Back to MCP Trust Indexm8ven
47
/ 100
1 month ago
glama

prompt-to-asset

Routes one brief to the right image model across 60+ (gpt-image-1.5, Ideogram 3, Recraft V4, Flux), validates the output, and fans out to iOS/Android/PWA/favicon/visionOS/Flutter bundles. Works without an API key via Pollinations, HF Inference, Stable Horde, or host-LLM inline SVG.

→ MohamedAbdallah-14/prompt-to-asset· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
2 flows detected: PROMPT_TO_BUNDLE_MODAL_COMFYUI_TOKEN, PROMPT_TO_BUNDLE_MODAL_LORA_TRAIN_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 25 credentials: BFL_API_KEY, CLOUDFLARE_API_TOKEN, FAL_API_KEY, FAL_KEY, FREEPIK_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, HF_TOKEN, HORDE_API_KEY, HUGGINGFACE_API_KEY, IDEOGRAM_API_KEY, LEONARDO_API_KEY, NIM_API_KEY, NVIDIA_API_KEY, OPENAI_API_KEY, PIXAZO_API_KEY, PIXAZO_SUBSCRIPTION_KEY, POLLINATIONS_TOKEN, PROMPT_TO_BUNDLE_MODAL_COMFYUI_TOKEN, PROMPT_TO_BUNDLE_MODAL_LORA_TRAIN_TOKEN, RECRAFT_API_KEY, REPLICATE_API_KEY, REPLICATE_API_TOKEN, STABILITY_API_KEY, TOGETHER_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretBFL_API_KEY
configCLOUDFLARE_ACCOUNT_ID
🔐 secretCLOUDFLARE_API_TOKEN
🔐 secretFAL_API_KEY
🔐 secretFAL_KEY
🔐 secretFREEPIK_API_KEY
🔐 secretGEMINI_API_KEY
🔐 secretGOOGLE_API_KEY
🔐 secretHF_TOKEN
🔐 secretHORDE_API_KEY
configHORDE_DISABLED
🔐 secretHUGGINGFACE_API_KEY
🔐 secretIDEOGRAM_API_KEY
configINTEGRATION
🔐 secretLEONARDO_API_KEY
🔐 secretNIM_API_KEY
🔐 secretNVIDIA_API_KEY
🔐 secretOPENAI_API_KEY
configP2A_ALLOWED_PATHS
configP2A_DATA_VERBOSE
configP2A_DISABLE_TMPDIR_ACCESS
configP2A_MAX_SPEND_USD_PER_RUN— Cost guardrail. Set =5.00 to cap any single tool call. Pre-flight estimate refuses to call if over. Free-tier routes are always $0.
🔐 secretPIXAZO_API_KEY
🔐 secretPIXAZO_SUBSCRIPTION_KEY
configPOLLINATIONS_DISABLED
🔐 secretPOLLINATIONS_TOKEN
configPROMPT_TO_ASSET_SECRETS_PATH
configPROMPT_TO_BUNDLE_CACHE_DIR
configPROMPT_TO_BUNDLE_DRY_RUN
configPROMPT_TO_BUNDLE_HTTP_PORT
🔐 secretPROMPT_TO_BUNDLE_MODAL_COMFYUI_TOKEN
configPROMPT_TO_BUNDLE_MODAL_COMFYUI_URL
🔐 secretPROMPT_TO_BUNDLE_MODAL_LORA_TRAIN_TOKEN
configPROMPT_TO_BUNDLE_MODAL_LORA_TRAIN_URL— asset_train_brand_lora Wrap a user-owned LoRA training endpoint (). Path-guarded; validates inputs.
configPROMPT_TO_BUNDLE_OG_FONT
configPROMPT_TO_BUNDLE_OUTPUT_DIR
configPROMPT_TO_BUNDLE_RECRAFT_VECTORIZE_URL
configPROMPT_TO_BUNDLE_RMBG_URL
configPROMPT_TO_BUNDLE_TRANSPORT
configPROMPT_TO_BUNDLE_UPSCALER_URL
configPROMPT_TO_BUNDLE_VLM_URL— asset_validate Tier-0 (dims, alpha, checkerboard FFT, safe-zone bbox, ΔE2000 palette, WCAG contrast, OCR Levenshtein). Tier-2 VLM-as-judge via .
configPROMPT_TO_BUNDLE_VQA_URL
🔐 secretRECRAFT_API_KEY
🔐 secretREPLICATE_API_KEY
🔐 secretREPLICATE_API_TOKEN
🔐 secretSTABILITY_API_KEY
🔐 secretTOGETHER_API_KEY
configXDG_CONFIG_HOME
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 0 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/mohamedabdallah-14-prompt-to-asset-xg3ic1)](https://m8ven.ai/mcp/mohamedabdallah-14-prompt-to-asset-xg3ic1)
commit: b791ea4838f60d29d8b79d6137285d011933e179
code hash: 001cec8f0245cdc7ef057ff65a3bc9c42a38be34856076dd241d6c8f138fe74b
verified: 6/11/2026, 11:20:07 AM
view raw JSON →