io.github.c64dos-png/vector-mirror
NPM · VECTOR-MIRROR
Deterministic SVG perception for LLM agents — measures, never guesses. MCP server.
Available components
Last scanned (6 hours ago)
Scores higher than 34% of npm servers
Category Design and Media
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 38 of 144 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 145 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability61
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2834 tokens (~314/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management63
- Stability observed for 19 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.
- 4 Nov 26 −6
- Stability: pass → 0.60 functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 23 Oct 26 0
- Stability: 0.97 → pass security
- 22 Oct 26 0
- Stability: pass → 0.97 functional
- 17 Oct 26 +43
- Injection markers: unverified → pass ▲ security
- Stability: unverified → pass ▲ security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- 12 Oct 26 −28
- Stability: 0.97 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- 8 Oct 26 −13
- Malware scan: pass → unverified ▼ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/vector-mirror@1.0.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 144 packages
| Packages resolved | 144 |
|---|---|
| Stale | 38 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
vector_mirror_analyze ~424
Analyzes an SVG against spatial constraints, returns a Spotter-Report. Input: SVG + Constraints "#subject TYPE #reference [value]", z.B. "#logo CENTERED-IN #frame"; Typen: vector_mirror_constraints; previousIssueCount → Konvergenz. Output: status PASS/FAIL/PARTIAL, corrections (fix), unchecked, diff; analysisId unter iteration. Eigenheiten (verifiziert): Reservierte/kollidierende Autor-ids (etwa "title") ersetzt der Sanitizer durch Auto-IDs; die Original-id steht NUR im Text-Kanal — bei lossy immer auch content[0].text lesen. | scene.elements zeigt maximal 7 Elemente, suppressed zählt den Rest; Constraints auf verdeckte Elemente werden trotzdem geprüft; einen Nachlade-Parameter gibt es nicht. | PARTIAL = unchecked-Constraints oder vom Cap verdeckte Warnungen (meta.truncated_warnings, nur bei Trunkierung); sichtbare Warnungen allein ergeben PASS. | Farben erscheinen überall als W3C-Namen, nie als Hex; COLOR vergleicht Namen: #ff0000 besteht als red, #ff6347 nicht. | analysisId und Bookmarks leben nur im laufenden Server-Prozess (in-memory) — Ein-Aufruf-Clients können compare/bookmark nicht nutzen. | Liste unvollständig — bei Unerwartetem canvas_validity prüfen, Verlust-Details im Text-Kanal lesen; Glossar: Server-Quickstart. Next step: fix per corrections, then analyze until PASS.
| Name | Type | Req | Description |
|---|---|---|---|
| constraints | array | – | Regeln im Format: "#subject TYPE #reference [value]". Typen: CENTERED-IN, NO-OVERLAP, INSIDE, ALIGNED-LEFT, ALIGNED-TOP, LEFT-OF, ABOVE, DISTANCE-FROM, SAME-SIZE, COLOR |
| previousIssueCount | integer | – | Anzahl Fehler des vorherigen Aufrufs (fuer Konvergenz-Tracking) |
| svg | string | yes | Vollstaendiger SVG-String |
| Name | Type | Req | Description |
|---|---|---|---|
| corrections | array | yes | – |
| diff | array | yes | – |
| error | object | – | – |
| iteration | object | yes | – |
| meta | object | – | – |
| scene | object | yes | – |
| status | string | yes | – |
| unchecked | array | yes | – |
No examples provided.
vector_mirror_arrange ~279
Computes SVG attributes (x, y, width, height, cx, cy) from canvas dimensions, element definitions, and spatial constraints — layout from scratch, no browser. Input: canvas {width, height}, elements [{id, tag, r?, width?, height?, content?}], constraints (string[]). Output: attributes per element (ready to apply to SVG) + warnings. Eigenheiten (verifiziert): Constraints wirken sequentiell — jede sieht das Ergebnis der vorigen, die Reihenfolge ändert das Layout. | FILL ist arrange-only (in analyze landet es als unchecked); COLOR hat hier keine Wirkung und wird ohne Warnung übersprungen. | Attribute sind Rechen-Vorschläge ohne Canvas-Wächter — auch Positionen außerhalb des Canvas kommen ohne Warnung zurück; mit analyze verifizieren. | Liste unvollständig — nicht Umsetzbares landet als Klartext in warnings; arrange-fähige Typen zeigt vector_mirror_constraints (hasArrange). Next step: use the returned attributes to construct or update the SVG, then call analyze to verify.
| Name | Type | Req | Description |
|---|---|---|---|
| canvas | object | yes | Canvas-Dimensionen |
| constraints | array | yes | Constraints im Format "#subject TYPE #reference". Reihenfolge ist semantisch relevant. |
| elements | array | yes | Elemente mit ID, Tag und optionalen Dimensionen |
| Name | Type | Req | Description |
|---|---|---|---|
| attributes | object | yes | – |
| error | object | – | – |
| warnings | array | yes | – |
No examples provided.
