slideless-mcp
MCP server that wraps the Slideless HTTP API as tools for listing, sharing, uploading, and managing HTML presentations from any MCP host without installing the CLI.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
slideless-ai
Source: Glama · also listed on Official
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
slideless_invite_collaboratorSends an invitation email granting another user dev (edit) access to a presentation. This actually sends real email. If the invitee already has a Slideless account the access is granted immediately; otherwise it lands as pending and is claimed on signup.
slideless_uninvite_collaboratorRevokes a collaborator's access to a presentation. The collaborator loses dev (edit) access immediately and can no longer view past versions through their account. Cannot be undone — re-inviting is a new invitation.
slideless_list_collaboratorsLists every collaborator on a presentation: pending, active, and revoked. Returns email, role, status, and timestamps.
slideless_whoamiReturns the identity associated with the connected API key: organization, key name, scopes, and timestamps. Useful as a sanity check that the connector is configured correctly.
slideless_search_marketplaceSearches the public Slideless marketplace for remixable presentations, apps, and plans. Public — works without an API key. Returns listings with slug, title, kind, interactive flag, tags, and popularity counts. Use the returned `slug` with slideless_remix_listing to copy a listing.
slideless_get_marketplace_listingFetches full detail for a single marketplace listing by slug: description, README, tags, entry path, file count, and popularity stats. Public — works without an API key.
slideless_remix_listingRemixes a public marketplace listing: returns the listing manifest plus the inline contents of every text file (HTML/CSS/JS/SVG/JSON/etc.) up to 256 KB each — ideal for copying a deck into chat to customize. Binary or oversized files are listed as metadata only. Public — works without an API key. Th…
slideless_publish_listingPublishes an existing pushed presentation to the public Slideless marketplace as a `presentation`, `app`, or `plan`. Requires an API key with the `marketplace:publish` scope. The `kind` is fixed at publish time and cannot be changed afterward.
slideless_star_listingStars a marketplace listing on behalf of the connected user, bumping its star count. Requires an API key.
slideless_unstar_listingRemoves the connected user's star from a marketplace listing. Requires an API key.
slideless_list_presentationsLists all Slideless presentations the user owns or has been invited to collaborate on. Returns titles, share URLs, view counts, and the user's role per deck.
slideless_get_presentationFetches full info for a single presentation: tokens, collaborators, version count, view stats, and the primary share URL.
slideless_list_versionsLists every version of a presentation in chronological order. Each version is immutable; uploads append a new version.
slideless_get_versionFetches the manifest for a specific version of a presentation: title, entry path, and the list of files (path, sha256, size, contentType).
slideless_download_versionDownloads a specific version of a presentation. Returns the manifest plus the inline contents of every text file (HTML/CSS/JS/SVG/JSON/etc.) up to 256 KB each — ideal for reading or modifying a deck's HTML in chat. Binary or oversized files are listed as metadata only.
slideless_delete_presentationPermanently deletes a presentation, including every version and every share token. Cannot be undone. Only the owner can delete.
slideless_add_share_tokenMints a new public share token for a presentation and returns the share URL. Each token can be revoked independently. Optionally pin the token to a specific version.
slideless_set_token_version_modePins or unpins an existing share token to a specific version. Use {type:'pinned',version:N} to freeze recipients, or {type:'latest'} to make the token follow future uploads.
slideless_unshare_presentationRevokes share tokens. Pass `tokenId` to revoke a single token; omit it to revoke every active token on the presentation. Anyone holding a revoked link will lose access immediately.
slideless_share_via_emailSends an invitation email to one or more recipients with a viewer link to the presentation. This actually sends real email — it does not draft. Each recipient receives a separate email with the share URL embedded.
slideless_upload_html_presentationUploads a single-file HTML presentation to Slideless. Pass the full HTML as a string. Pass `presentationId` to add a new version to an existing deck; omit it to create a new deck. Returns the presentationId and version. To get a shareable URL, call `slideless_add_share_token` after this.
slideless_upload_presentation_filesUploads a multi-file HTML presentation (HTML + CSS + JS + images, etc.). Each file's content is base64-encoded. Total payload should stay under ~1 MB; for larger decks use the slideless CLI. Pass `presentationId` to add a new version to an existing deck. Returns the presentationId and version. Call …
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Next.js is vulnerable to RCE in React flight protocol
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
SLIDELESS_API_BASE_URLTool annotations
15/22 tools have annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
22/22 tools missing one or more hints — slideless_invite_collaborator (missing: readOnlyHint, destructiveHint, idempotentHint); slideless_uninvite_collaborator (missing: readOnlyHint, idempotentHint, openWorldHint); slideless_list_collaborators (missing: destructiveHint, idempotentHint, openWorldHint), +19 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
20/22 tool handlers declare input schemas (91%)
Declare an inputSchema with zod/joi/yup on every tool definition.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
1 critical, 11 high severity in production deps — next@15.5.0 (critical), next@15.5.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/slideless-ai/mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check