# Car Image API (npm · @meterapp/car-image)
Studio-quality images and 3D models of any real car, 1990-2027, by make, model, year or VIN.
- Trust score: 62/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-04
## Components
- remote · `carimage.dev`: 38/100, [markdown](https://verifymcp.io/servers/dev-carimage-car-image/api-mcp.md), [page](https://verifymcp.io/servers/dev-carimage-car-image/api-mcp)
- npm · `@meterapp/car-image`: 62/100 (this document), [markdown](https://verifymcp.io/servers/dev-carimage-car-image/meterapp-car-image.md), [page](https://verifymcp.io/servers/dev-carimage-car-image/meterapp-car-image)
## Channel facts
- Registry: `npm`
- Package: `@meterapp/car-image`
- Version: `1.29.2`
- Transport: `stdio`
## Trust breakdown
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)
Scored 2026-11-04.
- **Supply Chain Security**: 99/100
- No malware found by supply-chain analysis.
- No known CVEs affecting this package version or its production dependencies.
- No install/post-install scripts declared.
- 1 of 4 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 19/100
- Repository check failed: no source repository is declared.
- Provenance check failed: no build-provenance attestation is published.
- Clear OSI-approved license (MIT).
- Actively maintained (last published 0 days ago).
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 61/100
- AI-judged instruction clarity (excellent).
- Context-footprint check failed: tool/resource definitions use about 5081 tokens (~423/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
- Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
- Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).
- 100% of tool parameters carry a description.
- Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
- We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
- Implements a current MCP spec version (2026-07-28).
**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
## Install
### How do I install the Car Image API MCP server?
Car Image API runs locally as an npm package, launched with npx -y @meterapp/car-image. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
### Claude
```bash
claude mcp add dev-carimage-car-image -- npx -y @meterapp/car-image
```
### Cursor
```json
{
"mcpServers": {
"dev-carimage-car-image": {
"command": "npx",
"args": [
"-y",
"@meterapp/car-image"
]
}
}
}
```
### VS Code
```json
{
"servers": {
"dev-carimage-car-image": {
"command": "npx",
"args": [
"-y",
"@meterapp/car-image"
]
}
}
}
```
### Codex
```bash
codex mcp add dev-carimage-car-image -- npx -y @meterapp/car-image
```
### opencode
```json
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dev-carimage-car-image": {
"type": "local",
"command": [
"npx",
"-y",
"@meterapp/car-image"
],
"enabled": true
}
}
}
```
### OpenClaw
```bash
openclaw mcp add dev-carimage-car-image --command npx --arg -y --arg @meterapp/car-image
```
### Hermes
```yaml
mcp_servers:
dev-carimage-car-image:
command: "npx"
args: ["-y", "@meterapp/car-image"]
```
### Netclaw
```json
{
"McpServers": {
"dev-carimage-car-image": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@meterapp/car-image"
]
}
}
}
```
### Vellum
```bash
assistant mcp add dev-carimage-car-image -t stdio -c npx -a -y @meterapp/car-image
```
### Other
```json
{
"mcpServers": {
"dev-carimage-car-image": {
"command": "npx",
"args": [
"-y",
"@meterapp/car-image"
]
}
}
}
```
## Changelog
Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.
### 2026-11-04 (score 62, +15)
- [security improvement] Malware scan: unverified → pass
### 2026-11-03 (score 47)
First indexed and scored.
## MCP tools (12)
### `get_car_image` (~1251 tokens)
Get car image bytes
Show a vehicle in chat: returns the image as an MCP image the host displays inline with the result, and the bytes for a file. Name the vehicle, view and color in the reply; do not also mint a signed URL for the same image. Where the person cannot see tool images (a terminal), use create_car_image_urls instead. Counts one vehicle image (vehicle, color, angle) for the month on the account's plan, prepared yet or not; the same image again this month adds nothing. Legacy credit-meter accounts: COSTS 1 CREDIT per call, cached or generated. Call resolve_vehicle first (or search_vehicles, or decode_vin for a VIN) and pass the id it returns as `vehicle`: the lookup is free, and the catalog files cars under its own names (a Mazda "MX-5 Miata" is mx-5), so a make and model typed from memory can answer 404 for a car the catalog carries. Make, model and year are for callers that already hold catalog spellings. Nine camera angles, any paint color (fifteen named presets or any hex such as #1a2b3c), any width and height up to 1024 px (fit contain|cover|inside), transparent or on a solid background, optionally trimmed to the car and with a soft ground shadow (shadow: true). Returns the image (PNG/WebP/JPG; format auto delivers PNG here) plus usage metadata (credits_charged, vehicle_images used this month, or credits_remaining on the credit meter; source cache|generated, request_id, the vehicle with its vehicle_id). Use create_car_image_urls for web pages, apps, emails and documents, and in a terminal. Do not call both paid tools for one image.
