Atlas / MCP servers / tenney95 / AI-Canvas-tauri

AI-Canvas-tauriBLOCK

mcp/tenney95/ai-canvas-tauri

Local-first AI canvas for visual workflows, AI short drama, image/video generation, storyboarding and asset management. ComfyUI, AI agents, MCP & Blender. 本地优先 AI 画布:AI短剧、AI资产管理、图像/视频生成、分镜制作与视频剪辑。

Verdict
BLOCK
Grade
F
Trust score
42 /100
Exposed tools
46 46r · 0w · 0d
Transport
stdio · streamable-http
License
NOASSERTION
Stars
208
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

⭐ 开源计划: 当本项目的 GitHub Stars 达到 10,000(10k) 时,项目自有代码将转用 [MIT License(MIT 许可证)](https://opensource.org/license/mit),允许自由使用、修改、分发和商用,须保留版权声明和许可文本。在此之前,仍以 LICENSE 中的当前许可条款为准。

简体中文 · English · 日本語 · 한국어

面向 AI短剧创作、AI资产管理、图像/视频生成与分镜制作 的本地优先 AI 多模态画布与可视化工作流桌面应用,集成 ComfyUI、对话 AI Agent 与 MCP,基于 Tauri 2 + React 19 + React Flow 12 构建。

AI Canvas Tauri 将文本、图像、视频、音频、逐帧动画、Markdown、分镜、360° 全景和手绘笔记组织成可连接的画布节点。你可以在同一个项目中编排生成链路、统一管理角色库、人物/场景/道具与本地素材、执行 ComfyUI 工作流、安装 JavaScript 或可信 Python 用户插件,也可以通过对话助手查询或修改画布、生成媒体、派出只读子智能体、读取授权文件并沉淀项目记忆。项目还能拆成剧集与分集,一部 AI短剧的每一集各占一张画布,角色库与素材整部剧共用。

在线体验: (首屏可直接试用,内置演示画布)

下载: (获取桌面安装包)

在线体验 · 下载 · 核心能力 · 快速开始 · 项目文档 · License

在线版适合体验画布与界面。用户插件、文件系统、凭据存储、独立窗口、3D 导演台、本地模型等能力依赖 Tauri 桌面环境;完整体验请按下方步骤启动桌面应用。

界面预览

资源库

统一浏览项目文件与全局资产,按类型、文件夹和标签筛选素材。

资产详情与提示词

全屏预览图片,查看与编辑提示词、参考图和标签,并查看图片尺寸、文件大小与来源。

帧动画编辑

逐帧预览与编辑动画,调整帧顺序、偏移、播放帧率和角色对齐。

核心能力

Read from source at commit 0d9c463b4d09OBSERVED · 2026-10-08
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add ai-canvas-tauri -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "ai-canvas-tauri": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (46)

46 read · 0 write · 0 destructive.

ToolRiskDescription
APIMartread一个 API 搞定一切——节省 30-70%
CC-MAX满血readClaude 稳定分组
CCC生图白嫖read该渠道无法限制分辨率,请以渠道实际输出为准
CCC生图稳定read自营 Adobe 图片渠道,支持 4K 传参
Exaread支持语义检索与网页摘要的搜索服务
GPT-Pro分组readGPT Pro 质量与稳定性分组
GPT-特价ProreadGPT Pro 特价分组
GRSAIread图像、视频与多模态文本模型服务
RunningHUB工作流read工作流模板:替换/风格迁移,结果更可控
RunningHUB模型read模型 API:文生图/图生图/图片编辑
RunningHubreadRunningHub 标准模型 API 与工作流
Sora2UreadSeedance 视频与图片模型
Stylereadcinematic
Tavilyread面向 AI Agent 的搜索与来源服务
canvas_queryread读取
overseas-short-drama-workflowread【海外短剧工作流】海外版短剧总控入口。 用于短剧选题、剧本评估和海外本地化。
两步链read
像素艺术read统一色板与像素质感
写实摄影read真实质感,光影自然
分镜师read依据剧本与项目人物场景资产产出结构化分镜表,供主任务落地为分镜节点。
分镜脚本read把剧本拆成分镜
剧本分析师read分析剧本结构、人物动机与节奏问题,输出按优先级排序的修改建议。
动漫风格read日系二次元绘画
动画专用read擅长二次元动画与运镜
即梦read官方 OAuth 登录,自动文生图/图生图/视频
可用read
台词润色师read润色台词口语度
国模-稳定2折readDeepSeek、GLM、Qwen、Hy3、MiMo 等国产模型
复古胶片read胶片颗粒与怀旧影调
扁平插画read简洁干净的矢量风
智谱联网搜索read智谱开放平台提供的 Web Search API
水墨画read水墨留白与写意笔触
水彩画read柔和通透的晕染
油画read厚重肌理与笔触
海外剧本优化read优化海外短剧剧本
火山方舟readArk Seedream 图像生成 API
电影质感read电影级调色与光影
短剧分镜read生成短剧分镜
短剧开场钩子read为短剧设计前三秒钩子
短剧总导演read短剧总导演
短剧总控read路由短剧创作任务
短剧节奏设计read用于短剧开场钩子与卡点设计
素描read黑白线条速写
自定义快捷指令read输入说明与提示词模板
自定义接口readOpenAI 兼容接口;非标准接口用模型的调用协议单独声明
赛博朋克read霓虹都市科技感
04

