ModelsAtlas
Explore
Atlas / MCP servers / lumalabs / Luma API

Luma APIBLOCK

mcp/lumalabs/luma-api
MCP server by lumalabs · api · genai · image · Audited 2026-10-09
⚑ Report / re-scanSource ↗

Powered by Ray (video) and Photon (image) models by Luma AI

Verdict
BLOCK
Grade
D
Trust score
66 /100
Exposed tools
2 0r · 2w · 0d
Transport
—
License
MIT
Stars
26
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Setup

  1. Install Claude Desktop App or any MCP client
  2. Get API Key from https://lumalabs.ai/api/keys
  3. Run sh setup.sh, here it will ask the API Key - paste it from 2.

Run

Open Claude Desktop or any MCP client

Features

Create Image

  • prompt: text
  • aspect_ratio: "1:1", "16:9", "9:16", "4:3", "3:4", "21:9", "9:21" (default: "16:9")
  • model: "photon-1", "photon-flash-1" (default: "photon-1")
  • image_ref: list of image URLs with weights to influence generation (optional), max 8
  • style_ref: single image URL with weight to influence style (optional), max 1
  • character_ref: list of character image URLs (optional), max 4
  • modify_image_ref: single image URL to modify with weight (optional), max 1

Create Video

  • prompt: text
  • aspect_ratio: "1:1", "16:9", "9:16", "4:3", "3:4", "21:9", "9:21" (default: "16:9")
  • model: "ray-2", "ray-flash-2", "ray-1-6" (default: "ray-2")
  • loop: boolean (default: false)
  • resolution: "540p", "720p", "1080p", "4k" (default: "720p")
  • duration: "5s", "9s" (default: "5s")
  • frame0_image: image URL (optional)
  • frame1_image: image URL (optional)
  • frame0_id: generation ID (optional)
  • frame1_id: generation ID (optional)

Technical Notes

  • Keyframes: Providing frame0image/frame1image gives more control over video start/end points
  • Video Response Time: Typical video generation takes 15-60 seconds depending on duration and resolution
  • Image Response Time: Typical generation takes 5-15 seconds depending on model complexity
Read from source at commit 5b1ab2fc797cOBSERVED · 2026-10-09
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add luma-mcp --env LUMA_API_KEY=${LUMA_API_KEY} -- uvx luma-mcp
claude-desktop
{
  "mcpServers": {
    "luma-mcp": {
      "command": "uvx",
      "args": [
        "luma-mcp"
      ],
      "env": {
        "LUMA_API_KEY": "${LUMA_API_KEY}"
      }
    }
  }
}
03

Exposed tools (2)

0 read · 2 write · 0 destructive.

ToolRiskDescription
create_imagewriteGenerates AI images using Luma API based on the provided parameters.
create_videowriteGenerates AI videos using Luma API based on the provided parameters.
04

Trust audit

BLOCKgrade D · trust 66/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (7 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (5)

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
setup.sh:49
sudo apt-get update && sudo apt-get install -y jq || warn "Failed to install jq using apt-get."
Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
setup.sh:51
sudo yum install -y jq || warn "Failed to install jq using yum."
Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
setup.sh:53
sudo dnf install -y jq || warn "Failed to install jq using dnf."
Why it matters. asks for elevated privileges
HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
setup.sh:55
sudo pacman -Syu --noconfirm jq || warn "Failed to install jq using pacman."
Why it matters. asks for elevated privileges
INFOPrompt injection · scope.undeclared_system · CWE-94, CWE-1427
<declared scope>
system use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare system use in the description, or remove it

Gates applied: no_behavioural_pass.

Audited 2026-10-09 · audit v0.4.1 · source sha 5b1ab2fc797cfull audit observations/trust-audit/mcp-server/lumalabs__luma-api.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-095b1ab2fc797cBLOCKD66first audit
06

Questions

What is the Luma API MCP server?

Powered by Ray (video) and Photon (image) models by Luma AI

What tools does Luma API expose?

2 in total: 0 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Luma API safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (66/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Luma API need?

It reads LUMA_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (5b1ab2fc797c), read on 2026-10-09. The repository is watched and re-audited when it changes.

Advertisement