Input parameters:
- `background` (string): Solid background: a hex color such as "#f4f4f4" or a CSS color name such as "white" or "whitesmoke". Omit for transparent (jpg is white).
- `color` (string): Paint color: one of the presets (white, black, gray, silver, blue, red, green, brown, beige, tan, orange, yellow, gold, burgundy, purple), a CSS color name such as navy (grey is the gray preset) or a…
- `fit` (string): With width and height: contain (default) keeps the whole car and pads the rest; cover fills the box and crops; inside may return a smaller image.
- `format` (string): png keeps the transparent background (default); webp is smallest; jpg is flattened onto white; auto lets each viewer's Accept header choose webp or png, negotiated on every load of a signed URL. An i…
- `framing` (string): Composition preset, instead of trim/padding (never with them): consistent (default) keeps the camera scale every view of the vehicle shares, for galleries and spinners; tight = trim with no margin, t…
- `height` (integer): Explicit height in px, up to 1024 (a larger size is clamped, see width).
- `make` (string): Manufacturer, e.g. "Porsche", "BMW", "Toyota". Case and punctuation do not matter. Prefer vehicle; omit when it is given.
- `model` (string): Model as the catalog spells it, e.g. "911", "M3", "mx-5". Look it up (resolve_vehicle, search_vehicles) rather than typing it from memory: prefer vehicle. Conservative typos and reviewed vehicle-db a…
- `padding` (integer): Margin around a trimmed car, percent of its longer side (0-50). Only with trim.
- `shadow` (boolean): Add a soft ground shadow under the car, drawn from its cut-out (semi-transparent, or grey on a background). Same image, nothing extra.
- `size` (string): Square size preset: thumb=256, small=512, medium=768, large=1024 px. Omit for 1024 px.
- `trim` (boolean): Crop to the car's own bounds before sizing, so it fills the box instead of floating in the square source frame.
- `vehicle` (string): Stable vehicle id such as veh_395yw8tn73ff8, as resolve_vehicle (params.vehicle_id), search_vehicles and decode_vin return it. The preferred way to name a vehicle: it cannot be misspelled. It names t…
- `view` (string): Camera angle, in yaw order around the car: front (0°), front-3-4 (35°, the classic hero angle, nose left), side (profile, nose left), rear-3-4 (145°, nose left), rear (180°), rear-3-4-right (215°, no…
- `width` (integer): Explicit width in px, up to 1024; overrides size. With height too, the output is exactly width x height. A larger size is clamped: the box shrinks to 1024 on its longer side and keeps its shape (1920…
- `year` (integer): Model year, e.g. 2024. The catalog covers 1990 through next year. Omit when vehicle is given.
Output parameters:
- `content_type` (string)
- `credits_charged` (number|null)
- `credits_remaining` (number|null)
- `etag` (string|null)
- `height`
- `request_id` (string|null)
- `source`
- `vehicle` (object)
- `vehicle_images` (object)
- `width`
### `create_car_image_urls` (~711 tokens)
Create signed car image URLs
Put vehicle images into web pages, apps, emails and documents: create 1-50 key-free signed URLs a browser loads directly (![]()
), each with ready-to-display Markdown. To show a vehicle in chat, use get_car_image instead: the host displays it inline. Use these URLs in chat only where tool images do not reach the person (a terminal) or the human asks for a link: then paste each returned markdown in the final reply, outside code fences (or link the URL where images do not render), with ttl_seconds 604800, max_uses 0 and renewal off unless requested. Reuse unexpired URLs; never mint twice for one image. Each URL counts its vehicle image for the month at creation (1 credit on the legacy credit meter); loads within the TTL add nothing and are publicly cacheable. Each image names its vehicle like get_car_image: look each distinct vehicle up once (resolve_vehicle, search_vehicles or decode_vin, all free) and pass its id as vehicle, or send make, model and year in catalog spelling. Each takes any paint color (a preset or a hex) and the same sizing options (width, height, fit, background, framing, trim, padding, shadow); format auto makes the URL serve webp or png per viewer. For email, CMS pages or documents that outlive a TTL, set renew: true with ttl_seconds 604800: the URL keeps serving past expiry, renewing in each opened week (one more credit per week on the legacy credit meter), for up to renew_days. Pass idempotency_key when the call might be repeated: a retry with the same key and arguments replays the first result instead of billing again. Returns id, url, markdown, expires_at, max_uses, renews_until and the normalized vehicle for each image. Prefer this over get_car_image for HTML, Markdown files, documents, emails and websites. State expiry briefly.