Trust audit

BLOCKgrade F · trust 42/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (7 observation(s))
Network
declared (6 observation(s))
Shell
declared (4 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94
src-tauri/resources/ai-canvas-mcp.mjs:14
atob( ... new Function(
Why it matters. decodes a payload and executes it
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src-tauri/src/plugins/runtime.rs:431
exec(compile(payload["source"], "<ai-canvas-plugin>", "exec"), namespace, namespace)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src-tauri/vendor/tauri/src/webview/mod.rs:1922
pub fn eval(&self, js: impl Into<String>) -> crate::Result<()> {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src-tauri/vendor/tauri/src/webview/webview_window.rs:2391
pub fn eval(&self, js: impl Into<String>) -> crate::Result<()> {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
src-tauri/src/agent/package.rs:1453
assert!(normalize_requested_relative_path("~/.ssh/id_rsa").is_err());
Why it matters. touches a credential store
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
src-tauri/src/plugins/host_effects.rs:737
"169.254.169.254",
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
MEDIUMInventory / provenance · inv.binary · CWE-1104
src-tauri/icons/icon.icns
icon.icns
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
src-tauri/resources/blender-runtime/v1/scripts/startup/bl_app_templates_user/ai_canvas_director/assets/characters/ai_canvas_female_white.blend
ai_canvas_female_white.blend
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
src-tauri/resources/blender-runtime/v1/scripts/startup/bl_app_templates_user/ai_canvas_director/assets/characters/ai_canvas_male_white.blend
ai_canvas_male_white.blend
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
src-tauri/resources/blender-runtime/v1/scripts/startup/bl_app_templates_user/ai_canvas_director/startup.blend
startup.blend
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
src-tauri/src/files/project_archive.rs:318
assert!(normalize_archive_path(Path::new("/etc/passwd")).is_err());
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
src-tauri/src/agent/provider_docs.rs:16
const CLOUDFLARE_DOH_ENDPOINT: &str = "https://1.1.1.1/dns-query";
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src-tauri/vendor/tauri/src/ipc/format_callback.rs:212
r#"{"test":"don\\🚀🐱👤\\'t forget to escape me!🚀🐱👤","te🚀🐱👤st2":"don't forget to escape me!","test3":"\\🚀🐱👤\\\\'''\\\\🚀🐱👤\\\\🚀🐱👤\\'''''"}"#.into()
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src-tauri/vendor/tauri/src/ipc/format_callback.rs:225
let result = r#"JSON.parse('{"test":"don\\\\🚀🐱👤\\\\\'t forget to escape me!🚀🐱👤","te🚀🐱👤st2":"don\'t forget to escape me!","test3":"\\\\🚀🐱👤\\\\\\\\\'\'\'\\\\\\\\🚀🐱👤\\\\\\\\🚀🐱👤\\\\\'\'\'\'\'"}')"#;
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src-tauri/vendor/tauri/src/ipc/format_callback.rs:296
r#"{"test":"don\\🚀🐱👤\\'t forget to escape me!🚀🐱👤","te🚀🐱👤st2":"don't forget to escape me!","test3":"\\🚀🐱👤\\\\'''\\\\🚀🐱👤\\\\🚀🐱👤\\'''''"}"#.into()
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src-tauri/vendor/tauri/src/ipc/format_callback.rs:309
let result = r#"JSON.parse('{"test":"don\\\\🚀🐱👤\\\\\'t forget to escape me!🚀🐱👤","te🚀🐱👤st2":"don\'t forget to escape me!","test3":"\\\\🚀🐱👤\\\\\\\\\'\'\'\\\\\\\\🚀🐱👤\\\\\\\\🚀🐱👤\\\\\'\'\'\'\'"}')"#;
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
src/components/AssetSearchWindow.tsx:1
/**
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/services/chat/providerConfigDraftService.test.ts:927
apiKey: 'must-not-enter-agent-input',
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/services/chat/providerConfigTools.test.ts:370
input: { ...previewInput(), apiKey: 'must-not-enter-agent-input' },
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/services/chat/providerConfigTools.test.ts:676
apiKey: 'existing-secret-value',
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/services/chat/providerConfigTools.test.ts:873
apiKey: 'existing-secret-value',
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/services/chat/providerConfigTools.test.ts:892
apiKey: 'existing-secret-value',
LOWInventory / provenance · inv.hidden_file · CWE-1104
.release-notes.md
.release-notes.md
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
site/.nojekyll
.nojekyll
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
src-tauri/vendor/tauri/.cargo_vcs_info.json
.cargo_vcs_info.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose

Gates applied: critical_finding, no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha 0d9c463b4d09full audit observations/trust-audit/mcp-server/tenney95__ai-canvas-tauri.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-080d9c463b4d09BLOCKF42first audit
06

Questions

What is the AI-Canvas-tauri MCP server?

Local-first AI canvas for visual workflows, AI short drama, image/video generation, storyboarding and asset management. ComfyUI, AI agents, MCP & Blender. 本地优先 AI 画布:AI短剧、AI资产管理、图像/视频生成、分镜制作与视频剪辑。

What tools does AI-Canvas-tauri expose?

46 in total: 46 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is AI-Canvas-tauri safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (42/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does AI-Canvas-tauri need?

No credential environment variables were found in its source, so it appears to need none.

How does AI-Canvas-tauri run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as ai-canvas-tauri at 0.10.2.

How current is this page?

The grade is for one exact copy of the source (0d9c463b4d09), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement