Atlas / MCP servers / minimax-ai / MiniMax

MiniMaxBLOCK

mcp/minimax-ai/minimax-1

Official MiniMax Model Context Protocol (MCP) JavaScript implementation that provides seamless integration with MiniMax's powerful AI capabilities including image generation, video generation, text-to-speech, and voice cloning APIs.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
36 36r · 0w · 0d
Transport
sse · stdio
License
MIT
Stars
130
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

JavaScript/TypeScript implementation of MiniMax MCP, providing image generation, video generation, text-to-speech, and more.

<img alt="Homepage" src="https://img.shields.io/badge/_Homepage-MiniMax-FF4040?style=flat-square&labelColor=2C3E50&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB2aWV3Qm94PSIwIDAgNDkwLjE2IDQxMS43Ij48ZGVmcz48c3R5bGU+LmNscy0xe2ZpbGw6I2ZmZjt9PC9zdHlsZT48L2RlZnM+PHBhdGggY2xhc3M9ImNscy0xIiBkPSJNMjMzLjQ1LDQwLjgxYTE3LjU1LDE3LjU1LDAsMSwwLTM1LjEsMFYzMzEuNTZhNDAuODIsNDAuODIsMCwwLDEtODEuNjMsMFYxNDVhMTcuNTUsMTcuNTUsMCwxLDAtMzUuMDksMHY3OS4wNmE0MC44Miw0MC44MiwwLDAsMS04MS42MywwVjE5NS40MmExMS42MywxMS42MywwLDAsMSwyMy4yNiwwdjI4LjY2YTE3LjU1LDE3LjU1LDAsMCwwLDM1LjEsMFYxNDVBNDAuODIsNDAuODIsMCwwLDEsMTQwLDE0NVYzMzEuNTZhMTcuNTUsMTcuNTUsMCwwLDAsMzUuMSwwVjIxNy41aDBWNDAuODFhNDAuODEsNDAuODEsMCwxLDEsODEuNjIsMFYyODEuNTZhMTEuNjMsMTEuNjMsMCwxLDEtMjMuMjYsMFptMjE1LjksNjMuNEE0MC44Niw0MC44NiwwLDAsMCw0MDguNTMsMTQ1VjMwMC44NWExNy41NSwxNy41NSwwLDAsMS0zNS4wOSwwdi0yNjBhNDAuODIsNDAuODIsMCwwLDAtODEuNjMsMFYzNzAuODlhMTcuNTUsMTcuNTUsMCwwLDEtMzUuMSwwVjMzMGExMS42MywxMS42MywwLDEsMC0yMy4yNiwwdjQwLjg2YTQwLjgxLDQwLjgxLDAsMCwwLDgxLjYyLDBWNDAuODFhMTcuNTUsMTcuNTUsMCwwLDEsMzUuMSwwdjI2MGE0MC44Miw0MC44MiwwLDAsMCw4MS42MywwVjE0NWExNy41NSwxNy41NSwwLDEsMSwzNS4xLDBWMjgxLjU2YTExLjYzLDExLjYzLDAsMCwwLDIzLjI2LDBWMTQ1QTQwLjg1LDQwLjg1LDAsMCwwLDQ0OS4zNSwxMDQuMjFaIi8+PC9zdmc+&logoWidth=20" style="display: inline-block; vertical-align: middle;"/>

Read from source at commit 33c4da9aa322OBSERVED · 2026-10-07
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add minimax-mcp-js -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "minimax-mcp-js": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (36)

36 read · 0 write · 0 destructive.

ToolRiskDescription
aspectRatioreadImage aspect ratio, values: [
async_modereadWhether to use async mode. Defaults to False. If True, the video generation task will be submitted asynchronously and the response will return a task_id. Should use
audioFilereadAudio file path
bitratereadBitrate (bps), values: [64000, 96000, 128000, 160000, 192000, 224000, 256000, 320000]
channelreadAudio channels, values: [1, 2]
durationreadThe duration of the video. The model must be
emotionreadSpeech emotion, values: [
firstFrameImagereadFirst frame image
formatreadAudio format, values: [
generate_videoreadGenerate video based on text prompt
image_to_videoreadGenerate video based on image
inputFilePathreadPath to audio file to play
isUrlreadWhether audio file is a URL
languageBoostreadEnhance the ability to recognize specified languages and dialects. Supported values include:
list_voicesreadList all available voices
modelreadModel to use
nreadNumber of images to generate (1-9)
outputFilereadOutput file path, auto-generated if not provided
pitchreadSpeech pitch (-12 to 12)
play_audioreadPlay audio file. Supports WAV and MP3 formats. Does not support video.
previewTextreadThe text to preview the voice
promptreadText prompt for image generation
promptOptimizerreadWhether to optimize prompt
query_video_generationreadQuery the status of a video generation task.
resolutionreadThe resolution of the video. The model must be
sampleRatereadSample rate (Hz), values: [8000, 16000, 22050, 24000, 32000, 44100]
speedreadSpeech speed (0.5-2.0)
subtitleEnablereadThe parameter controls whether the subtitle service is enabled. The model must be
textreadText to convert to audio
text_to_audioreadConvert text to audio
text_to_imagereadGenerate image based on text prompt
voiceIdreadVoice ID to use, e.g.
voiceTypereadType of voices to list, values: [
voice_clonereadClone voice using provided audio file
voice_designreadGenerate a voice based on description prompts
volreadSpeech volume (0.1-10.0)
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (4 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (8)

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
README.md:107
|MINIMAX_API_HOST| https://api.minimaxi.chat (note the extra **"i"**) | https://api.minimax.chat |
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
README.zh-CN.md:97
|MINIMAX_API_HOST| https://api.minimaxi.chat (请注意额外的 **"i"** 字母) | https://api.minimax.chat |
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
README.md:11
<img alt="Homepage" src="https://img.shields.io/badge/_Homepage-MiniMax-FF4040?style=flat-square&labelColor=2C3E50&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIH
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
README.md:17
<img alt="Chat" src="https://img.shields.io/badge/_MiniMax_Chat-FF4040?style=flat-square&labelColor=2C3E50&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOn
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
README.zh-CN.md:11
<img alt="Homepage" src="https://img.shields.io/badge/_Homepage-MiniMax-FF4040?style=flat-square&labelColor=2C3E50&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIH
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
README.zh-CN.md:17
<img alt="Chat" src="https://img.shields.io/badge/_MiniMax_Chat-FF4040?style=flat-square&labelColor=2C3E50&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOn
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@chatmcp/sdk, @modelcontextprotocol/sdk, axios, cors, dotenv, express, zod, @types/cors
Why it matters. 13 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha 33c4da9aa322full audit observations/trust-audit/mcp-server/minimax-ai__minimax-1.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-0733c4da9aa322BLOCKD69first audit
06

Questions

What is the MiniMax MCP server?

Official MiniMax Model Context Protocol (MCP) JavaScript implementation that provides seamless integration with MiniMax's powerful AI capabilities including image generation, video generation, text-to-speech, and voice cloning APIs.

What tools does MiniMax expose?

36 in total: 36 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is MiniMax safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does MiniMax need?

No credential environment variables were found in its source, so it appears to need none.

How does MiniMax run?

It speaks sse and stdio, so it runs as a local process your client starts. It is published on npm as minimax-mcp-js at 0.0.18.

How current is this page?

The grade is for one exact copy of the source (33c4da9aa322), read on 2026-10-07. The repository is watched and re-audited when it changes.

Advertisement