Add demo-nyc-neighborhood-finder

[chriswhong]

Summary

This PR adds a new demo project: NYC Neighborhood Finder — an AI-powered neighborhood recommendation app for New York City.

• Users describe what they're looking for (lifestyle, commute, amenities, vibe) in a chat interface
• Claude reasons about NYC neighborhoods using both LLM knowledge and real Mapbox location data
• Recommended neighborhoods are highlighted as polygons on an interactive Mapbox GL JS map

Architecture

• Frontend: React + TypeScript + Vite + Mapbox GL JS
• Backend: Express server (server.js) streaming responses from Claude via the Vercel AI SDK
• AI Agent: Anthropic Claude (claude-opus-4-6) with Mapbox MCP Server tools for real location data (POIs, transit, stores)
• The agent uses a show_neighborhoods custom tool to push neighborhood data to the map UI

Requirements

This demo requires two API keys, configured in a .env file:

• A Mapbox access token (VITE_MAPBOX_TOKEN)
• An Anthropic API key (ANTHROPIC_API_KEY)

A .env.sample file is included with instructions.

🤖 Generated with Claude Code

[ox-security]

Successfully scanned changes introduced in a pull request into main from cw/demo-nyc-neighborhood-finder.

Internal scan identifier: 2a3d97f0-678a-41fe-80a9-f311037b8567.

Total issues	Blocking issues	Scan status
10	0	✔️

Category	Issues
Open Source Security	10

See all issues found during this scan in the OX Security Application.

Detailed information

Issue #	1
Name	vite@5.4.11 • 12 CVEs • KEV - Known Exploited • Public Exploit
Status	Old
Enforcement	Monitor
Severity	Critical
Category	Open Source Security
Source tools	OX Open Source Security
Recommendation	Development dependencies are normally not critical to resolve right away, however, it is safer to use a library with less security issues. • Current Dependency: vite@5.4.11 • Recommended Upgrade: vite@8.2.2 • vite@8.2.2 resolves 1 of 1 development vulnerabilities Upgrading to vite@8.2.2 will resolve ALL known vulnerabilities in your current dependency.

1 aggregation

File	Match
yarn.lock	vite@5.4.11

---

Issue #	2
Name	lodash@4.17.21 • 3 CVEs • EPSS Low
Status	Old
Enforcement	Monitor
Severity	High
Category	Open Source Security
Source tools	OX Open Source Security
Recommendation	Development dependencies are normally not critical to resolve right away, however, it is safer to use a library with less security issues. • Current Dependency: lodash@4.17.21 • Recommended Upgrade: lodash@4.18.1 • lodash@4.18.1 resolves 1 of 1 development vulnerabilities Upgrading to lodash@4.18.1 will resolve ALL known vulnerabilities in your current dependency.

1 aggregation

File	Match
yarn.lock	lodash@4.17.21

---

Issue #	3
Name	js-yaml@4.1.0 • 4 CVEs • Public Exploit • EPSS Low
Status	Old
Enforcement	Monitor
Severity	High
Category	Open Source Security
Source tools	OX Open Source Security
Recommendation	Development dependencies are normally not critical to resolve right away, however, it is safer to use a library with less security issues. • Current Dependency: js-yaml@4.1.0 • Recommended Upgrade: js-yaml@4.3.2 • js-yaml@4.3.2 resolves 1 of 1 development vulnerabilities Upgrading to js-yaml@4.3.2 will resolve ALL known vulnerabilities in your current dependency.

1 aggregation

File	Match
yarn.lock	js-yaml@4.1.0

---

Issue #	4
Name	form-data@3.0.2 • 2 CVEs • EPSS Low
Status	Old
Enforcement	Monitor
Severity	High
Category	Open Source Security
Source tools	OX Open Source Security
Recommendation	Development dependencies are normally not critical to resolve right away, however, it is safer to use a library with less security issues. • Current Dependency: form-data@3.0.2 • Recommended Upgrade: form-data@3.0.5 • form-data@3.0.5 resolves 1 of 1 development vulnerabilities Upgrading to form-data@3.0.5 will resolve ALL known vulnerabilities in your current dependency.

