gbs-toolkit/mcp-server

MCP server for structured GB Studio 4.x project editing, enabling read/patch scripts, scenes, actors, triggers, variables; build ROMs; and sprite generation.

→ gbs-toolkit/mcp-server · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: REPLICATE_API_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

⚠️

Tool descriptions don’t match what handlers do

1 tool describes read intent but its handler mutates — build_rom (line 105: fs.mkdir(ctx.config.romOutputDir, { recursive: true }))

⚠️

Known vulnerabilities in dependencies: 2 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 5 credentials: FAL_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, OPENAI_API_KEY, REPLICATE_API_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretFAL_KEY— conditional — Required for fal provider

configFAL_LORA_PATH

configFAL_MODEL

configGBS_CLI_PATH— no probes common install locations Absolute path to gb-studio-cli.js

configGBS_LOG_PATH— no <root>/build/compile.log Captured compile log

configGBS_MGBA_RUNNER— no none Path to a libmgba-linked runner binary used by run_emulator (build it from native/build.sh)

configGBS_PROJECT_ROOT— "": "./gbsproj/demo"

configGBS_ROM_OUT— no <root>/build Output directory for build_rom

configGBS_SCREENSHOT_DIR— no <root>/build/screenshots Where run_emulator drops PNGs

🔐 secretGEMINI_API_KEY— conditional — Required for gemini provider

🔐 secretGOOGLE_API_KEY

🔐 secretOPENAI_API_KEY— conditional — Required if SPRITE_PROVIDER=openai and generate_sprite is used

🔐 secretREPLICATE_API_TOKEN— conditional — Required for replicate provider

configREPLICATE_MODEL

configSPRITE_PROVIDER— no openai openai / gemini / replicate / fal

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/gbs-toolkit-mcp-server-12es0l)](https://m8ven.ai/mcp/gbs-toolkit-mcp-server-12es0l)

commit: 8ebd20df110137ba2b471e25aa4193329f26002d

code hash: a10d297c3917d2156231016178fc35854dbfdf356cebfa30aa7a6475281e9132

verified: 5/29/2026, 10:24:37 AM

view raw JSON →