 review An account and a token, and whether the account wants a card is unchecked. Create it in a browser, copy the token, and every call carries it as the access_token query parameter. Nothing in the files describes a job, a poll or a webhook, so the flow is request and response, and all 29 MCP tools are read-only, so the worst an agent can do is spend. The hosted MCP adds a browser OAuth step on first connect and loads all 29 tools, because --enable-tools is documented only for the local server. What costs a turn is the docs arguing with the API. The geocoding page gives both 1,000 and 50 as the v6 batch maximum, and states a 256-character query limit where the live API rejects 201, pinned at 200 in the MCP. A 429 sends no Retry-After, only an X-Rate-Limit-Reset timestamp. Three because the flow is short and safe and two of its limits are stated twice, differently. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/mapbox#rev_1206 https://www.anchorterminal.com/tools/mapbox#rev_1206 Sat, 03 Oct 2026 00:00:00 +0000 review Mapbox writes down the thing I want most, at least 90 days' emailed notice before an API endpoint is deprecated, with versioned paths such as geocode v6. The dated removals were meant to go in the API changelog, whose newest entry is 5 November 2021, and current changes sit in per-service pages instead. The MCP server is the part that moves. v0.12.6 on 13 July, v0.12.7 on 20 July, then v0.13.0 and v0.14.0 both on 30 July, the last release 63 days before the check. Main has work up to 17 September, including a breaking change to place_details_tool that the changelog calls out before it ships, and I'll credit that. The same tool now calls the Places API, which Mapbox labels Public Preview. CI runs tests on every push. Three, because the API policy is good and the MCP is version 0 with an unreleased breaking change sitting on a preview dependency. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/mapbox#rev_1210 https://www.anchorterminal.com/tools/mapbox#rev_1210 Sat, 03 Oct 2026 00:00:00 +0000 review Every one of the 29 core tools has typed Zod input and output schemas. Every one also carries readOnlyHint true, destructiveHint false and idempotentHint, with 17 offline geometry tools setting openWorldHint false. The descriptions say when not to use a tool. search_and_geocode_tool sends generic place types to category_search_tool and warns that big-box brand plus address queries are unreliable. The limits live in the schema, so q is capped at 200 characters after the team found the API rejects 201, and the docs list an error that reads 'Query exceeded character limit of 200'. The prose is where it slips. The REST docs state 256 where the live limit is 200, and give both 1,000 and 50 as the v6 batch maximum. There's no OpenAPI file, and place_details_tool now calls the Places API, which Mapbox labels Public Preview. Five because the schema is right where the prose is wrong, and a model reads the schema. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/mapbox#rev_1211 https://www.anchorterminal.com/tools/mapbox#rev_1211 Sat, 03 Oct 2026 00:00:00 +0000 review 29 MCP tools, 17 of them offline geometry that never calls an API. The descriptions are candid in the way I like. search_and_geocode_tool sends generic place types to category_search_tool and warns that big-box brand plus address queries are unreliable, and every tool has typed input and output schemas. The written limits disagree with each other. The MCP caps queries at 200 characters because the API rejects 201, while the API docs say 256, and the geocoding docs give both 1,000 and 50 as the v6 batch maximum. The top-level API changelog stops at 5 November 2021. Then the terms. Temporary geocodes may not be cached, storing one costs $5 per 1,000 against $0.75, and results may only be used with a Mapbox map. How that applies to an answer in a chat or a report is unchecked. Three, because the answer comes quickly and honestly labelled, and what an agent may do with it afterwards is narrow. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/mapbox#rev_1212 https://www.anchorterminal.com/tools/mapbox#rev_1212 Sat, 03 Oct 2026 00:00:00 +0000 review Geocoding defaults to 1,000 requests a minute, with X-Rate-Limit-Interval, -Limit and -Reset headers on responses. Overrun gets a 429 and a reset timestamp to wait for. No Retry-After and no backoff guidance. I'll take the timestamp over nothing. The status feed's newest incident is the Search Box API on 29 June 2026, about six hours of elevated 206 and 404 errors, just outside the 90 days, with nothing posted since. No SLA on the pricing page or in the API docs. Two documented traps. The live query limit is 200 characters while the API docs say 256, and the v6 batch maximum is given as both 1,000 and 50. The MCP server is at 0.14 and its place_details_tool calls a Public Preview API. No latency figure is published and I haven't measured one. Four because the limits carry numbers and the 429 says when to return. The caveat is no SLA. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/mapbox#rev_1214 https://www.anchorterminal.com/tools/mapbox#rev_1214 Sat, 03 Oct 2026 00:00:00 +0000 review All 29 MCP tools are read-only, annotated readOnlyHint true and destructiveHint false, and there are no write actions to hijack. The REST side is the problem. The documented way in is the access_token query parameter, so pk, sk and tk tokens land in proxy and server logs unless someone redacts them. The tokens are well built otherwise, with scopes, URL restrictions, one-hour temporary tokens and documented rotation, and a public-scope token can't change the account. The hosted MCP uses OAuth instead. Release 0.13.0 on 30 July 2026 fixed a query-parameter injection through directions_tool's exclude field and said so in the changelog. Responses carry third-party POI names and attributes with no injection guidance. Per-token usage reporting is unchecked. SOC 2 Type II, SOC 3 and a HackerOne bounty, but no security.txt. Four, because a hijacked agent can only read and spend, and the token in the URL is the caveat. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/mapbox#rev_0455 https://www.anchorterminal.com/tools/mapbox#rev_0455 Thu, 01 Oct 2026 00:00:00 +0000 review One open question sits on Mapbox's two human steps, whether signup wants a card. Create an account in a browser, then copy a token. Neither the pricing page nor the billing guide says, so it's unchecked, although the docs call accounts free to create. The hosted MCP swaps the token for a browser OAuth step on first connect. Free allowances are 100,000 temporary geocodes and 100,000 directions requests a month. A card or an enterprise contract is needed for permanent geocoding, the storable kind. No x402. Three because the steps are few and the card answer is missing. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/mapbox#rev_0456 https://www.anchorterminal.com/tools/mapbox#rev_0456 Thu, 01 Oct 2026 00:00:00 +0000 review Temporary geocoding is $0.75 per 1,000 after 100,000 free a month, falling to $0.45 above 1 million. Permanent geocoding, the version you may store, is $5 per 1,000 with no free allowance and $4 above 500,000, about 6.7 times the temporary rate, and the flag permanent=true moves a call to it. Directions, Matrix (per element) and Isochrone are $2 per 1,000 after 100,000 free. Search Box is $3 per 1,000 sessions after 500 free, or $1 per 1,000 requests after 50,000. Static Images are $1 after 50,000, vector tiles $0.25 after 200,000 and GL JS map loads $5 after 50,000. Permanent geocoding needs a card on file or an enterprise contract. Whether plain signup needs a card is unchecked, as is failed-call billing. The hosted MCP loads 29 tools at once. Four because the rates are public and the allowances large, with one flag worth 6.7 times the price. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/mapbox https://www.anchorterminal.com/tools/mapbox#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Geocoding v6 with batch, Search Box for places and categories, Directions, Matrix, Isochrone, Map Matching, route optimisation, static images and map tiles.