Limits and safety

Row caps, the schema allow-list, plan gating and metering, error shapes, data freshness, and what the MCP server deliberately cannot do.

Giving a language model direct access to a production database is a reasonable thing to be nervous about. The server is narrow by design.

What it cannot do

Read-only. Every tool issues a select against the parcel layer. There is no tool that writes, updates, or deletes anything, and no tool that executes arbitrary SQL or CQL.
No free-text query language. Filters arrive as structured {column, op, value} objects, validated field by field, then translated server-side. The model never composes a query string, so there is no injection surface to escape.
No other tables. The tools reach exactly one layer — the nationwide parcel layer. Nothing else in the database is exposed.

Row and response caps

Limit	Value
Default rows per call	10
Maximum rows per call	1,000 (a larger `limit` is silently clamped, not rejected)
Geometry in responses	Never returned — `geom` is excluded even if requested
Columns per row	~50 by default; use `columns` to narrow
WFS query timeout	30 seconds
Geocoder timeout	10 seconds
Geocoder candidates (`size`)	Capped at 5; the top hit is always used

The row cap protects both the serving layer and the model's context window. For anything that wants more than 1,000 rows at a time, use the bulk downloads or the WFS endpoint with paging — MCP is built for questions, not extraction.

Schema allow-list

Column names in where and columns are checked against the published schema before a query is built, and values are type-checked and escaped. An invented column name fails cleanly with a message telling the caller to call parcel_schema — it never becomes a malformed query. lrid is forced into any explicit columns list so rows can always be correlated back to a parcel.

Plan gating and metering

Access is checked against your plan when the connection is established, and every tool call is metered and logged with the token, tool name, arguments, status, and duration — the same audit trail as the rest of the API.

A token whose plan has no MCP allowance gets 403 Your plan does not include MCP access at handshake time, before any tool runs.
Tool calls are metered under the MCP tool calls meter. Your remaining allowance appears alongside your other quotas on your account page, and you'll get the same approaching-limit and over-limit notifications as the tile and record meters.
One tool call is one metered request. A single conversational question often spans several — parcel_schema, then parcel_count, then parcel_query is three. Prompt guidance that avoids needless calls (see Examples) is the practical way to keep usage down.

Error shapes

Tool errors do not break the JSON-RPC envelope. The call returns normally with a JSON error object in the text block, so the model can read it and adjust:

{
  "error": "CQLBuildError",
  "message": "unknown column: 'owner_name'. Call parcel_schema to see valid columns.",
  "duration_ms": 3
}

Common cases:

`error` / message	Cause
`unknown column: '…'`	Column not in the schema — call `parcel_schema`
`unsupported operator '…'`	Only `eq`, `ne`, `gt`, `ge`, `lt`, `le`, `like`, `ilike`, `in`, `is_null` are allowed
`in requires a non-empty list`	`in` was given a scalar or an empty array
`use is_null op instead of a bare None value`	A `null` value was passed to a comparison operator
`lrid must be a UUID, got …`	`parcel_by_id` received something other than a UUID
`bbox min must be <= max on each axis`	`minx`/`miny` exceeded `maxx`/`maxy`
`distance_meters must be positive`	Zero or negative radius
`unsupported geometry type '…'`	Only `Polygon` and `MultiPolygon` — pass the bare geometry, not a Feature
`polygon ring must have at least 4 points (closed)`	Degenerate ring in the supplied GeoJSON
`GeocodeError: … found no matches for '…'`	Address didn't resolve — add city, state, or ZIP

Validation failures are logged with status 400, upstream failures with 500. Both are metered, so a loop of failing calls still consumes allowance — worth knowing if you are testing an agent.

Transport-level problems (bad or missing token, plan not entitled) are HTTP errors instead, and never reach the tools — see the troubleshooting table.

Data freshness

The MCP server reads the same serving layer as the rest of api.landrecords.us, so it inherits the weekly refresh. Ownership transfers, new assessments, and newly ingested county boundaries reach your assistant on the same cycle they reach the tile and WFS endpoints — there is nothing to re-sync on your end.

Attribute coverage still varies by county: a column that exists in the schema may be null for a given parcel because the source assessor doesn't publish it. See Coverage Statistics before concluding that a filter returned nothing because nothing matched.

Operational notes

Health check. GET https://api.landrecords.us/mcp/health is unauthenticated and tells you the server is up. It does not validate your token or plan.
Transports. New clients should use the Streamable HTTP endpoint at https://api.landrecords.us/mcp. The legacy SSE pair (/mcp/sse + /mcp/messages/) remains for older clients.
Token handling. The MCP token is a full-access read credential for your plan's quota. Keep it in an environment variable or secret store, not in a checked-in config file, and revoke it from your account page if it leaks.
Support. Questions, a callback port you need registered, or a tool you wish existed: hello@landrecords.us. We are actively expanding the tool set.