Input parameters:
- `idempotency_key` (string): Makes a retry safe. The same key with the same arguments within 24 hours replays the first result (idempotent_replayed: true) instead of minting and billing again; the same key with different argumen…
- `images` (array, required): One to fifty image requests. Each URL counts its vehicle image (vehicle, color, angle) for the month when created; the same image again this month adds nothing.
- `max_uses` (integer): Maximum redemptions per URL, 0 to 1000; 0 (default) means unlimited until expiry.
- `renew` (boolean): Auto-renew past the TTL: the first load in each further window of ttl_seconds renews the URL, until renew_days (no extra count on a plan; one more credit per window on the legacy credit meter, so pai…
- `renew_days` (integer): How long a renewable URL keeps renewing, 1 to 365 days from creation (default 365). Only with renew: true.
- `ttl_seconds` (integer): How long the URLs stay valid, 60 to 604800 seconds (7 days). Default 3600.
Output parameters:
- `billing` (object)
- `data` (array)
- `idempotent_replayed` (boolean)
- `request_id` (string)
### `search_vehicles` (~224 tokens)
Search the vehicle catalog
Free. Browse the open vehicle catalog (1,608 makes, 42,312 models, 1990-2027) by make and/or model with typo tolerance. Returns canonical make/model names, the years each model exists and match kind; a model hit carries a stable vehicle id per year (ids, and id when the query names one year) to pass as `vehicle` to the image and 3D tools. Use it to list a make's models, to see which years exist or to let the human choose between similar models; when you already know which car is wanted, resolve_vehicle is the one call that names it.
Input parameters:
- `limit` (integer): Maximum number of results (1-25).
- `query` (string, required): Free text: make and/or model, optional year, typos tolerated, e.g. "porshe 911" or "2019 f150". Fewer words find more: every word must be in the name of one catalog vehicle.
- `year` (integer): Restrict results to one model year.
Output parameters:
- `data` (object)
### `resolve_vehicle` (~207 tokens)
Resolve free text to image parameters
Free. The first call for any picture of a car, including one you chose yourself: turn a request such as "red 2018 Mazda MX-5 Miata side view" into the catalog vehicle and exact get_car_image parameters (vehicle_id, make, model, year, view, color), plus alternative candidates and a confidence of high, medium or low. A make and model are read by the rules the image tools read them with, so this names the vehicle they would render. Pass params.vehicle_id as vehicle to get_car_image, create_car_image_urls or create_3d_model. Ask the human to choose when confidence is low or several candidates fit, and tell them when params.year is not the year they asked for (extracted.year).
Input parameters:
- `query` (string, required): What the human asked for, in words: year, make and model, plus the view and color when they named them, e.g. "red 2024 porsche 911 side view".
Output parameters:
- `cli` (string)
- `data` (object)
### `decode_vin` (~226 tokens)
Decode a VIN
Free. Decode a full 17-character VIN, or a partial VIN of at least 5 characters with * for unknown positions, with NHTSA vPIC data: year, make, model, trim, series, body class, engine, transmission, manufacturer, plant and every decoded attribute. `vehicle` is the catalog vehicle it maps to, with the stable id to pass as `vehicle` to get_car_image, create_car_image_urls or create_3d_model, or null when the catalog does not carry that car. Use it whenever the human gives a VIN instead of a make and model. To show the vehicle, call create_car_image_urls with that id (1 credit per signed URL, loads at once when the image is already rendered).
Input parameters:
- `vin` (string, required): A full 17-character VIN, or a partial VIN of at least 5 characters with * for each unknown position. Case, spaces and dashes do not matter.
- `year` (integer): Model-year hint for the decoder; it flags a mismatch with the VIN's own year position.
