Car Image API
NPM · @METERAPP/CAR-IMAGE · 2 COMPONENTS
Studio-quality images and 3D models of any real car, 1990-2027, by make, model, year or VIN.
Available components
Last scanned (21 hours ago)
Scores higher than 31% of npm servers
Category Design and Media
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 1 of 4 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: no source repository is declared. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability61
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 5081 tokens (~423/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 3 Nov 26 47
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/@meterapp/car-image@1.29.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 4 packages
| Packages resolved | 4 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_vehicles Check which vehicles the catalog carries ~377
Free. Check a list of up to 100 vehicles in one call before rendering any: which ones the catalog carries and under which vehicle id. Send each as the list spells it ({make, model, year}) or as a stored id ({vehicle}), with an optional ref that is echoed back. Each entry is read exactly as get_car_image would read it and answered as match (vehicle.id is the id to store and render by; vehicle.match is exact, or the looser rule that read the name), suggestion (not in the catalog as named; suggestions are real vehicles close to it, such as the same model in its nearest year, which is another car: ask the human before using one), miss (nothing close: skip it in every view and color) or invalid (error says what to fix). Use it for a catalog, a spreadsheet or any list of more than a few cars, instead of one lookup or one paid render per car; summary counts each status and the distinct vehicles a backfill would render. With views: true each match also carries views.prepared (0-9) and views.missing, which of its nine camera views are prepared now, and summary.views_complete counts the vehicles with all nine. A longer list is work for code: car-image check <file>, or client.checkVehicles, 2,000 vehicles per request.
| Name | Type | Req | Description |
|---|---|---|---|
| vehicles | array | yes | 1 to 100 vehicles, each {make, model, year} as the list spells them or {vehicle} for a stored id, with an optional ref echoed back. |
| views | boolean | – | true: each match also says which of its nine camera views are prepared now, as get_image_availability reports them (views.prepared 0-9 and views.missing). Free and read-only. Default false. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | – |
| request_id | string | yes | – |
No examples provided.
create_car_image_urls Create signed car image URLs ~711
Put vehicle images into web pages, apps, emails and documents: create 1-50 key-free signed URLs a browser loads directly (<img src>), each with ready-to-display Markdown. To show a vehicle in chat, use get_car_image instead: the host displays it inline. Use these URLs in chat only where tool images do not reach the person (a terminal) or the human asks for a link: then paste each returned markdown in the final reply, outside code fences (or link the URL where images do not render), with ttl_seconds 604800, max_uses 0 and renewal off unless requested. Reuse unexpired URLs; never mint twice for one image. Each URL counts its vehicle image for the month at creation (1 credit on the legacy credit meter); loads within the TTL add nothing and are publicly cacheable. Each image names its vehicle like get_car_image: look each distinct vehicle up once (resolve_vehicle, search_vehicles or decode_vin, all free) and pass its id as vehicle, or send make, model and year in catalog spelling. Each takes any paint color (a preset or a hex) and the same sizing options (width, height, fit, background, framing, trim, padding, shadow); format auto makes the URL serve webp or png per viewer. For email, CMS pages or documents that outlive a TTL, set renew: true with ttl_seconds 604800: the URL keeps serving past expiry, renewing in each opened week (one more credit per week on the legacy credit meter), for up to renew_days. Pass idempotency_key when the call might be repeated: a retry with the same key and arguments replays the first result instead of billing again. Returns id, url, markdown, expires_at, max_uses, renews_until and the normalized vehicle for each image. Prefer this over get_car_image for HTML, Markdown files, documents, emails and websites. State expiry briefly.
| Name | Type | Req | Description |
|---|---|---|---|
| idempotency_key | string | – | Makes a retry safe. The same key with the same arguments within 24 hours replays the first result (idempotent_replayed: true) instead of minting and billing again; the same key with different argumen… |
| images | array | yes | One to fifty image requests. Each URL counts its vehicle image (vehicle, color, angle) for the month when created; the same image again this month adds nothing. |
| max_uses | integer | – | Maximum redemptions per URL, 0 to 1000; 0 (default) means unlimited until expiry. |
| renew | boolean | – | Auto-renew past the TTL: the first load in each further window of ttl_seconds renews the URL, until renew_days (no extra count on a plan; one more credit per window on the legacy credit meter, so pai… |
| renew_days | integer | – | How long a renewable URL keeps renewing, 1 to 365 days from creation (default 365). Only with renew: true. |
| ttl_seconds | integer | – | How long the URLs stay valid, 60 to 604800 seconds (7 days). Default 3600. |
| Name | Type | Req | Description |
|---|---|---|---|
| billing | object | yes | – |
| data | array | yes | – |
| idempotent_replayed | boolean | – | – |
| request_id | string | yes | – |
No examples provided.