vector_mirror_bookmark ~231
Saves a previous analyze result as a named baseline for the Sniper-Loop: pin a state, edit the SVG, then compare against the name instead of the UUID. Input: name (kein UUID-Format) + analysisId (UUID aus analyze). Output: name, analysisId, stored, bookmarkCount. Eigenheiten (verifiziert): analysisId und Bookmarks leben nur im laufenden Server-Prozess (in-memory) — Ein-Aufruf-Clients können compare/bookmark nicht nutzen. | Unbekannte/verdrängte analysisId: isError:true und error {code: ANALYSIS_NOT_FOUND, hint}; maximal 10 Bookmarks, das älteste wird verdrängt (LRU). | Liste unvollständig — Session-Begriffe (analysisId, Bookmarks) erklärt das Glossar im Server-Quickstart. Next step: compare(svg, [], name) against this baseline.
| Name | Type | Req | Description |
|---|---|---|---|
| analysisId | string | yes | analysisId aus vector_mirror_analyze |
| name | string | yes | Bookmark-Name (kein UUID-Format; Keyspace disjunkt von grids). |
| Name | Type | Req | Description |
|---|---|---|---|
| analysisId | string | yes | – |
| bookmarkCount | integer | yes | – |
| error | object | – | – |
| name | string | yes | – |
| stored | boolean | yes | – |
No examples provided.
vector_mirror_compare ~336
Compares an SVG with a stored baseline and reports what changed. Input: SVG + analysisId (UUID aus analyze) ODER Bookmark-Name; optionale constraints für Re-Check. Output: analyzeOutput-Form mit diff. Eigenheiten (verifiziert): analysisId und Bookmarks leben nur im laufenden Server-Prozess (in-memory) — Ein-Aufruf-Clients können compare/bookmark nicht nutzen. | Ohne Baseline in diesem Prozess: isError:true und error {code: NO_BASELINE, hint} in structured, derselbe Hint im Text-Kanal — zuerst analyze ausführen. | Diff-Vokabular deutsch und endlich: VERSCHOBEN, FARBÄNDERUNG, FORMÄNDERUNG, NEU, ENTFERNT. | Das Diff sieht Farben auf Namens-Ebene: Hex-Drift unterhalb der Namens-Grenze bleibt unsichtbar, Namens-Sprünge erscheinen als FARBÄNDERUNG. | Liste unvollständig — bei Unerwartetem canvas_validity prüfen, Verlust-Details im Text-Kanal lesen; Glossar: Server-Quickstart. Next step: review diff, adjust SVG, then analyze or compare again.
| Name | Type | Req | Description |
|---|---|---|---|
| analysisId | string | yes | analysisId (UUID aus analyze) ODER Bookmark-Name (aus vector_mirror_bookmark). Server löst UUID→grids, Name→bookmarks auf. Pflichtfeld (§1.1). |
| constraints | array | – | Optionale Constraints fuer Re-Check |
| svg | string | yes | Vollstaendiger SVG-String (neuer Zustand) |
| Name | Type | Req | Description |
|---|---|---|---|
| corrections | array | yes | – |
| diff | array | yes | – |
| error | object | – | – |
| iteration | object | yes | – |
| meta | object | – | – |
| scene | object | yes | – |
| status | string | yes | – |
| unchecked | array | yes | – |
No examples provided.
vector_mirror_constraints ~166
Lists all available constraint types with their syntax and capabilities. Input: none. Output: types [{type, syntax, hasArrange}]. Eigenheiten (verifiziert): Das Vokabular ist abschließend — was hier nicht steht, existiert nicht; RIGHT-OF/BELOW existieren nicht: LEFT-OF/ABOVE mit getauschten Operanden nutzen. | Unbekannte Typen werden nie geraten: analyze liefert unchecked mit reasonCode CONSTRAINT_TYPE_UNKNOWN und Hint, bei nahen Tippfehlern mit Korrektur-Vorschlag. | Liste unvollständig — unbekannter Typ ⇒ unchecked mit reasonCode + Hint; vollständiges Vokabular: vector_mirror_constraints. Next step: use the constraint syntax in vector_mirror_analyze.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| types | array | yes | – |
No examples provided.
vector_mirror_inspect ~274
Inspects an SVG and returns element positions, sizes, colors and grid mapping without checking constraints. Input: SVG string. Output: scene mit id, tag, Grid-Zelle (Ortssprache, z.B. C4), color je Element. Eigenheiten (verifiziert): Reservierte/kollidierende Autor-ids (etwa "title") ersetzt der Sanitizer durch Auto-IDs; die Original-id steht NUR im Text-Kanal — bei lossy immer auch content[0].text lesen. | Derselbe 7-Elemente-Cap wie analyze — inspect umgeht ihn nicht; suppressed zählt verdeckte Elemente. | structuredContent trägt nur scene (plus meta bei Trunkierung) — kein status, keine corrections; canvas_validity und suppressed stehen in scene. | canvas_validity=lossy heißt: der Sanitizer hat etwas entfernt oder ersetzt — auch render-neutrale Strips (etwa Kommentare) zählen; Verlust-Details stehen nur im Text-Kanal der Antwort. | Liste unvollständig — bei Unerwartetem canvas_validity prüfen, Verlust-Details im Text-Kanal lesen; Glossar: Server-Quickstart. Next step: define constraints based on the layout, then call analyze.
