media-gen-mcp (wangdong233/media-gen-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 21 tools. No publisher has claimed this listing.

D
Caution
54/100

media-gen-mcp

Claude Code 的图像全家桶 MCP——AI 生图/视频 + 图像识别(OCR/表格/图表/VLM)+ 架构图/数据图/分享卡/二维码/公式/嵌套可下钻架构图,21 工具一个装好,纯免费。 | All-in-one image MCP for Claude Code — AI image/video gen + recognition (OCR/table/chart/VLM) + diagrams/charts/cards/QR/formula + nested drill-down architecture. 21 tools, free.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

wangdong233

Source: Glama · also listed on github_code, github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 9 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// tools this server exposes21 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

generate_image

Generate or edit an AI image (text-to-image 文生图/AI画图; or image-to-image 图生图 via `images`) using free models (Agnes AI default, or Zhipu). Output downloads locally and the path is returned; no local rendering libs needed. WHEN: subject is photographic or illustrated (写实图/插画/概念图/original logo artwork

create_video

Create an AI video (text-to-video / image-to-video / keyframe animation; 文生视频/图生视频/关键帧动画/让这张图动起来/做个动画) via free models (Agnes AI default, or Zhipu). Smart async: long videos return a handle to poll with `get_video`; short ones block until done. WHEN: user wants photorealistic or AI-generated video

get_video

Poll and optionally download a video task created by create_video (by videoId or taskId). Companion to create_video — use it after an async video returns a handle, or to check/retrieve any video task.

extract_text

Extract/recognize text from an image (OCR / 文字识别 / 文字提取 / 画像からの文字起こし) — verification codes, digits, license plates, printed Latin, or Chinese documents. Zero-config: tesseract runs in-process (WASM, bundled). Chinese accuracy is weak by default; configure a `paddleocr` provider for Chinese SOTA. The

extract_table

Recognize a table from an image → HTML/Markdown/JSON (表格识别/表格提取/tabla): invoices, receipts, financial statements, academic paper tables. Requires a `paddleocr` provider (PaddleX serving, Chinese SOTA); no pure-JS fallback (tesseract cannot parse table structure — a clear error is returned, not a sil

analyze_chart

Extract data points FROM an existing chart IMAGE (图表识别/图表数据提取/Chart OCR): reverse-engineer bar/line/pie/scatter charts into structured data series. Requires a `paddleocr` provider (PP-Chart2Table via useChartRecognition); if paddle is unconfigured, call `list_vision_capabilities` first to warn the u

describe_image

VLM image understanding — natural-language description or visual QA (图像描述/看图说话/VQA/describir imagen): handwritten text, complex layouts, scenes, formulas→LaTeX. Requires `paddleocr` provider (PaddleOCR-VL); M3+ adds `vlm` provider for enhanced VQA. Leave `question` empty for a default description.

list_models

List available AI image/video models and video constraints per provider (Agnes / Zhipu). Use to discover model names (e.g. cogview-4, agnes-video-v2.0) and allowed video frame counts before calling generate_image / create_video.

list_vision_capabilities

Introspect vision (image recognition) provider capabilities BEFORE calling extract_text/extract_table/analyze_chart/describe_image — shows which providers are configured, what each supports (tasks/languages/latency/accuracy), per-task caveats, and routing guidance. Use this to avoid runtime errors (

generate_diagram

Generate architecture / flowchart / sequence / class / ER / mindmap diagrams (架构图/流程图/时序图/类图/ER图/思维导图/示意图), rendered locally to vector SVG. The D2 and Graphviz engines are BUILT IN (WASM, bundled with this tool) — you do NOT need d2/dot/graphviz installed, do NOT run `which d2`/`which dot`, and do N

generate_interactive_diagram
generate_nested_diagram
generate_qrcode

Generate a QR code (二维码) as SVG or PNG from text/URL. Pure local rendering — no qrencode/zbar/system install, no AI, no network. Just call with the text/URL to encode. NEXT: embed into a `generate_card` poster via the `logo` prop, or rasterize larger via `render_svg`. Multilingual triggers: QRコード

