Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Car Image API

NPM · @METERAPP/CAR-IMAGE · 2 COMPONENTS

Studio-quality images and 3D models of any real car, 1990-2027, by make, model, year or VIN.

62 Trust /100

Last scanned (21 hours ago)

Scores higher than 31% of npm servers

Category Design and Media

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security99
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 1 of 4 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
Schema Quality & AI Usability61
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 5081 tokens (~423/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +15
    • Malware scan: unverified → pass ▲ security
  • 3 Nov 26 47

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed npm/@meterapp/car-image@1.29.2

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 4 packages
Packages resolved 4
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 12 exposed · ~4,309 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
check_vehicles ~377

Free. Check a list of up to 100 vehicles in one call before rendering any: which ones the catalog carries and under which vehicle id. Send each as the list spells it ({make, model, year}) or as a stored id ({vehicle}), with an optional ref that is echoed back. Each entry is read exactly as get_car_image would read it and answered as match (vehicle.id is the id to store and render by; vehicle.match is exact, or the looser rule that read the name), suggestion (not in the catalog as named; suggestions are real vehicles close to it, such as the same model in its nearest year, which is another car: ask the human before using one), miss (nothing close: skip it in every view and color) or invalid (error says what to fix). Use it for a catalog, a spreadsheet or any list of more than a few cars, instead of one lookup or one paid render per car; summary counts each status and the distinct vehicles a backfill would render. With views: true each match also carries views.prepared (0-9) and views.missing, which of its nine camera views are prepared now, and summary.views_complete counts the vehicles with all nine. A longer list is work for code: car-image check <file>, or client.checkVehicles, 2,000 vehicles per request.

NameTypeReqDescription
vehiclesarrayyes1 to 100 vehicles, each {make, model, year} as the list spells them or {vehicle} for a stored id, with an optional ref echoed back.
viewsboolean–true: each match also says which of its nine camera views are prepared now, as get_image_availability reports them (views.prepared 0-9 and views.missing). Free and read-only. Default false.
NameTypeReqDescription
dataobjectyes–
request_idstringyes–

No examples provided.

create_car_image_urls ~711

Put vehicle images into web pages, apps, emails and documents: create 1-50 key-free signed URLs a browser loads directly (<img src>), each with ready-to-display Markdown. To show a vehicle in chat, use get_car_image instead: the host displays it inline. Use these URLs in chat only where tool images do not reach the person (a terminal) or the human asks for a link: then paste each returned markdown in the final reply, outside code fences (or link the URL where images do not render), with ttl_seconds 604800, max_uses 0 and renewal off unless requested. Reuse unexpired URLs; never mint twice for one image. Each URL counts its vehicle image for the month at creation (1 credit on the legacy credit meter); loads within the TTL add nothing and are publicly cacheable. Each image names its vehicle like get_car_image: look each distinct vehicle up once (resolve_vehicle, search_vehicles or decode_vin, all free) and pass its id as vehicle, or send make, model and year in catalog spelling. Each takes any paint color (a preset or a hex) and the same sizing options (width, height, fit, background, framing, trim, padding, shadow); format auto makes the URL serve webp or png per viewer. For email, CMS pages or documents that outlive a TTL, set renew: true with ttl_seconds 604800: the URL keeps serving past expiry, renewing in each opened week (one more credit per week on the legacy credit meter), for up to renew_days. Pass idempotency_key when the call might be repeated: a retry with the same key and arguments replays the first result instead of billing again. Returns id, url, markdown, expires_at, max_uses, renews_until and the normalized vehicle for each image. Prefer this over get_car_image for HTML, Markdown files, documents, emails and websites. State expiry briefly.

NameTypeReqDescription
idempotency_keystring–Makes a retry safe. The same key with the same arguments within 24 hours replays the first result (idempotent_replayed: true) instead of minting and billing again; the same key with different argumen…
imagesarrayyesOne to fifty image requests. Each URL counts its vehicle image (vehicle, color, angle) for the month when created; the same image again this month adds nothing.
max_usesinteger–Maximum redemptions per URL, 0 to 1000; 0 (default) means unlimited until expiry.
renewboolean–Auto-renew past the TTL: the first load in each further window of ttl_seconds renews the URL, until renew_days (no extra count on a plan; one more credit per window on the legacy credit meter, so pai…
renew_daysinteger–How long a renewable URL keeps renewing, 1 to 365 days from creation (default 365). Only with renew: true.
ttl_secondsinteger–How long the URLs stay valid, 60 to 604800 seconds (7 days). Default 3600.
NameTypeReqDescription
billingobjectyes–
dataarrayyes–
idempotent_replayedboolean––
request_idstringyes–

