glyphs-mini-mcp

Item: glyphs-mini-mcp
Rating: 37
Author: M8ven

Enables an AI agent to build and edit fonts for Glyphs Mini by manipulating .glyphs files on disk, with a built-in rendering feedback loop for visual inspection.

→ PetriLahdelma/glyphs-mini-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tool annotations don’t match behaviour

1 read-only tool performs write/delete/exec — glyphs_open_in_mini (line 502: proc = subprocess.run(["open", "-a", "Glyphs Mini", _STATE["path"]], capture_output=True, text=True))

⚠️

Tool descriptions don’t match what handlers do

2 tools describe read intent but their handlers mutate — glyphs_render_specimen (line 475: proc = subprocess.run([sys.executable, "-m", "fontmake", "-g", _STATE["path"], "-o", "ttf",); glyphs_open_in_mini (line 502: proc = subprocess.run(["open", "-a", "Glyphs Mini", _STATE["path"]], capture_output=True, text=True))

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/petrilahdelma-glyphs-mini-mcp-1o71w3)](https://m8ven.ai/mcp/petrilahdelma-glyphs-mini-mcp-1o71w3)

commit: 8e87a7185a6368e176e6586949899a1a409dc8d4

code hash: 23b09366f3f31a4f7ab312917effd2a0c0f55f47e9d25db87dfea6b4448a721a

verified: 7/27/2026, 10:22:23 AM

view raw JSON →