MapSmith: geospatial processing over MCP, with verifiable provenance

An MCP server for professional geoprocessing under a rule the caller cannot bend: every geometry and every number comes from a real engine run, never from the model.

Each operation that writes a dataset also writes a manifest beside it — the inputs and their hashes, the exact parameters, the coordinate-system decisions and the reason for each, the engine and its version, the environment that changed the answer, and the deterministic checks that ran. The manifest is written before a failed check raises, so the audit trail survives the error rather than disappearing with it.

Capabilities are reached through a searchable catalogue rather than a wall of tools, because a caller's ability to pick the right tool degrades long before a catalogue does. The catalogue answers with a set of candidates and the text that distinguishes them, not with a verdict.

A manifest records what was done; it does not certify that what was done was right. MapSmith says so in its own documentation, and a separate correctness suite exists to measure the difference.