io.github.antonkarliner/truepane
NPM · TRUEPANE-MCP · SCANNED OCT 1
Local MCP server generating complete App Store & Google Play screenshot sets.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 104 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (AGPL-3.0-only).Pass
- Actively maintained (last published 56 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability70
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3187 tokens (~167/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 96% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.antonkarliner/truepane MCP server?
io.github.antonkarliner/truepane runs locally as an npm package, launched with npx -y truepane-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · truepane-mcp
claude mcp add antonkarliner-truepane -- npx -y truepane-mcp
{
"mcpServers": {
"antonkarliner-truepane": {
"command": "npx",
"args": [
"-y",
"truepane-mcp"
]
}
}
} {
"servers": {
"antonkarliner-truepane": {
"command": "npx",
"args": [
"-y",
"truepane-mcp"
]
}
}
} codex mcp add antonkarliner-truepane -- npx -y truepane-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"antonkarliner-truepane": {
"type": "local",
"command": [
"npx",
"-y",
"truepane-mcp"
],
"enabled": true
}
}
} openclaw mcp add antonkarliner-truepane --command npx --arg -y --arg truepane-mcp
mcp_servers:
antonkarliner-truepane:
command: "npx"
args: ["-y", "truepane-mcp"] {
"McpServers": {
"antonkarliner-truepane": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"truepane-mcp"
]
}
}
} assistant mcp add antonkarliner-truepane -t stdio -c npx -a -y truepane-mcp
{
"mcpServers": {
"antonkarliner-truepane": {
"command": "npx",
"args": [
"-y",
"truepane-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 30 Sept 26 +1
- Security disclosure: unverified → fail ▼ functional
- 29 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
- 28 Sept 26 −2
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Sept 26 0
- Stability: 0.97 → pass security
- 26 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Sept 26 +1
- Security disclosure: fail → unverified ▼ functional
- 22 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 1 Oct 2026 · Analysed npm/truepane-mcp@0.2.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 104 packages
| Packages resolved | 104 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
apply_brand_kit Apply a brand kit file ~111
Apply typography, text colors, background, and default composition from a local .truepane-brand.json file. Targets, slides, screenshots, translations, and release data are preserved. Per-slide overrides are preserved by default.
| Name | Type | Req | Description |
|---|---|---|---|
| clear_slide_overrides | boolean | – | Before applying, clear every slide-specific background, text-color, and composition override so all slides inherit the kit |
| path | string | yes | Absolute path to a .truepane-brand.json file |
| project_id | string | yes | Project id |
No output schema declared.
No examples provided.
compare_release Compare with release baseline ~51
Compare deterministic slide/output/locale signatures with the explicit saved release baseline. Returns added, changed, unchanged, and removed assets without rendering PNGs or changing the baseline.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project id |
No output schema declared.
No examples provided.
create_project Create a screenshot project ~243
Create a named in-memory project from slide texts and local screenshot files. Platforms: "ios" (App Store · 6.9″ iPhone, 1320x2868px), "ipad" (App Store · 13″ iPad, 2064x2752px), "android" (Play Store · Pixel portrait, 1080x2400px), "android-tablet" (Play Store · 10″ tablet, 1600x2560px). Screenshots are read from absolute local paths (PNG/JPEG/WebP), ideally raw device/simulator captures matching the device screen aspect; they are scaled to fill the device screen and center-cropped. Slides without a screenshot render a placeholder. After creating, style with set_style, then call render.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | Project id (slug). Auto-generated if omitted. |
| platform | string | – | Device frame. One of: ios, ipad, android, android-tablet. Default "ios". |
| slides | array | yes | Slides in order (1-8 typical) |
| targets | array | – | Platform targets included in the project. The first is active. |
No output schema declared.
No examples provided.
export_brand_kit Export a brand kit file ~73
Write this project's current typography, colors, background, custom font, and default composition to a portable brand kit file.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Brand kit display name |
| path | string | yes | Absolute output path, conventionally ending .truepane-brand.json |
| project_id | string | yes | Project id |
No output schema declared.