No examples provided.

decode_vin ~226

Free. Decode a full 17-character VIN, or a partial VIN of at least 5 characters with * for unknown positions, with NHTSA vPIC data: year, make, model, trim, series, body class, engine, transmission, manufacturer, plant and every decoded attribute. `vehicle` is the catalog vehicle it maps to, with the stable id to pass as `vehicle` to get_car_image, create_car_image_urls or create_3d_model, or null when the catalog does not carry that car. Use it whenever the human gives a VIN instead of a make and model. To show the vehicle, call create_car_image_urls with that id (1 credit per signed URL, loads at once when the image is already rendered).

NameTypeReqDescription
vinstringyesA full 17-character VIN, or a partial VIN of at least 5 characters with * for each unknown position. Case, spaces and dashes do not matter.
yearinteger–Model-year hint for the decoder; it flags a mismatch with the VIN's own year position.
NameTypeReqDescription
dataobjectyes–
request_idstringyes–

No examples provided.

get_account ~69

Free. Show the organization this connection acts for (data.organization, with the caller's role), usage this month (limits_usage: vehicle images used and included, keys, request rates) and the key's scopes. Every new account includes 100 free vehicle images a month. Check this before large batches.

Input schema present but exposes no named parameters.

NameTypeReqDescription
dataobjectyes–
linksobject––
request_idstring––

No examples provided.

get_car_image ~1,251

Show a vehicle in chat: returns the image as an MCP image the host displays inline with the result, and the bytes for a file. Name the vehicle, view and color in the reply; do not also mint a signed URL for the same image. Where the person cannot see tool images (a terminal), use create_car_image_urls instead. Counts one vehicle image (vehicle, color, angle) for the month on the account's plan, prepared yet or not; the same image again this month adds nothing. Legacy credit-meter accounts: COSTS 1 CREDIT per call, cached or generated. Call resolve_vehicle first (or search_vehicles, or decode_vin for a VIN) and pass the id it returns as `vehicle`: the lookup is free, and the catalog files cars under its own names (a Mazda "MX-5 Miata" is mx-5), so a make and model typed from memory can answer 404 for a car the catalog carries. Make, model and year are for callers that already hold catalog spellings. Nine camera angles, any paint color (fifteen named presets or any hex such as #1a2b3c), any width and height up to 1024 px (fit contain|cover|inside), transparent or on a solid background, optionally trimmed to the car and with a soft ground shadow (shadow: true). Returns the image (PNG/WebP/JPG; format auto delivers PNG here) plus usage metadata (credits_charged, vehicle_images used this month, or credits_remaining on the credit meter; source cache|generated, request_id, the vehicle with its vehicle_id). Use create_car_image_urls for web pages, apps, emails and documents, and in a terminal. Do not call both paid tools for one image.