generate_chart

Generate bar / line / pie / area / scatter charts and data visualizations (柱状图/折线图/饼图/散点图/数据可视化) from your data — Claude converts your numbers/CSV/data into a Vega-Lite spec internally; you just pass the data and chart type. Vega-Lite + vega are BUILT IN (bundled); no matplotlib / Python / graphviz

generate_formula

Render a math formula to vector SVG (数学公式/公式渲染/方程). Pass the formula as LaTeX (e.g. E=mc^2, \frac{a}{b}, \sum_{i=1}^n i^2) — even simple formulas qualify; the user need not say 'LaTeX'. MathJax is BUILT IN (bundled) — no KaTeX/system install, no font dependency; just call this tool. Prefer this over

generate_icon

Fetch and render a vector icon / logo / symbol / favicon (图标/logo/符号) from Iconify — 200k+ icons. Renders to SVG/PNG locally. Needs network (Iconify API); cached after first fetch. Browse at https://icon-sets.iconify.design. No AI. AVOID: original illustrated logo ARTWORK → use `generate_image` ins

generate_card

Generate a share card / OG image / quote card / poster / cover image (分享卡/分享图/封面图/海报/引言卡/金句卡/OG图; default 1200x630 PNG). The rendering engine is BUILT IN and runs entirely in-process — do NOT write HTML+CSS and screenshot it with headless Chrome/Puppeteer/Playwright, do NOT use Pillow/PIL/Python, an

render_svg

Render SVG source to high-quality PNG or SVG. Dual backend: resvg (92% filter fidelity, in-process) or Chrome (100% filter fidelity, needs system Chrome/Edge). AUTO-selects: SVG contains <filter>/<feGaussianBlur>/<feTurbulence> AND Chrome available → Chrome; else resvg. No AI; same input → same outp

render_video

Render HTML/CSS/GSAP animation to a deterministic MP4/GIF/WebM video. Input: HTML source (with CSS animations or GSAP timeline) + fps + duration. Engine: headless Chrome (seek-based frame capture, HyperFrames-style) + ffmpeg (frame stitching). No AI, deterministic (same input → same output). WHEN:

extract_pdf

Extract text from a PDF document (PDF识别/多页OCR/财务报表/发票/扫描件文字提取): supports both digital PDFs (with embedded text layer → instant text extraction) and scanned PDFs (rendered to images → OCR via configured vision provider). Smart async: long PDFs return a handle to poll with get_pdf; short ones block un

get_pdf

Poll and retrieve a PDF extraction task created by extract_pdf (by pdfId). Companion to extract_pdf — use it after an async PDF returns a handle, or to check progress of a long PDF extraction.

// known CVEs in dependencies9 high1 medium1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.17.4GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.17.4GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.17.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highvega@5.30.0GHSA-7f2v-3qq3-vvjf

Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable

high@xmldom/xmldom@0.9.0GHSA-2v35-w6hq-6mfw

xmldom: Uncontrolled recursion in XML serialization leads to DoS

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configMEDIA_GEN_CHECK_DISABLE
configMEDIA_GEN_CHECK_PROFILE
configMEDIA_GEN_NO_SIGNAL_HANDLERS
configMEDIA_PROVIDER
configOUT_DIR
// quality suggestions

Dependencies

19 dependencies, 1 flagged: puppeteer-core

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

21/21 tools missing one or more hints — generate_image (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_video (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_video (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +18 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 1/21 tools referenced in tests (5%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

6 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 4 high severity in production deps — @modelcontextprotocol/sdk@1.17.4 (high), @modelcontextprotocol/sdk@1.17.4 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

5 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/wangdong233/media-gen-mcp?variant=verified)](https://m8ven.ai/mcp/wangdong233/media-gen-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: cd1321c416e726454df3f7d3cb8e50b762994df7
code hash: 0e3347e5800c36c886dc06f6e7454e68a9b4f337e7a5e3109c071c18b4618c02
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client