Nano BananaSAFE
AI image generation MCP server powered by Google Gemini, with smart model selection and 4K output
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A production-ready Model Context Protocol (MCP) server that provides AI-powered image generation capabilities through Google's Gemini models with intelligent model selection.
⭐ NEW: Nano Banana 2 — Gemini 3.1 Flash Image! 🍌🚀
Nano Banana 2 (gemini-3.1-flash-image-preview) is now the default model — delivering Pro-level quality at Flash speed:
- 🍌 Flash Speed + 4K Quality: Up to 3840px at Gemini 2.5 Flash latency
- 🌐 Google Search Grounding: Real-world knowledge for factually accurate images
- 🎯 Subject Consistency: Up to 5 characters and 14 objects per scene
- ✍️ Precision Text Rendering: Crystal-clear text placement in images
- 🏆 Gemini 3 Pro Image still available for maximum reasoning depth
✨ Features
- 🎨 Multi-Model AI Image Generation: Three Gemini models with intelligent automatic selection
- 🍌 Gemini 3.1 Flash Image (NB2): Default model — 4K resolution at Flash speed with grounding
- 🏆 Gemini 3 Pro Image: Maximum reasoning depth for the most complex compositions
- ⚡ Gemini 2.5 Flash Image: Legacy Flash model for high-volume rapid prototyping
- 🤖 Smart Model Selection: Automatically routes to NB2 or Pro based on your prompt
- 📐 Aspect Ratio Control ⭐ NEW: Specify output dimensions (1:1, 16:9, 9:16, 21:9, and more)
- 📋 Smart Templates: Pre-built prompt templates for photography, design, and editing
- 📁 File Management: Upload and manage files via Gemini Files API
- 🔍 Resource Discovery: Browse templates and file metadata through MCP resources
- 🛡️ Production Ready: Comprehensive error handling, logging, and validation
- ⚡ High Performance: Optimized architecture with intelligent caching
🚀 Quick Start
Prerequisi
9ed2d354c189OBSERVED · 2026-10-01Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add nanobanana-mcp-server -- None nanobanana-mcp-server==0.2.0
Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
show_output_stats | read |
Trust audit
SAFEgrade B · trust 87/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (15)
extra_info += f" • 👨👩👧 Parent: {meta.get('parent_file_id')}"image_hash = hashlib.md5(image_bytes).hexdigest()[:8]
image_hash = hashlib.md5(image_bytes).hexdigest()[:8]
image_hash = hashlib.md5(
image_hash = hashlib.md5(image_bytes, usedforsecurity=False).hexdigest()[:8]
secret = tmp_path / "id_rsa.txt"
base64.b64decode(image_b64, validate=True)
raw_data = base64.b64decode(b64)
thumbnail_bytes = base64.b64decode(thumbnail_b64)
optimized_bytes = base64.b64decode(optimized_b64)
thumbnail_bytes = base64.b64decode(thumbnail_b64)
"""Load configuration from environment variables."""
# Load local .env if present
curl -LsSf https://astral.sh/uv/install.sh | sh
curl -LsSf https://astral.sh/uv/install.sh | sh
Gates applied: no_behavioural_pass.
9ed2d354c189full audit observations/trust-audit/mcp-server/zhongweili__nano-banana.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-01 | 9ed2d354c189 | SAFE | B | 87 | first audit |
Questions
What is the Nano Banana MCP server?
AI image generation MCP server powered by Google Gemini, with smart model selection and 4K output
What tools does Nano Banana expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Nano Banana safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (87/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Nano Banana need?
It reads GEMINI_API_KEY, GOOGLE_API_KEY and NANOBANANA_AUTH_METHOD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Nano Banana run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as nanobanana-mcp-server.
How current is this page?
The grade is for one exact copy of the source (9ed2d354c189), read on 2026-10-01. The repository is watched and re-audited when it changes.