decode_vin Decode a VIN ~226
Free. Decode a full 17-character VIN, or a partial VIN of at least 5 characters with * for unknown positions, with NHTSA vPIC data: year, make, model, trim, series, body class, engine, transmission, manufacturer, plant and every decoded attribute. `vehicle` is the catalog vehicle it maps to, with the stable id to pass as `vehicle` to get_car_image, create_car_image_urls or create_3d_model, or null when the catalog does not carry that car. Use it whenever the human gives a VIN instead of a make and model. To show the vehicle, call create_car_image_urls with that id (1 credit per signed URL, loads at once when the image is already rendered).
| Name | Type | Req | Description |
|---|---|---|---|
| vin | string | yes | A full 17-character VIN, or a partial VIN of at least 5 characters with * for each unknown position. Case, spaces and dashes do not matter. |
| year | integer | – | Model-year hint for the decoder; it flags a mismatch with the VIN's own year position. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | – |
| request_id | string | yes | – |
No examples provided.
get_account Get account ~69
Free. Show the organization this connection acts for (data.organization, with the caller's role), usage this month (limits_usage: vehicle images used and included, keys, request rates) and the key's scopes. Every new account includes 100 free vehicle images a month. Check this before large batches.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | – |
| links | object | – | – |
| request_id | string | – | – |
No examples provided.
get_car_image Get car image bytes ~1,251
Show a vehicle in chat: returns the image as an MCP image the host displays inline with the result, and the bytes for a file. Name the vehicle, view and color in the reply; do not also mint a signed URL for the same image. Where the person cannot see tool images (a terminal), use create_car_image_urls instead. Counts one vehicle image (vehicle, color, angle) for the month on the account's plan, prepared yet or not; the same image again this month adds nothing. Legacy credit-meter accounts: COSTS 1 CREDIT per call, cached or generated. Call resolve_vehicle first (or search_vehicles, or decode_vin for a VIN) and pass the id it returns as `vehicle`: the lookup is free, and the catalog files cars under its own names (a Mazda "MX-5 Miata" is mx-5), so a make and model typed from memory can answer 404 for a car the catalog carries. Make, model and year are for callers that already hold catalog spellings. Nine camera angles, any paint color (fifteen named presets or any hex such as #1a2b3c), any width and height up to 1024 px (fit contain|cover|inside), transparent or on a solid background, optionally trimmed to the car and with a soft ground shadow (shadow: true). Returns the image (PNG/WebP/JPG; format auto delivers PNG here) plus usage metadata (credits_charged, vehicle_images used this month, or credits_remaining on the credit meter; source cache|generated, request_id, the vehicle with its vehicle_id). Use create_car_image_urls for web pages, apps, emails and documents, and in a terminal. Do not call both paid tools for one image.
| Name | Type | Req | Description |
|---|---|---|---|
| background | string | – | Solid background: a hex color such as "#f4f4f4" or a CSS color name such as "white" or "whitesmoke". Omit for transparent (jpg is white). |
| color | string | – | Paint color: one of the presets (white, black, gray, silver, blue, red, green, brown, beige, tan, orange, yellow, gold, burgundy, purple), a CSS color name such as navy (grey is the gray preset) or a… |
| fit | string | – | With width and height: contain (default) keeps the whole car and pads the rest; cover fills the box and crops; inside may return a smaller image. |
| format | string | – | png keeps the transparent background (default); webp is smallest; jpg is flattened onto white; auto lets each viewer's Accept header choose webp or png, negotiated on every load of a signed URL. An i… |
| framing | string | – | Composition preset, instead of trim/padding (never with them): consistent (default) keeps the camera scale every view of the vehicle shares, for galleries and spinners; tight = trim with no margin, t… |
| height | integer | – | Explicit height in px, up to 1024 (a larger size is clamped, see width). |
| make | string | – | Manufacturer, e.g. "Porsche", "BMW", "Toyota". Case and punctuation do not matter. Prefer vehicle; omit when it is given. |
| model | string | – | Model as the catalog spells it, e.g. "911", "M3", "mx-5". Look it up (resolve_vehicle, search_vehicles) rather than typing it from memory: prefer vehicle. Conservative typos and reviewed vehicle-db a… |
| padding | integer | – | Margin around a trimmed car, percent of its longer side (0-50). Only with trim. |
