GyazoSAFE
Official Model Context Protocol server for Gyazo
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol server for Gyazo image integration
This is a TypeScript-based MCP server that provides access to Gyazo images. It allows AI assistants to access and interact with Gyazo images through the Model Context Protocol, providing:
- Resources representing Gyazo images with URIs and metadata
- Tools for searching, fetching, and uploading images
- Image content and metadata access via the Gyazo API
Features
Resources
- List and access Gyazo images via
gyazo-mcp://URIs - Each image includes:
- Original image content
- Metadata (title, description, app, URL)
- OCR data (if available)
- Supports various image formats (JPEG, PNG, etc.)
Tools
gyazo_search- Full-text search for captures uploaded by users on Gyazo
- Search by keyword, title, app, URL, or date range
- Supports pagination for browsing multiple results
- Returns matching image URIs and metadata
gyazo_image- Fetch image content and metadata from Gyazo
- Retrieve specific images by ID or URL
- Returns both image content and detailed metadata
gyazo_latest_image- Fetch the most recent image from Gyazo
- Returns both image content and metadata
- Includes OCR text if available
gyazo_upload- Upload an image to Gyazo- Upload images with base64 encoded image data
- Add optional metadata like title, description, referer URL, and app name
- Returns the uploaded image's permalink URL and ID
Installation
NPM Package
The easiest way to install the Gyazo MCP server is via npm:
npm install -g @notainc/gyazo-mcp-server
Prerequisites
- Create a Gyazo account if you don't have one: https://gyazo.com
- Get your Gyazo API access token from: https://gyazo.com/api
- Click "Register applications" button
- Click "New Application" button
- Fill in the form with your app name and description
- Name and Callback URL are required
- You can use
http://localhostfor the Callback URL - C
eed1fc21d587OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add gyazo-mcp-server --env GYAZO_ACCESS_TOKEN=${GYAZO_ACCESS_TOKEN} -- npx -y @notainc/[email protected]{
"mcpServers": {
"gyazo-mcp-server": {
"command": "npx",
"args": [
"-y",
"@notainc/[email protected]"
],
"env": {
"GYAZO_ACCESS_TOKEN": "${GYAZO_ACCESS_TOKEN}"
}
}
}
}Exposed tools (4)
3 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
gyazo_image | read | Fetch image content and metadata from Gyazo |
gyazo_latest_image | read | Fetch latest uploaded image content and metadata from Gyazo |
gyazo_search | read | Full-text search for captures uploaded by users on Gyazo |
gyazo_upload | write | Upload an image to Gyazo |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
dotenv, sharp, @types/node, mcp-proxy, typescript
Gates applied: no_behavioural_pass.
eed1fc21d587full audit observations/trust-audit/mcp-server/nota__gyazo-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | eed1fc21d587 | SAFE | B | 89 | first audit |
Questions
What is the Gyazo MCP server?
Official Model Context Protocol server for Gyazo
What tools does Gyazo expose?
4 in total: 3 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Gyazo safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Gyazo need?
It reads GYAZO_ACCESS_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Gyazo run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @notainc/gyazo-mcp-server at 0.2.0.
How current is this page?
The grade is for one exact copy of the source (eed1fc21d587), read on 2026-10-08. The repository is watched and re-audited when it changes.