io.github.cyanheads/pixoo-mcp-server
NPM · @CYANHEADS/PIXOO-MCP-SERVER · SCANNED AUG 7
Render and push styled pixel art, text, dashboards, and animations to Divoom Pixoo LED displays.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security90
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects sharp 0.34.5, reached via @cyanheads/pixoo-toolkit > sharp. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 41 of 186 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 55 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability81
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1590 tokens (~144/item across 11 items; 7 tools + 4 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @cyanheads/pixoo-mcp-server
claude mcp add cyanheads-pixoo-mcp-server -- npx -y @cyanheads/pixoo-mcp-server
codex mcp add cyanheads-pixoo-mcp-server -- npx -y @cyanheads/pixoo-mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"cyanheads-pixoo-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@cyanheads/pixoo-mcp-server"
],
"enabled": true
}
}
} openclaw mcp add cyanheads-pixoo-mcp-server --command npx --arg -y --arg @cyanheads/pixoo-mcp-server
mcp_servers:
cyanheads-pixoo-mcp-server:
command: "npx"
args: ["-y", "@cyanheads/pixoo-mcp-server"] {
"mcpServers": {
"cyanheads-pixoo-mcp-server": {
"command": "npx",
"args": [
"-y",
"@cyanheads/pixoo-mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 7 Aug 26 +3
- Dependency health: partial → 0.91 functional
- 6 Aug 26 +31
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Schema quality: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Tool coverage: 100 functional
- First check of Tool coverage: 100 functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Schema quality: fail functional
- 5 Aug 26 0
- CVE-2026-69207 no longer affects this package ▲ security
- 4 Aug 26 0
- CVE-2026-69207 affects this package: high ▼ security
- 2 Aug 26 +28
- GHSA-f88m-g3jw-g9cj affects this package: high ▼ security
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. functional
- Capabilities: Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet. functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Licence: Apache-2.0 functional
- 1 Aug 26 −10
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 −10
- Provenance: unverified → fail ▼ security
- Malware scan: pass → unverified ▼ security
- Install scripts: unverified → pass ▲ security
- Dependency health: partial → unverified ▼ functional
- Maintenance: unverified → pass ▲ functional
- License: unverified → pass ▲ functional
- Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess. functional
- Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess. functional
- Licence: Apache-2.0 functional
- 29 Jul 26 +1
- Dependency health: unverified → partial ▲ functional
- Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 7 Aug 2026 · Analysed npm/@cyanheads/[email protected]
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-f88m-g3jw-g9cj | high | yes |
Dependencies 186 packages
| Packages resolved | 186 |
|---|---|
| Stale | 41 |
| Tree resolution | Complete |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
pixoo_compose_scene ~221
Compose a full scene: layered elements (text, icons, widgets, shapes, bitmaps, images, sprites) with per-element effects and keyframes, static or animated. Returns the rendered scene as an image content block for immediate inspection. Elements render back-to-front in array order. For text-only display use pixoo_display_text; run pixoo_design_brief with topic "scene" or "dashboard" for layout and palette guidance.
| Name | Type | Req | Description |
|---|---|---|---|
| background | – | yes | Scene background: solid color, gradient, or named theme. |
| elements | array | yes | Scene elements rendered back-to-front. Up to 50 elements. |
| frames | integer | – | Number of animation frames (1–40, default: 1). 20 frames at 150ms ≈ 3s loop. |
| output | string | – | Explicit output file path for saving (overrides PIXOO_OUTPUT_DIR). |
| push | boolean | – | Push to device (default: true). |
| speed | integer | – | Milliseconds per frame for animations (default: 150ms). |
| Name | Type | Req | Description |
|---|---|---|---|
| deviceState | object | – | Device state after the push. Absent when push: false. |
| frames | number | yes | Number of frames in the rendered output (1 for static, 2–40 for animations). |
| layout | array | yes | Layout report for each element. |
| notice | string | – | Warning or informational notice about the render or push. |
| outputFiles | array | – | Absolute paths to saved output files (PNG for static, GIF for animations). Present only when PIXOO_OUTPUT_DIR is configured or output is set. |
| previewData | string | – | Base64-encoded PNG preview of the rendered scene (8× upscaled, 512px). For animations: the middle frame. |
| previewMimeType | string | – | MIME type of the preview image. |
| pushed | boolean | yes | True when the device acknowledged the push. False when push: false or push failed. |
No examples provided.
