MCP server · Org-owned · Audited from source

PPTAgent MCP server

by icip-cas/pptagentMIT licenceAudited 21 Sep 2026 · source fc575a09d386

npm pptagent-skill-runtime 1.0.0stdio★ 5,046

✓SAFEGrade B · 89/100 · 21 Sep 2026 · fc575a0

5,046GitHub stars

Is it safe? Yes — SAFE, grade B (89/100). It exposes 2 tools: 2 read, 0 write and 0 destructive. The audit recorded 6 findings (0 critical, 0 high, 0 medium, 4 low). Maintainer's description: An Agentic Framework for Reflective PowerPoint Generation

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “PPTAgent MCP server (icip-cas/pptagent)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/icip-cas/pptagent

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score89/100✓SAFE B

0 critical0 high0 medium4 low2 info

6 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemNone observedNothing seen in the source
NetworkDeclared3 observations
ShellNone observedNothing seen in the source
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 4 findings
`L1` Static source	Secrets, path traversal, supply chain	PASS 2 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS
`L3` Inventory	Declared tools match the source	PASS
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner icip-casOrganizationAccount type recorded when we read the repository.
PackagePublished on npmpptagent-skill-runtime at version 1.0.0
LicenceMITFrom the repository, as read at the audited commit.
Last pushTodayActivity of the repository when we read it.
Source commit readfc575a09d386The audit covers exactly this commit, read on 21 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory2 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (6)

Sorted by severity

LOWInventory / provenanceinv.hidden_file · .pre-commit-config.yaml

F-13 Inventory / provenanceCWE-1104Layer L0

.pre-commit-config.yaml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.symlink · CLAUDE.md

F-13 Inventory / provenanceCWE-1104Layer L0

CLAUDE.md

Why: link not followed
Fix: —

LOWSupply chainsupply.unpinned · skills/pptagent/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

fast-glob, minimist, pptxgenjs, sharp

Why: 4 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · skills/pptagent/requirements.txt

F-08 Supply chainCWE-829 · CWE-1357Layer L1

PyYAML, Pillow, PyMuPDF, fastmcp

Why: 4 requirement(s) not pinned with ==
Fix: pin exact versions

INFOInventory / provenanceinv.oversize · resource/pptagent-demo.gif

F-13 Inventory / provenanceCWE-1104Layer L0

resource/pptagent-demo.gif

Why: 7132018 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · resource/pptagent.png

F-13 Inventory / provenanceCWE-1104Layer L0

resource/pptagent.png

Why: 1018957 bytes not read
Fix: —

Tools it exposes

2 declared in source · 0 destructive

2 read0 write0 destructive

Tool	Risk	What it does
`review_deck`	read	Render and review the exported answer.pptx contact sheets.
`review_slides`	read	Render and review every HTML slide with the configured visual model.

Install

Package version 1.0.0 · audited commit fc575a0

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 1.0.0. The audit covers commit fc575a0 only.

claude mcp add pptagent-skill-runtime -- npx -y [email protected]

{
  "mcpServers": {
    "pptagent-skill-runtime": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

The command pins the package version recorded in the source (1.0.0); the audit covers commit fc575a09d386. Transport: stdio. No environment variables required.

Audit history

2026-09-21
✓SAFE B 89 / 100
BLOCK -> SAFE · fc575a09d386
2026-09-13
✕BLOCK D 69 / 100
First audit · 10efdfbea462

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: SAFE B](https://modelsatlas.com/mcp/icip-cas/pptagent/badge.svg)](https://modelsatlas.com/mcp/icip-cas/pptagent/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about PPTAgent MCP server

What is the PPTAgent MCP server?

An Agentic Framework for Reflective PowerPoint Generation

What tools does PPTAgent expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is PPTAgent safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does PPTAgent need?

No credential environment variables were found in its source, so it appears to need none.

How does PPTAgent run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as pptagent-skill-runtime at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (fc575a09d386), read on 2026-09-21. The repository is watched and re-audited when it changes.

Sources

icip-cas/pptagent on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — SAFE verdict for commit fc575a09d386Observed · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the PPTAgent MCP server?
GChatGPT CClaude PPerplexity
What tools does PPTAgent expose?
GChatGPT CClaude PPerplexity
Is PPTAgent safe to connect to an agent?
GChatGPT CClaude PPerplexity