NameTypeReqDescription
backgroundstring–Solid background: a hex color such as "#f4f4f4" or a CSS color name such as "white" or "whitesmoke". Omit for transparent (jpg is white).
colorstring–Paint color: one of the presets (white, black, gray, silver, blue, red, green, brown, beige, tan, orange, yellow, gold, burgundy, purple), a CSS color name such as navy (grey is the gray preset) or a…
fitstring–With width and height: contain (default) keeps the whole car and pads the rest; cover fills the box and crops; inside may return a smaller image.
formatstring–png keeps the transparent background (default); webp is smallest; jpg is flattened onto white; auto lets each viewer's Accept header choose webp or png, negotiated on every load of a signed URL. An i…
framingstring–Composition preset, instead of trim/padding (never with them): consistent (default) keeps the camera scale every view of the vehicle shares, for galleries and spinners; tight = trim with no margin, t…
heightinteger–Explicit height in px, up to 1024 (a larger size is clamped, see width).
makestring–Manufacturer, e.g. "Porsche", "BMW", "Toyota". Case and punctuation do not matter. Prefer vehicle; omit when it is given.
modelstring–Model as the catalog spells it, e.g. "911", "M3", "mx-5". Look it up (resolve_vehicle, search_vehicles) rather than typing it from memory: prefer vehicle. Conservative typos and reviewed vehicle-db a…
paddinginteger–Margin around a trimmed car, percent of its longer side (0-50). Only with trim.
shadowboolean–Add a soft ground shadow under the car, drawn from its cut-out (semi-transparent, or grey on a background). Same image, nothing extra.
sizestring–Square size preset: thumb=256, small=512, medium=768, large=1024 px. Omit for 1024 px.
trimboolean–Crop to the car's own bounds before sizing, so it fills the box instead of floating in the square source frame.
vehiclestring–Stable vehicle id such as veh_395yw8tn73ff8, as resolve_vehicle (params.vehicle_id), search_vehicles and decode_vin return it. The preferred way to name a vehicle: it cannot be misspelled. It names t…
viewstring–Camera angle, in yaw order around the car: front (0°), front-3-4 (35°, the classic hero angle, nose left), side (profile, nose left), rear-3-4 (145°, nose left), rear (180°), rear-3-4-right (215°, no…
widthinteger–Explicit width in px, up to 1024; overrides size. With height too, the output is exactly width x height. A larger size is clamped: the box shrinks to 1024 on its longer side and keeps its shape (1920…
yearinteger–Model year, e.g. 2024. The catalog covers 1990 through next year. Omit when vehicle is given.
NameTypeReqDescription
content_typestringyes–
credits_chargednumber|nullyes–
credits_remainingnumber|null––
etagstring|nullyes–
height–yes–
request_idstring|nullyes–
source–yes–
vehicleobjectyes–
vehicle_imagesobject––
width–yes–

No examples provided.

get_image_availability ~480

Free, read-only check before generating an image. Look the vehicle up first and pass its vehicle id. Check one view or omit view for all nine; pass the requested paint as color. cached true means the view is prepared: it serves quickly from storage, without waiting for a new render. Returns each view's quality (standard, enhanced or premium; null when no stored image), upgrade state, and render_eta for views not cached. It renders nothing, queues nothing and counts no image usage. This does not authorize a render or a quality upgrade. Unlike a public preview, this checks what an authenticated image request would serve, including the requested color.

NameTypeReqDescription
colorstring–Paint color: one of the presets (white, black, gray, silver, blue, red, green, brown, beige, tan, orange, yellow, gold, burgundy, purple), a CSS color name such as navy (grey is the gray preset) or a…
makestring–Manufacturer, e.g. "Porsche", "BMW", "Toyota". Case and punctuation do not matter. Prefer vehicle; omit when it is given.
modelstring–Model as the catalog spells it, e.g. "911", "M3", "mx-5". Look it up (resolve_vehicle, search_vehicles) rather than typing it from memory: prefer vehicle. Conservative typos and reviewed vehicle-db a…
vehiclestring–Stable vehicle id such as veh_395yw8tn73ff8, as resolve_vehicle (params.vehicle_id), search_vehicles and decode_vin return it. The preferred way to name a vehicle: it cannot be misspelled. It names t…
viewstring–Check one camera view; omit to check all nine views.
yearinteger–Model year, e.g. 2024. The catalog covers 1990 through next year. Omit when vehicle is given.
NameTypeReqDescription
dataobjectyes–
request_idstringyes–

No examples provided.

report_issue ~261

Free. Report a problem with Car Image itself (a failed or wrong render, an error that looks like a bug, a broken endpoint), with the human's agreement. Pass the failed call's request_id and what you know in context (endpoint, error_code, vehicle id, view, color): the team sees exactly what happened. Private to the human and the team. Similar open reports come back first, as with request_feature: upvote_feedback one that matches. The human gets an acknowledgement and an email when it is picked up and when it is fixed. Not for a vehicle the catalog lacks, and never include API keys.

NameTypeReqDescription
bodystring–What was called, what was expected, what happened.
contextobject–The identifiers of what went wrong. Checked against the account's own requests; never shown publicly.
forceboolean–File it even though similar reports exist.
request_idstring–The request_id of the failed call (from its error or X-Request-Id). The single most useful thing to attach.
titlestringyesWhat went wrong, in a line, e.g. "Side views of the 2024 Camry return 502". No keys or personal data.
NameTypeReqDescription
createdbooleanyes–
data–yes–
request_idstringyes–
similararrayyes–

No examples provided.

request_feature ~166

Free. When the human wishes the API did something it does not (new views, formats, endpoints, anything), file it on the public feedback board. Similar items are checked first: when some exist nothing is filed (created: false) and similar lists them; upvote_feedback the one that matches, or call again with force: true if none does. A new request returns its page URL; the human gets a thank-you email and one for every status change until it ships.