pixoo_control_device ~138
Read or change device state: brightness (0–100), screen on/off, channel, or clock face. Call with no params to read current state only. Supply any params to apply changes before reading back state. Use pixoo_discover_devices first if PIXOO_IP is not yet configured.
| Name | Type | Req | Description |
|---|---|---|---|
| brightness | integer | – | Set display brightness (0–100). |
| channel | string | – | Switch to a channel: faces, cloud, visualizer, or custom. |
| clockFaceId | integer | – | Select a clock face by ID (channel must be faces). |
| screen | string | – | Turn the display screen on or off. |
| Name | Type | Req | Description |
|---|---|---|---|
| applied | array | yes | Settings successfully applied in this call (e.g. "brightness:80", "screen:on"). Empty when called with no params or all changes failed. A requested setting that failed is absent here and reported in… |
| brightness | number | – | Current brightness level (0–100). Absent when device is unreachable. |
| channel | string | – | Current channel name (faces, cloud, visualizer, or custom). Absent when device is unreachable. |
| clockId | number | – | Current clock face ID (faces channel only). Absent on other channels or when device is unreachable. |
| reachable | boolean | yes | True if device responded to the status read. |
| screenOn | boolean | – | True if the screen is on. Absent when device is unreachable. |
No examples provided.
pixoo_design_brief ~121
Return craft guidance and live device context for a design topic. Covers legibility rules, palette discipline, layout zones, animation budget, and pre-filled next-tool suggestions based on current device state. The orientation tool to run before authoring a scene, dashboard, or animation — or when troubleshooting display issues.
| Name | Type | Req | Description |
|---|---|---|---|
| topic | string | yes | Design topic: text (styled text guidance), scene (composition + layout zones), dashboard (widgets + metrics), animation (motion budget + effects), pixel-art (bitmap + sprite guidance), troubleshootin… |
| Name | Type | Req | Description |
|---|---|---|---|
| availableThemes | array | yes | Available named scene themes (e.g. "midnight", "ember"). Use in background.theme or pixoo_display_text theme param. |
| craftGuidance | string | yes | Markdown-formatted craft rules: legibility floors, palette discipline, layout zones, and technique guidance specific to the topic. |
| deviceContext | object | yes | Live device state snapshot at the time of the request. |
| iconCategories | object | yes | Built-in icon names grouped by category (weather, arrows, status, media). Use names in pixoo_compose_scene icon elements. |
| nextToolSuggestions | array | yes | Suggested next steps based on topic and device state. |
| topic | string | yes | The topic that was requested. |
No examples provided.
pixoo_discover_devices ~92
Find Pixoo devices on the local network via Divoom's cloud discovery endpoint (requires internet — queries app.divoom-gz.com). Run once during initial setup to find device IPs; set PIXOO_IP in server configuration to enable all other tools. For ongoing device control use pixoo_control_device.
| Name | Type | Req | Description |
|---|---|---|---|
| timeoutMs | integer | – | Discovery timeout in milliseconds (default: 5000ms). |
| Name | Type | Req | Description |
|---|---|---|---|
| configuredIp | string | – | Currently configured PIXOO_IP value (absent if not set). |
| configuredIpFound | boolean | – | True if PIXOO_IP matches a discovered device; false signals an IP mismatch. Absent when PIXOO_IP is not set. |
| devices | array | yes | Discovered Pixoo devices on the local network. |
| notice | string | – | Recovery hint when no devices found or IP mismatch. |
No examples provided.
pixoo_display_text ~278
Render styled text (theme, gradient, shadow, outline, auto-fit) onto the Pixoo display and push it. Returns the rendered frame as an image content block for immediate inspection. The primary tool for text-only display — for layers, icons, widgets, or animations use pixoo_compose_scene. Run pixoo_design_brief with topic "text" first for palette and legibility guidance.