1 aggregation

File	Match
yarn.lock	form-data@3.0.2

---

Issue #	5
Name	rollup@4.30.1 • 1 CVE • Public Exploit • EPSS Low
Status	Old
Enforcement	Monitor
Severity	High
Category	Open Source Security
Source tools	OX Open Source Security
Recommendation	Development dependencies are normally not critical to resolve right away, however, it is safer to use a library with less security issues. • Current Dependency: rollup@4.30.1 • Recommended Upgrade: rollup@4.63.1 • rollup@4.63.1 resolves 1 of 1 development vulnerabilities Upgrading to rollup@4.63.1 will resolve ALL known vulnerabilities in your current dependency.

1 aggregation

File	Match
yarn.lock	rollup@4.30.1

---

Issue #	6
Name	rollup@4.52.3 • 1 CVE • Public Exploit • EPSS Low
Status	Old
Enforcement	Monitor
Severity	High
Category	Open Source Security
Source tools	OX Open Source Security
Recommendation	Development dependencies are normally not critical to resolve right away, however, it is safer to use a library with less security issues. • Current Dependency: rollup@4.52.3 • Recommended Upgrade: rollup@4.63.1 • rollup@4.63.1 resolves 1 of 1 development vulnerabilities Upgrading to rollup@4.63.1 will resolve ALL known vulnerabilities in your current dependency.

1 aggregation

File	Match
yarn.lock	rollup@4.52.3

---

Issue #	7
Name	flatted@3.3.2 • 2 CVEs • Public Exploit • EPSS Low
Status	Old
Enforcement	Monitor
Severity	High
Category	Open Source Security
Source tools	OX Open Source Security
Recommendation	Development dependencies are normally not critical to resolve right away, however, it is safer to use a library with less security issues. • Current Dependency: flatted@3.3.2 • Recommended Upgrade: flatted@3.4.4 • flatted@3.4.4 resolves 1 of 1 development vulnerabilities Upgrading to flatted@3.4.4 will resolve ALL known vulnerabilities in your current dependency.

1 aggregation

File	Match
yarn.lock	flatted@3.3.2

---

Issue #	8
Name	postcss@8.4.49 • 4 CVEs • Public Exploit • EPSS Low
Status	Old
Enforcement	Monitor
Severity	High
Category	Open Source Security
Source tools	OX Open Source Security
Recommendation	Development dependencies are normally not critical to resolve right away, however, it is safer to use a library with less security issues. • Current Dependency: postcss@8.4.49 • Recommended Upgrade: postcss@8.5.26 • postcss@8.5.26 resolves 1 of 1 development vulnerabilities Upgrading to postcss@8.5.26 will resolve ALL known vulnerabilities in your current dependency.

1 aggregation

File	Match
yarn.lock	postcss@8.4.49

---

Issue #	9
Name	postcss@8.5.6 • 4 CVEs • Public Exploit • EPSS Low
Status	Old
Enforcement	Monitor
Severity	High
Category	Open Source Security
Source tools	OX Open Source Security
Recommendation	Development dependencies are normally not critical to resolve right away, however, it is safer to use a library with less security issues. • Current Dependency: postcss@8.5.6 • Recommended Upgrade: postcss@8.5.26 • postcss@8.5.26 resolves 1 of 1 development vulnerabilities Upgrading to postcss@8.5.26 will resolve ALL known vulnerabilities in your current dependency.

1 aggregation

File	Match
yarn.lock	postcss@8.5.6

---

Issue #	10
Name	js-yaml@4.1.1 • 3 CVEs • Public Exploit • EPSS Low
Status	Old
Enforcement	Monitor
Severity	High
Category	Open Source Security
Source tools	OX Open Source Security
Recommendation	Development dependencies are normally not critical to resolve right away, however, it is safer to use a library with less security issues. • Current Dependency: js-yaml@4.1.1 • Recommended Upgrade: js-yaml@4.3.2 • js-yaml@4.3.2 resolves 1 of 1 development vulnerabilities Upgrading to js-yaml@4.3.2 will resolve ALL known vulnerabilities in your current dependency.

1 aggregation

File	Match
yarn.lock	js-yaml@4.1.1

[AndrewSepic]

The demo-droidcon-web folder should be removed completely. There are a few other comments which should have fixes implemented and I have a PR which improved the experience here from a 20% ability of the agent to render neighborhoods on the map to a 100% ability.