No examples provided.
export_project Save project JSON ~86
Write the project as JSON to an absolute path. The file is the exact format the Truepane web app's Import Project accepts (screenshots embedded as data URLs), so a human can open and fine-tune it later.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | Absolute output path, e.g. /tmp/my-app/truepane-project.json |
| project_id | string | yes | Project id |
No output schema declared.
No examples provided.
import_screenshots Preview or apply a screenshot folder ~118
Deterministically map a local screenshot directory to target/locale/slide slots. Defaults to a read-only dry run. Files named target/locale/NN-name.png map explicitly; otherwise known dimensions and filename tokens are used. Conflicts are reported and never overwritten.
| Name | Type | Req | Description |
|---|---|---|---|
| apply | boolean | – | Must be true to apply non-conflicting mappings |
| directory | string | yes | Absolute directory containing PNG/JPEG/WebP screenshots |
| dry_run | boolean | – | Preview only (default true) |
| project_id | string | yes | Project id |
No output schema declared.
No examples provided.
list_options List capabilities and style options ~59
Start here. Lists Truepane's complete agent workflow and every valid platform, output, font, background, and composition option, including bulk import, multi-target sets, linked devices, preflight, brand kits, custom outputs, and changed-only release exports.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
load_project Load project JSON ~89
Load a Truepane project JSON file (from export_project or the web app's Export Project) into memory as a new project. Returns the project id and a summary. Screenshots embedded in the file are restored.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | Project id to assign (auto-generated if omitted; replaces any existing project with this id) |
| path | string | yes | Absolute path to the project JSON file |
No output schema declared.
No examples provided.
render Render PNGs to disk ~452
Render the project to PNG files at full store resolution (e.g. ios = 1320x2868) and return the absolute output paths plus a small inline preview image of the first slide (or the strip) so you can inspect the result. what: "slides" writes slide-01.png, slide-02.png, …; "strip" writes strip.png (all slides side by side — backgrounds flow continuously across it); "both" writes both. Pass scale (e.g. 0.25) for smaller draft output. language: omit for the base text; a language code (e.g. "es") renders that translation (blank/missing fields fall back to base text); "all" writes per-language subfolders of output_dir — source/ plus one per settings.languages code, same layout as the web app's all-languages ZIP (add languages with set_translations first). Each language renders in its own font override when set (see set_translations font / set_style language), else the global font. Fonts are fetched/registered automatically before rendering. Iterate: render → look at preview → set_style → render again.
| Name | Type | Req | Description |
|---|---|---|---|
| changed_only | boolean | – | Write only added/changed assets compared with the explicit release baseline |
| language | string | – | Omit = base text; a language code = that translation; "all" = per-language subfolders |
| output_dir | string | yes | Absolute directory for the PNGs (created if missing) |
| output_frame | string | – | Device frame for feature/custom output |
| output_height | number | – | Custom height in whole pixels; required with output_width for custom output (320..8192) |
| output_id | string | – | Temporary output override for this render |
| output_width | number | – | Custom width in whole pixels; required with output_height for custom output (320..8192) |
| project_id | string | yes | Project id |
| scale | number | – | Downscale factor for draft output (default 1 = full store resolution) |
| target | – | – | Platform target. Omit = active target; "all" = every settings.targets target. |
| what | string | – | What to render. Default "slides". |
No output schema declared.
No examples provided.
set_background_image Set or clear the background image ~255
Put a custom image behind the slides. The image is read from an absolute local path, downscaled and re-encoded server-side, so an agent cannot write an oversized payload. span "slide" fits one slide; span "strip" fits the whole strip (slide width x slide count) and slices it by slide, which is how one long backdrop flows continuously across the export. Without slide_index the image applies to every slide; with slide_index it becomes that slide's override. Pass clear:true to remove it. Tune opacity, scrim, fit, and scrimColor afterwards with set_style background.image; for a backdrop derived from the slide's own screenshot use set_style background.image.useScreenshotBlur instead of this tool — it costs no storage.
| Name | Type | Req | Description |
|---|---|---|---|
| clear | boolean | – | Remove the background image instead of setting one |
| image_path | string | – | Absolute path to a PNG/JPEG/WebP image. Required unless clear:true. |
| project_id | string | yes | Project id |
| slide_index | integer | – | If set, apply to this slide only instead of every slide |
| span | string | – | "slide" (default) fits one slide; "strip" spreads one image across the whole strip |
No output schema declared.