| shadow | boolean | – | Add a soft ground shadow under the car, drawn from its cut-out (semi-transparent, or grey on a background). Same image, nothing extra. |
| size | string | – | Square size preset: thumb=256, small=512, medium=768, large=1024 px. Omit for 1024 px. |
| trim | boolean | – | Crop to the car's own bounds before sizing, so it fills the box instead of floating in the square source frame. |
| vehicle | string | – | Stable vehicle id such as veh_395yw8tn73ff8, as resolve_vehicle (params.vehicle_id), search_vehicles and decode_vin return it. The preferred way to name a vehicle: it cannot be misspelled. It names t… |
| view | string | – | Camera angle, in yaw order around the car: front (0°), front-3-4 (35°, the classic hero angle, nose left), side (profile, nose left), rear-3-4 (145°, nose left), rear (180°), rear-3-4-right (215°, no… |
| width | integer | – | Explicit width in px, up to 1024; overrides size. With height too, the output is exactly width x height. A larger size is clamped: the box shrinks to 1024 on its longer side and keeps its shape (1920… |
| year | integer | – | Model year, e.g. 2024. The catalog covers 1990 through next year. Omit when vehicle is given. |
| Name | Type | Req | Description |
|---|---|---|---|
| content_type | string | yes | – |
| credits_charged | number|null | yes | – |
| credits_remaining | number|null | – | – |
| etag | string|null | yes | – |
| height | – | yes | – |
| request_id | string|null | yes | – |
| source | – | yes | – |
| vehicle | object | yes | – |
| vehicle_images | object | – | – |
| width | – | yes | – |
No examples provided.
get_image_availability Check prepared images and quality ~480
Free, read-only check before generating an image. Look the vehicle up first and pass its vehicle id. Check one view or omit view for all nine; pass the requested paint as color. cached true means the view is prepared: it serves quickly from storage, without waiting for a new render. Returns each view's quality (standard, enhanced or premium; null when no stored image), upgrade state, and render_eta for views not cached. It renders nothing, queues nothing and counts no image usage. This does not authorize a render or a quality upgrade. Unlike a public preview, this checks what an authenticated image request would serve, including the requested color.
| Name | Type | Req | Description |
|---|---|---|---|
| color | string | – | Paint color: one of the presets (white, black, gray, silver, blue, red, green, brown, beige, tan, orange, yellow, gold, burgundy, purple), a CSS color name such as navy (grey is the gray preset) or a… |
| make | string | – | Manufacturer, e.g. "Porsche", "BMW", "Toyota". Case and punctuation do not matter. Prefer vehicle; omit when it is given. |
| model | string | – | Model as the catalog spells it, e.g. "911", "M3", "mx-5". Look it up (resolve_vehicle, search_vehicles) rather than typing it from memory: prefer vehicle. Conservative typos and reviewed vehicle-db a… |
| vehicle | string | – | Stable vehicle id such as veh_395yw8tn73ff8, as resolve_vehicle (params.vehicle_id), search_vehicles and decode_vin return it. The preferred way to name a vehicle: it cannot be misspelled. It names t… |
| view | string | – | Check one camera view; omit to check all nine views. |
| year | integer | – | Model year, e.g. 2024. The catalog covers 1990 through next year. Omit when vehicle is given. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | – |
| request_id | string | yes | – |
No examples provided.
report_issue Report an issue ~261
Free. Report a problem with Car Image itself (a failed or wrong render, an error that looks like a bug, a broken endpoint), with the human's agreement. Pass the failed call's request_id and what you know in context (endpoint, error_code, vehicle id, view, color): the team sees exactly what happened. Private to the human and the team. Similar open reports come back first, as with request_feature: upvote_feedback one that matches. The human gets an acknowledgement and an email when it is picked up and when it is fixed. Not for a vehicle the catalog lacks, and never include API keys.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | – | What was called, what was expected, what happened. |
| context | object | – | The identifiers of what went wrong. Checked against the account's own requests; never shown publicly. |
| force | boolean | – | File it even though similar reports exist. |
| request_id | string | – | The request_id of the failed call (from its error or X-Request-Id). The single most useful thing to attach. |
| title | string | yes | What went wrong, in a line, e.g. "Side views of the 2024 Camry return 502". No keys or personal data. |
| Name | Type | Req | Description |
|---|---|---|---|
| created | boolean | yes | – |
| data | – | yes | – |
| request_id | string | yes | – |
| similar | array | yes | – |
No examples provided.