NameTypeReqDescription
bodystring–Details: the use case, what the output should look like.
forceboolean–File it even though similar items exist. Only after checking that none of the returned similar items matches.
titlestringyesShort summary, e.g. "Interior views".
NameTypeReqDescription
createdbooleanyes–
data–yes–
request_idstringyes–
similararrayyes–

No examples provided.

resolve_vehicle ~207

Free. The first call for any picture of a car, including one you chose yourself: turn a request such as "red 2018 Mazda MX-5 Miata side view" into the catalog vehicle and exact get_car_image parameters (vehicle_id, make, model, year, view, color), plus alternative candidates and a confidence of high, medium or low. A make and model are read by the rules the image tools read them with, so this names the vehicle they would render. Pass params.vehicle_id as vehicle to get_car_image, create_car_image_urls or create_3d_model. Ask the human to choose when confidence is low or several candidates fit, and tell them when params.year is not the year they asked for (extracted.year).

NameTypeReqDescription
querystringyesWhat the human asked for, in words: year, make and model, plus the view and color when they named them, e.g. "red 2024 porsche 911 side view".
NameTypeReqDescription
clistringyes–
dataobjectyes–

No examples provided.

search_vehicles ~224

Free. Browse the open vehicle catalog (1,608 makes, 42,312 models, 1990-2027) by make and/or model with typo tolerance. Returns canonical make/model names, the years each model exists and match kind; a model hit carries a stable vehicle id per year (ids, and id when the query names one year) to pass as `vehicle` to the image and 3D tools. Use it to list a make's models, to see which years exist or to let the human choose between similar models; when you already know which car is wanted, resolve_vehicle is the one call that names it.

NameTypeReqDescription
limitinteger–Maximum number of results (1-25).
querystringyesFree text: make and/or model, optional year, typos tolerated, e.g. "porshe 911" or "2019 f150". Fewer words find more: every word must be in the name of one catalog vehicle.
yearinteger–Restrict results to one model year.
NameTypeReqDescription
dataobjectyes–

No examples provided.

submit_review ~248

Free. Post or edit the human's public review of Car Image (one per account, 1-5 stars, their own words; never invent or nudge a rating). Shown on the reviews page with the team's answer once it passes a quick check. Set marketing_consent only when they agree to be quoted. Editing replaces the displayed public review; confirm the replacement text with the human. One edit an hour; the first post gets a thank-you email.

NameTypeReqDescription
bodystring–The review, in the human's words.
dislikesstring–What could be better.
display_companystring–A company to show, only if they want one.
display_namestring–The name to show. Defaults to their first name.
likesstring–What works well.
marketing_consentboolean–true only if the human agreed that Car Image may quote it in marketing. Default false.
ratingintegeryes1 to 5 stars, the human's own rating.
titlestring–A headline, in the human's words.
use_casestring–What they use the API for.
NameTypeReqDescription
createdbooleanyes–
dataobjectyes–
request_idstringyes–

No examples provided.

upvote_feedback ~89

Free. Add the human's vote to a feature, vehicle request or published issue (idempotent): the way to say "me too" instead of filing a duplicate. They follow it from then on and hear about every status change. A vote on a merged item lands on the item it was merged into.

NameTypeReqDescription
idstringyesThe item id to upvote. Idempotent.
NameTypeReqDescription
dataobjectyes–
request_idstringyes–

No examples provided.

Install

How do I install the Car Image API MCP server?

Car Image API runs locally as an npm package, launched with npx -y @meterapp/car-image. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @meterapp/car-image

# add to Claude Code
claude mcp add dev-carimage-car-image -- npx -y @meterapp/car-image
Common questions

What is the Car Image API MCP server?

Car Image API is an MCP server listed in the public MCP registry as dev.carimage/car-image. Studio-quality images and 3D models of any real car, 1990-2027, by make, model, year or VIN. This page covers its npm package (@meterapp/car-image).

Is the Car Image API MCP server safe to use?

Car Image API scores 62 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Car Image API MCP server expose?

Car Image API exposes 12 tools: get_car_image, create_car_image_urls, search_vehicles, resolve_vehicle, decode_vin, and 7 more. Their descriptions and schemas cost roughly 4,309 tokens of context every time the server is loaded.

Is the Car Image API MCP server still maintained?

Car Image API is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Car Image API MCP server under?

Car Image API declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.