No examples provided.
set_output Set output canvas ~125
Choose a native store screenshot, the 1024x500 Google Play feature graphic, or bounded custom dimensions. The device frame remains procedural and is never stretched.
| Name | Type | Req | Description |
|---|---|---|---|
| frame | string | – | Device frame/source target |
| height | number | – | Custom height in whole pixels; required with width for output_id custom (320..8192) |
| output_id | string | yes | Built-in output id or custom |
| project_id | string | yes | Project id |
| width | number | – | Custom width in whole pixels; required with height for output_id custom (320..8192) |
No output schema declared.
No examples provided.
set_release_baseline Set release baseline ~49
Explicitly replace the project's release baseline with deterministic signatures for the current assets. Previewing, importing, validating, and rendering never call this automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project id |
No output schema declared.
No examples provided.
set_screenshots Attach screenshots to slides ~173
Attach or replace screenshots on existing slides by 0-based index, from absolute local file paths (PNG/JPEG/WebP). Images are scaled to fill the device screen and center-cropped; aspect mismatches are reported as warnings, not errors. Pass language (a locale code, e.g. "ar") to set a screenshot for just that locale instead of the base slide — useful when your app UI is itself localized, so each language renders its own screenshot. A locale screenshot with no translated text still falls back to the base title/subhead; the locale is added to settings.languages so render language:"all" includes it. Omit language to set the base screenshot (used by every locale that has none of its own).
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project id |
| screenshots | array | yes | – |
No output schema declared.
No examples provided.
set_slides Replace slide texts ~84
Replace the project's slide list (full-array replace — send ALL slides in final order). Each slide keeps its existing screenshot by position unless a screenshot_path is given for it; use set_screenshots to change images only. Reorder/add/remove by sending the array you want.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project id from create_project |
| slides | array | yes | – |
No output schema declared.
No examples provided.
set_style Set typography, colors, background ~547
Patch project style. Without slide_index, patches global settings: fontFamily (see list_options), titleColor/subheadColor (CSS colors), titleScale/subtitleScale (multipliers, ~0.5-1.5), titleWeight/subtitleWeight (font weight 100..900; default 700/400), platform (ios | ipad | android | android-tablet), and background — a partial patch merged onto the current background. Background fields: fill (solid|linear|radial), shape (see list_options), color, gradientColor, accent, accentOpacity (0..1), ringLayout, ringCount (1..8), seed, density (1..8), dotsAligned, gradientAngle. With shape "custom", background.customShape carries the composable parameters (primitive, layout, count, size, spacing, rotation, strokeWidth, opacityRamp) — see list_options for the ranges and a worked example. Composition supports a preset plus normalized text/device placement, scale, and flat rotation (-20..20). With slide_index (0-based), background/titleColor/subheadColor/composition apply as per-slide overrides instead (other fields are global-only and rejected). With language (a locale code, e.g. "ar"), fontFamily sets that locale's font override — used only when rendering that language, while the base keeps the global font (pass only fontFamily). Re-render after changes to see the result.
| Name | Type | Req | Description |
|---|---|---|---|
| background | object | – | Partial background patch |
| composition | object | – | Composition preset and optional text/device placement. Device x/y are normalized canvas coordinates; rotation is -20..20 degrees. |
| fontFamily | string | – | Font id from list_options (global only) |
| language | string | – | If set (a locale code, e.g. "ar"), fontFamily becomes that language's font override |
| platform | string | – | Switch device frame (global only) |
| project_id | string | yes | Project id |
| slide_index | integer | – | If set, apply background/titleColor/subheadColor to this slide only |
| subheadColor | string | – | Subhead color, e.g. rgba(26,22,18,0.62) |
| subtitleScale | number | – | Subhead size multiplier (global only) |
| subtitleWeight | integer | – | Subhead font weight 100..900, default 400 (global only) |
| titleColor | string | – | Title color, e.g. #1a1612 |
| titleScale | number | – | Title size multiplier (global only) |
| titleWeight | integer | – | Title font weight 100..900, default 700 (global only) |
No output schema declared.