| Name | Type | Req | Description |
|---|---|---|---|
| align | string | – | Multi-line text alignment (default: center). |
| background | – | – | Background color or gradient. Overrides theme background when set. |
| brightness | integer | – | Set device brightness before push (0–100). Failure is a warning, not an error. |
| effect | string | – | Animation effect. auto = scroll only when text overflows. Produces a multi-frame result. |
| font | string | – | Font variant: standard (5×7) or compact (3×5). Auto-fit will choose if omitted. |
| position | object | – | Text position on the display. |
| push | boolean | – | Push the rendered frame to the device (default: true). |
| style | object | – | Text style: palette, shadow, outline, scale. |
| text | – | yes | Text to display. String or array of lines. |
| theme | string | – | Named scene theme — sets background gradient and default text palette. |
| Name | Type | Req | Description |
|---|---|---|---|
| deviceState | object | – | Device state after the push. Absent when push: false. |
| layout | array | yes | Layout report: every fit decision the renderer made. |
| notice | string | – | Warning or informational message about the render or push. |
| outputFiles | array | – | Absolute paths to saved PNG preview files. Present only when PIXOO_OUTPUT_DIR is configured. |
| previewData | string | – | Base64-encoded PNG preview of the rendered frame (8× upscaled, 512px). |
| previewMimeType | string | – | MIME type of the preview image. |
| pushed | boolean | yes | True when the device acknowledged the push. |
No examples provided.
pixoo_overlay_text ~320
Set or clear a device-native scrolling text overlay. Use mode "set" to add or update an overlay on a slot (0–19); use mode "clear" to remove it. Overlays use device-rendered fonts (115 font IDs, 0–114) and persist across channel switches until explicitly cleared with mode "clear". Not previewable — rendering happens on-device. Best for persistent tickers over pushed scenes; for styled, previewable text use pixoo_display_text instead.
| Name | Type | Req | Description |
|---|---|---|---|
| align | string | – | Text alignment (default: left). |
| color | string | – | Text color as CSS hex color (default: white). |
| direction | string | – | Scroll direction (default: left). |
| font | integer | – | Device font ID (0–114). 0 = default, 18 = arrows, 20 = °C/°F. Device-rendered; no preview. |
| id | integer | yes | Overlay slot ID (0–19). Each ID is an independent overlay layer. |
| mode | string | yes | set = add/update overlay; clear = remove it. |
| speed | integer | – | Scroll speed (0–100, device units; default: 50). |
| text | string | – | Text to display (required for mode=set). |
| width | integer | – | Text region width in pixels (optional; defaults to display width). |
| x | integer | – | X start position on display (default: 0). |
| y | integer | – | Y start position on display (default: 0). |
| Name | Type | Req | Description |
|---|---|---|---|
| acknowledged | boolean | yes | True when the device confirmed the overlay command (error_code: 0). |
| id | number | yes | The overlay slot ID (0–19) that was operated on. |
| mode | string | yes | Operation performed: "set" (overlay added/updated) or "clear" (overlay removed). |
No examples provided.
pixoo_push_image ~168
Load an image (absolute local path or https URL), resize it to fit the LED grid, and optionally push it to the display. Returns the downsampled result as an image content block so you see exactly what the display received. Nearest-neighbor kernel preserves pixel art; use lanczos3 or mitchell for photos.
| Name | Type | Req | Description |
|---|---|---|---|
| fit | string | – | Resize fit mode: contain (letterbox), cover (crop to fill), fill (stretch). |
| kernel | string | – | Resize kernel: nearest for pixel art, lanczos3 for photos, mitchell for a balance. |
| push | boolean | – | Push the resized image to the device (default: true). |
| source | string | yes | Absolute local file path or https (not http) URL of the image to display. |
| Name | Type | Req | Description |
|---|---|---|---|
| deviceState | object | – | Device state after the push. Absent when push: false. |
| notice | string | – | Warning or informational message. |
| outputFiles | array | – | Absolute paths to saved PNG preview files. Present only when PIXOO_OUTPUT_DIR is configured. |
| previewData | string | – | Base64-encoded PNG preview of the downsampled 64×64 result (8× upscaled, 512px). |
| previewMimeType | string | – | MIME type of the preview image. |
| pushed | boolean | yes | True when the device acknowledged the push. |
No examples provided.