Transloadit JavaScript/TypeScript SDKsCAUTION
Transloadit's official Node.js SDK
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/transloadit/node-sdk/actions/workflows/ci.yml) [](https://codecov.io/gh/transloadit/node-sdk)
Monorepo for Transloadit SDKs, shared packages, and the MCP server.
[](https://glama.ai/mcp/servers/transloadit/node-sdk)
Packages
@transloadit/viewer— Published alpha for responsive images from Storage and Smart CDN
Templates. See the Viewer guide.
@transloadit/node— Node.js SDK + CLI. Seepackages/node/README.md.transloadit— Stable unscoped package (built from@transloadit/node).@transloadit/mcp-server— MCP server (Streamable HTTP + stdio). Seepackages/mcp-server/README.md.@transloadit/types— Shared TypeScript types.@transloadit/utils— Shared utilities.@transloadit/zod— Zod schemas for Transloadit APIs.
Quick start
Node SDK
import { Transloadit } from '@transloadit/node'
const client = new Transloadit({
authKey: process.env.TRANSLOADIT_KEY as string,
authSecret: process.env.TRANSLOADIT_SECRET as string,
})
const result = await client.createAssembly({
params: {
steps: {
':original': { robot: '/upload/handle' },
636cd031a0e9OBSERVED · 2026-10-13Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server --env TRANSLOADIT_SECRET=${TRANSLOADIT_SECRET} -- npx -y @transloadit/[email protected] stdioExposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
custom_echo | read |
Trust audit
CAUTIONgrade D · trust 64/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
.claude/skills
.codex/skills
.cursor/rules/coding-style.mdc
.cursor/rules/general.mdc
.cursor/rules/playwright.mdc
urlParams: { token: 'never-log-query-token' },const SECRET = 'test-secret-0123456789abcdef0123456789abcdef'
.yarnrc.yml
const hash = createHash('md5')const checksum = createHash('md5')const actualMd5 = crypto.createHash('md5').update(downloadedBuffer).digest('hex')const md5hash = createHash('md5').update(bytes).digest('hex')const md5hash = createHash('md5').update(bytes).digest('hex')const repoRoot = resolve(import.meta.dirname, '../../..')
await readFile(new URL('../../utils/package.json', import.meta.url), 'utf8'),import packageJson from '../../package.json' with { type: 'json' }import { createTransloaditMcpHttpHandler } from '../../src/index.ts'import { lintAssemblyInstructions } from '../../../node/src/lintAssemblyInstructions.ts'"baseUrl": "http://127.0.0.1:3020/file/{workspace}",baseUrl: 'http://127.0.0.1:32189/file/{workspace}',expect(html).toContain('http://127.0.0.1:32189/file/catalog-app/')baseUrl: 'http://127.0.0.1:32189/file/{workspace}',baseUrl: 'http://127.0.0.1:32189/file/{workspace}',? atob(hash)
const binary = atob(padded)
Gates applied: no_behavioural_pass.
636cd031a0e9full audit observations/trust-audit/mcp-server/transloadit__node-sdk.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | 636cd031a0e9 | CAUTION | D | 64 | first audit |
Questions
What is the @transloadit/mcp-server MCP server?
Transloadit's official Node.js SDK
What tools does @transloadit/mcp-server expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @transloadit/mcp-server safe to connect to an agent?
With care. The audit graded it D (64/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does @transloadit/mcp-server need?
It reads TRANSLOADIT_ASSEMBLY_KEY, TRANSLOADIT_ASSEMBLY_SECRET, TRANSLOADIT_CREDENTIALS_FILE, TRANSLOADIT_KEY, TRANSLOADIT_MCP_METRICS_PASSWORD, TRANSLOADIT_MCP_TOKEN, TRANSLOADIT_MCP_UPSTREAM_SECRET, TRANSLOADIT_SECRET, TRANSLOADIT_SMART_CDN_KEY and TRANSLOADIT_SMART_CDN_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @transloadit/mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as transloadit-img-next-fixture at 0.5.0.
How current is this page?
The grade is for one exact copy of the source (636cd031a0e9), read on 2026-10-13. The repository is watched and re-audited when it changes.