request_feature Request a feature ~166
Free. When the human wishes the API did something it does not (new views, formats, endpoints, anything), file it on the public feedback board. Similar items are checked first: when some exist nothing is filed (created: false) and similar lists them; upvote_feedback the one that matches, or call again with force: true if none does. A new request returns its page URL; the human gets a thank-you email and one for every status change until it ships.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | – | Details: the use case, what the output should look like. |
| force | boolean | – | File it even though similar items exist. Only after checking that none of the returned similar items matches. |
| title | string | yes | Short summary, e.g. "Interior views". |
| Name | Type | Req | Description |
|---|---|---|---|
| created | boolean | yes | – |
| data | – | yes | – |
| request_id | string | yes | – |
| similar | array | yes | – |
No examples provided.
resolve_vehicle Resolve free text to image parameters ~207
Free. The first call for any picture of a car, including one you chose yourself: turn a request such as "red 2018 Mazda MX-5 Miata side view" into the catalog vehicle and exact get_car_image parameters (vehicle_id, make, model, year, view, color), plus alternative candidates and a confidence of high, medium or low. A make and model are read by the rules the image tools read them with, so this names the vehicle they would render. Pass params.vehicle_id as vehicle to get_car_image, create_car_image_urls or create_3d_model. Ask the human to choose when confidence is low or several candidates fit, and tell them when params.year is not the year they asked for (extracted.year).
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | What the human asked for, in words: year, make and model, plus the view and color when they named them, e.g. "red 2024 porsche 911 side view". |
| Name | Type | Req | Description |
|---|---|---|---|
| cli | string | yes | – |
| data | object | yes | – |
No examples provided.
search_vehicles Search the vehicle catalog ~224
Free. Browse the open vehicle catalog (1,608 makes, 42,312 models, 1990-2027) by make and/or model with typo tolerance. Returns canonical make/model names, the years each model exists and match kind; a model hit carries a stable vehicle id per year (ids, and id when the query names one year) to pass as `vehicle` to the image and 3D tools. Use it to list a make's models, to see which years exist or to let the human choose between similar models; when you already know which car is wanted, resolve_vehicle is the one call that names it.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of results (1-25). |
| query | string | yes | Free text: make and/or model, optional year, typos tolerated, e.g. "porshe 911" or "2019 f150". Fewer words find more: every word must be in the name of one catalog vehicle. |
| year | integer | – | Restrict results to one model year. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | – |
No examples provided.
submit_review Review Car Image ~248
Free. Post or edit the human's public review of Car Image (one per account, 1-5 stars, their own words; never invent or nudge a rating). Shown on the reviews page with the team's answer once it passes a quick check. Set marketing_consent only when they agree to be quoted. Editing replaces the displayed public review; confirm the replacement text with the human. One edit an hour; the first post gets a thank-you email.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | – | The review, in the human's words. |
| dislikes | string | – | What could be better. |
| display_company | string | – | A company to show, only if they want one. |
| display_name | string | – | The name to show. Defaults to their first name. |
| likes | string | – | What works well. |
| marketing_consent | boolean | – | true only if the human agreed that Car Image may quote it in marketing. Default false. |
| rating | integer | yes | 1 to 5 stars, the human's own rating. |
| title | string | – | A headline, in the human's words. |
| use_case | string | – | What they use the API for. |
| Name | Type | Req | Description |
|---|---|---|---|
| created | boolean | yes | – |
| data | object | yes | – |
| request_id | string | yes | – |
No examples provided.
upvote_feedback Upvote a feedback item ~89
Free. Add the human's vote to a feature, vehicle request or published issue (idempotent): the way to say "me too" instead of filing a duplicate. They follow it from then on and hear about every status change. A vote on a merged item lands on the item it was merged into.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The item id to upvote. Idempotent. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | – |
| request_id | string | yes | – |
No examples provided.
How do I install the Car Image API MCP server?
Car Image API runs locally as an npm package, launched with npx -y @meterapp/car-image. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @meterapp/car-image
claude mcp add dev-carimage-car-image -- npx -y @meterapp/car-image
What is the Car Image API MCP server?
Car Image API is an MCP server listed in the public MCP registry as dev.carimage/car-image. Studio-quality images and 3D models of any real car, 1990-2027, by make, model, year or VIN. This page covers its npm package (@meterapp/car-image).
Is the Car Image API MCP server safe to use?
Car Image API scores 62 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Car Image API MCP server expose?
Car Image API exposes 12 tools: get_car_image, create_car_image_urls, search_vehicles, resolve_vehicle, decode_vin, and 7 more. Their descriptions and schemas cost roughly 4,309 tokens of context every time the server is loaded.
Is the Car Image API MCP server still maintained?
Car Image API is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Car Image API MCP server under?
Car Image API declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.