mini-creative-toolkitCAUTION
23 CPU-first media tools behind one MCP server: background removal, EXIF/GPS stripping, resize, thumbnails, GIFs, video trim. 22 of them report "network": "none" in their own response payload rather than in a README, and a test fails if any other module ever imports an HTTP client. No GPU, no paid A
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Local media tools for MCP clients and the shell: strip GPS from a photo, resize, convert, cut out a background, trim a video. 22 of the 23 tools run on your CPU, and every reply states its own `execution` and `network`.
uvx --from git+https://github.com/Furkiozknn/mini-creative-toolkit mct inspect photo.jpg
Your files stay on the machine: the one hosted tool (generate_image_free) is labelled network: required, and remove_background downloads a model's weights once (first-run-only), as does batch_process when it runs remove_background. The server puts network: none in the payload on 20 of its 23 tools. No clone, no API key, no GPU. Needs uv; ffmpeg only for video and audio. Measured on Windows 11: 21 s from an empty cache to the first result, 3 s once cached (docs/DENETIM.md).
Use it from Claude Code or any MCP client with one line:
claude mcp add --transport stdio mini-creative-toolkit -- uvx --from git+https://github.com/Furkiozknn/mini-creative-toolkit mct serve
Real commands, real output: the full record is docs/demo/komutlar.txt. photo.jpg is a synthetic picture with EXIF and GPS tags, not anybody's photo. The last command is an MCP client session over stdio (scripts/mcp_probe.py). Regenerate everything with uv run python scripts/demo-uret.py.
12716b9fd513OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mini-creative-toolkit -- uvx mini-creative-toolkit==2.1.0
Trust audit
CAUTIONgrade B · trust 86/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (11)
FSRCNN_x2.pb
FSRCNN_x3.pb
FSRCNN_x4.pb
@pytest.mark.parametrize("target", ["/etc/passwd", "/etc/../etc/passwd", "~root/.ssh/id_rsa"])url = pollinations.build_url("../../admin?x=1&y=2 #frag")assert safe_stem("../../etc/passwd") == "etc-passwd""../../etc/passwd",
@pytest.mark.parametrize("stamp", ["-ss", "1; rm -rf /", "$(id)", "../../etc/passwd", "-i"])@font-face{font-family:JB;font-weight:400;src:url(data:font/ttf;base64,AAEAAAAQAQAABAAAR0RFRmTuZOoAAAJYAAABckdQT1NNk7vRAAAejAAADPxHU1VCZhSk1QAAbVgAAFR+T1MvMhDxBoEAAAH4AAAAYFNUQVTmX9MbAAABmAAAAF5jbWFwK@font-face{font-family:JB;font-weight:700;src:url(data:font/ttf;base64,AAEAAAAQAQAABAAAR0RFRmTuZOoAAAJEAAABckdQT1NPacQ3AAAeZAAADQhHU1VCZhSk1QAAbTwAAFR+T1MvMhIdBmEAAAHkAAAAYFNUQVTrN8wVAAABmAAAAExjbWFwKGates applied: no_behavioural_pass.
12716b9fd513full audit observations/trust-audit/mcp-server/furkiozknn__mini-creative-toolkit.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 12716b9fd513 | CAUTION | B | 86 | first audit |
Questions
What is the mini-creative-toolkit MCP server?
23 CPU-first media tools behind one MCP server: background removal, EXIF/GPS stripping, resize, thumbnails, GIFs, video trim. 22 of them report "network": "none" in their own response payload rather than in a README, and a test fails if any other module ever imports an HTTP client. No GPU, no paid A
Is mini-creative-toolkit safe to connect to an agent?
With care. The audit graded it B (86/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does mini-creative-toolkit need?
No credential environment variables were found in its source, so it appears to need none.
How does mini-creative-toolkit run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as mini-creative-toolkit.
How current is this page?
The grade is for one exact copy of the source (12716b9fd513), read on 2026-10-12. The repository is watched and re-audited when it changes.