| Name | Type | Req | Description |
|---|---|---|---|
| svg | string | yes | Vollstaendiger SVG-String |
| Name | Type | Req | Description |
|---|---|---|---|
| error | object | – | – |
| meta | object | – | – |
| scene | object | yes | – |
No examples provided.
vector_mirror_palette ~173
Extracts fill and stroke colors from all SVG elements — review the color scheme before applying COLOR constraints. Input: SVG string. Output: colors [{id, fill, stroke}]. Eigenheiten (verifiziert): Farben erscheinen überall als W3C-Namen, nie als Hex; COLOR vergleicht Namen: #ff0000 besteht als red, #ff6347 nicht. | Maximal 7 Einträge in colors, ohne Zähler — weitere Elemente nennt nur die Text-Zeile (N weitere). | Liste unvollständig — bei Unerwartetem canvas_validity prüfen, Verlust-Details im Text-Kanal lesen; Glossar: Server-Quickstart. Next step: use COLOR constraints in analyze to enforce specific colors.
| Name | Type | Req | Description |
|---|---|---|---|
| svg | string | yes | Vollstaendiger SVG-String |
| Name | Type | Req | Description |
|---|---|---|---|
| colors | array | yes | – |
| error | object | – | – |
No examples provided.
vector_mirror_selftest ~220
Runs the 5 calibration fixtures (EK-1 color, EK-2 grid, EK-3 constraint, EK-4 3D-suppression, EK-5 frozen animation) and verifies Vector Mirror against the spec-derived truth. Input: optional full (boolean) — adds an N=10 mini determinism check. Output: status (PASS/FAIL), calibrated, total, failures. Eigenheiten (verifiziert): Misst die 5 Eichkörper gegen spec-abgeleitete expected-Werte, nie gegen gespeicherten eigenen Output — Anti-Zirkularität als Vertrauensanker. | Liste unvollständig — Feld-Bedeutungen erklärt das Glossar im Server-Quickstart; bei selftest-FAIL nennt failures die exakte Spec-Abweichung je Eichkörper. Next step: PASS = trust the measurements; FAIL = fix per failures, then re-run.
| Name | Type | Req | Description |
|---|---|---|---|
| full | boolean | – | true → zusätzlich N=10-Mini-Determinismus-Check (langsamer). Default: nur Kalibrierung. |
| Name | Type | Req | Description |
|---|---|---|---|
| calibrated | integer | yes | – |
| failures | array | yes | – |
| status | string | yes | – |
| total | integer | yes | – |
No examples provided.
vector_mirror_status ~151
Returns Vector Mirror server health. Input: none. Output: version, browser (running/stopped), lastAnalysis, constraintTypes, breaker, calibration. Eigenheiten (verifiziert): calibration=PENDING: der Auto-Selftest vom Serverstart läuft noch oder scheiterte — nicht defekt; der Browser startet lazy beim ersten Mess-Aufruf. | lastAnalysis zeigt Baseline-Existenz nur für diesen Prozess. | Liste unvollständig — Feld-Bedeutungen erklärt das Glossar im Server-Quickstart; bei selftest-FAIL nennt failures die exakte Spec-Abweichung je Eichkörper. Next step: if browser is stopped, any analyze/inspect/palette call will auto-start it.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| breaker | – | yes | – |
| browser | string | yes | – |
| calibration | – | – | – |
| constraintTypes | integer | yes | – |
| lastAnalysis | boolean | yes | – |
| version | string | yes | – |
No examples provided.
How do I install the io.github.c64dos-png/vector-mirror MCP server?
io.github.c64dos-png/vector-mirror runs locally as an npm package, launched with npx -y vector-mirror. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · vector-mirror
claude mcp add c64dos-png-vector-mirror -- npx -y vector-mirror
What is the io.github.c64dos-png/vector-mirror MCP server?
io.github.c64dos-png/vector-mirror is an MCP server listed in the public MCP registry as io.github.c64dos-png/vector-mirror. Deterministic SVG perception for LLM agents, measures, never guesses. MCP server. This page covers its npm package (vector-mirror).
Is the io.github.c64dos-png/vector-mirror MCP server safe to use?
io.github.c64dos-png/vector-mirror scores 66 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.c64dos-png/vector-mirror MCP server expose?
io.github.c64dos-png/vector-mirror exposes 9 tools: vector_mirror_analyze, vector_mirror_compare, vector_mirror_bookmark, vector_mirror_inspect, vector_mirror_palette, and 4 more. Their descriptions and schemas cost roughly 2,254 tokens of context every time the server is loaded.
Is the io.github.c64dos-png/vector-mirror MCP server still maintained?
io.github.c64dos-png/vector-mirror is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.c64dos-png/vector-mirror MCP server under?
io.github.c64dos-png/vector-mirror declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.