No examples provided.
set_translations Store slide translations ~365
Store per-language translations of the slide texts. You are a language model: translate the slide titles/subheads YOURSELF — preserve the marketing tone and keep lengths similar to the source (titles wrap to ~2 lines on the slide) — then call this with the results. Each entry: code (folder/storage key, e.g. "es", "pt-BR"), name (human label, e.g. "Spanish"), and slides aligned 1:1 with the project's slides (same count, same order). An empty title/subhead falls back to the base text at render time. Translations are stored on the slides (slide.translations) and the languages merged into settings.languages, exactly like the web app — so the project round-trips through export_project. Then render with language:"all" for per-language folders (or one code to inspect a single language). Each slide entry may also include screenshot_path to give that locale its own screenshot (for apps whose UI is itself localized — e.g. an Arabic build); omit it and the locale reuses the base screenshot. You can also set locale screenshots separately with set_screenshots (pass language). For non-Latin scripts set a per-language font (the entry's font, or set_style with language) so this locale renders in a covering font while the base keeps the global one — Inter covers Cyrillic/Greek, Noto Sans JP/KR/SC cover CJK, "Noto Sans Arabic" covers Arabic). Arabic is shaped and laid out right-to-left automatically. Server-side rendering has no per-glyph system-font fallback, so glyphs a font lacks come out as boxes; always inspect the render preview.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project id |
| translations | array | yes | – |
No output schema declared.
No examples provided.
span_device_across_slides Span a device across two slides ~75
Place one identical device across the boundary between an adjacent slide pair. The left slide exports the left half and the next slide exports the right half; their text and backgrounds remain independent.
| Name | Type | Req | Description |
|---|---|---|---|
| left_slide_index | integer | yes | 0-based index of the first slide |
| project_id | string | yes | Project id |
No output schema declared.
No examples provided.
suggest_palette_from_screenshot Extract a palette from a screenshot ~188
Extract a color palette from a screenshot: the dominant vivid color as the shape/accent color plus a soft near-white tint of it as the background color (same algorithm as the web app's palette button). Applying the suggestion changes the background base/gradient-start color and shape accent only; it does not change the fill, shape, gradient end, or layout. Point it at a project slide (project_id + slide_index) or any local image file (image_path). Purely local math — no AI, no network. Apply the result with set_style.
| Name | Type | Req | Description |
|---|---|---|---|
| image_path | string | – | Absolute path to an image file (instead of project_id/slide_index) |
| project_id | string | – | Project id (with slide_index) |
| slide_index | integer | – | 0-based slide whose screenshot to sample |
| target | string | – | Platform target; defaults to active |
No output schema declared.
No examples provided.
validate_project Run release preflight ~44
Return the same ordered release-preflight issues shown by the web editor. Validation is advisory; stable issue codes are suitable for automation.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | Project id |
No output schema declared.
No examples provided.
What is the io.github.antonkarliner/truepane MCP server?
io.github.antonkarliner/truepane is an MCP server listed in the public MCP registry as io.github.antonkarliner/truepane. Local MCP server generating complete App Store & Google Play screenshot sets. This page covers its npm package (truepane-mcp).
Is the io.github.antonkarliner/truepane MCP server safe to use?
io.github.antonkarliner/truepane scores 82 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 1 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.antonkarliner/truepane MCP server expose?
io.github.antonkarliner/truepane exposes 19 tools: list_options, create_project, set_slides, set_screenshots, import_screenshots, and 14 more. Their descriptions and schemas cost roughly 3,187 tokens of context every time the server is loaded.
Is the io.github.antonkarliner/truepane MCP server still maintained?
io.github.antonkarliner/truepane is still listed as active in the MCP registry. We last reached this channel on 1 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.antonkarliner/truepane MCP server under?
io.github.antonkarliner/truepane declares the AGPL-3.0-only licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.