Image GeneratorSAFE
MCP server for AI image generation and editing with automatic prompt optimization and quality presets. Supports Nano Banana (Gemini), OpenAI GPT Image, and BytePlus Seedream.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Generate and edit images from Codex, Cursor, Claude Code, or any MCP client. mcp-image adds visual direction to your request before sending it to Gemini, OpenAI, or BytePlus Seedream.
[](https://www.npmjs.com/package/mcp-image) [](https://www.npmjs.com/package/mcp-image) [](https://opensource.org/licenses/MIT)
Tell it what image to create or what to change in an existing image, and what it is for. The result is saved to disk and returned to your assistant.
What It Does
Before generating an image, mcp-image rewrites short requests into more specific prompts. It keeps what you asked for and fills in details such as composition, lighting, and camera angle. The more detail you provide, the less it changes.
You ask:
"A photo of a roast chicken dinner for a recipe site. It should look like it was actually cooked, and it should be partway through being carved so you can tell how juicy it is."
mcp-image sends to the image model:
"... a beautifully roasted whole chicken, golden-brown and glistening, resting on a rustic wooden cutting board. One leg is partially carved, revealing tender, succulent white meat and rich, glistening juices pooling around the carving knife ... shallow depth of field focused on the carved chicken."
Generated with Gemini using the default `fast` quality preset.
What carried through:
for a recipe site: one clear subject, with everything else kept subordinateactually cooked: uneven browning and juices across the boardpartway through being carved: the cut face and slices beside ithow juicy it is: close framing and shallow depth of field around the cut
Compare the same request with
9f29f7e348f8OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-image --env GEMINI_API_KEY=${GEMINI_API_KEY} --env OPENAI_API_KEY=${OPENAI_API_KEY} --env ARK_API_KEY=${ARK_API_KEY} -- npx -y [email protected]Exposed tools (1)
0 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
generate_image | write | Generate a new image from a text prompt or edit an existing image using inputImagePath. Saves the result and returns a file resource. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (9)
const secret = 'sk-proj-ABCDEF123456789'
logger.info('config', `Starting service with ${name}=${secret}`)const inputPath = './output/../../../root/.ssh/id_rsa'
import { errorWithCode } from '../../tests/helpers/inspect'import type { Config } from '../../utils/config'import { GeminiAPIError, NetworkError } from '../../utils/errors'import type { Config } from '../../utils/config'import { GeminiAPIError, NetworkError } from '../../utils/errors'@google/genai, @modelcontextprotocol/sdk, openai, @biomejs/biome, @types/node, dpdm, husky, knip
Gates applied: no_behavioural_pass.
9f29f7e348f8full audit observations/trust-audit/mcp-server/shinpr__image-generator-4.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 9f29f7e348f8 | SAFE | B | 89 | first audit |
Questions
What is the Image Generator MCP server?
MCP server for AI image generation and editing with automatic prompt optimization and quality presets. Supports Nano Banana (Gemini), OpenAI GPT Image, and BytePlus Seedream.
What tools does Image Generator expose?
1 in total: 0 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Image Generator safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Image Generator need?
It reads ARK_API_KEY, GEMINI_API_KEY and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Image Generator run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-image at 0.15.0.
How current is this page?
The grade is for one exact copy of the source (9f29f7e348f8), read on 2026-10-07. The repository is watched and re-audited when it changes.