Output parameters:
- `data` (object)
- `request_id` (string)
### `get_image_availability` (~480 tokens)
Check prepared images and quality
Free, read-only check before generating an image. Look the vehicle up first and pass its vehicle id. Check one view or omit view for all nine; pass the requested paint as color. cached true means the view is prepared: it serves quickly from storage, without waiting for a new render. Returns each view's quality (standard, enhanced or premium; null when no stored image), upgrade state, and render_eta for views not cached. It renders nothing, queues nothing and counts no image usage. This does not authorize a render or a quality upgrade. Unlike a public preview, this checks what an authenticated image request would serve, including the requested color.
Input parameters:
- `color` (string): Paint color: one of the presets (white, black, gray, silver, blue, red, green, brown, beige, tan, orange, yellow, gold, burgundy, purple), a CSS color name such as navy (grey is the gray preset) or a…
- `make` (string): Manufacturer, e.g. "Porsche", "BMW", "Toyota". Case and punctuation do not matter. Prefer vehicle; omit when it is given.
- `model` (string): Model as the catalog spells it, e.g. "911", "M3", "mx-5". Look it up (resolve_vehicle, search_vehicles) rather than typing it from memory: prefer vehicle. Conservative typos and reviewed vehicle-db a…
- `vehicle` (string): Stable vehicle id such as veh_395yw8tn73ff8, as resolve_vehicle (params.vehicle_id), search_vehicles and decode_vin return it. The preferred way to name a vehicle: it cannot be misspelled. It names t…
- `view` (string): Check one camera view; omit to check all nine views.
- `year` (integer): Model year, e.g. 2024. The catalog covers 1990 through next year. Omit when vehicle is given.
Output parameters:
- `data` (object)
- `request_id` (string)
### `check_vehicles` (~377 tokens)
Check which vehicles the catalog carries
Free. Check a list of up to 100 vehicles in one call before rendering any: which ones the catalog carries and under which vehicle id. Send each as the list spells it ({make, model, year}) or as a stored id ({vehicle}), with an optional ref that is echoed back. Each entry is read exactly as get_car_image would read it and answered as match (vehicle.id is the id to store and render by; vehicle.match is exact, or the looser rule that read the name), suggestion (not in the catalog as named; suggestions are real vehicles close to it, such as the same model in its nearest year, which is another car: ask the human before using one), miss (nothing close: skip it in every view and color) or invalid (error says what to fix). Use it for a catalog, a spreadsheet or any list of more than a few cars, instead of one lookup or one paid render per car; summary counts each status and the distinct vehicles a backfill would render. With views: true each match also carries views.prepared (0-9) and views.missing, which of its nine camera views are prepared now, and summary.views_complete counts the vehicles with all nine. A longer list is work for code: car-image check , or client.checkVehicles, 2,000 vehicles per request.
Input parameters:
- `vehicles` (array, required): 1 to 100 vehicles, each {make, model, year} as the list spells them or {vehicle} for a stored id, with an optional ref echoed back.
- `views` (boolean): true: each match also says which of its nine camera views are prepared now, as get_image_availability reports them (views.prepared 0-9 and views.missing). Free and read-only. Default false.
Output parameters:
- `data` (object)
- `request_id` (string)
### `get_account` (~69 tokens)
Get account
Free. Show the organization this connection acts for (data.organization, with the caller's role), usage this month (limits_usage: vehicle images used and included, keys, request rates) and the key's scopes. Every new account includes 100 free vehicle images a month. Check this before large batches.
Output parameters:
- `data` (object)
- `links` (object)
- `request_id` (string)
### `request_feature` (~166 tokens)
Request a feature
Free. When the human wishes the API did something it does not (new views, formats, endpoints, anything), file it on the public feedback board. Similar items are checked first: when some exist nothing is filed (created: false) and similar lists them; upvote_feedback the one that matches, or call again with force: true if none does. A new request returns its page URL; the human gets a thank-you email and one for every status change until it ships.
Input parameters:
- `body` (string): Details: the use case, what the output should look like.
- `force` (boolean): File it even though similar items exist. Only after checking that none of the returned similar items matches.
- `title` (string, required): Short summary, e.g. "Interior views".
Output parameters:
- `created` (boolean)
- `data`
- `request_id` (string)
- `similar` (array)
### `report_issue` (~261 tokens)
Report an issue
Free. Report a problem with Car Image itself (a failed or wrong render, an error that looks like a bug, a broken endpoint), with the human's agreement. Pass the failed call's request_id and what you know in context (endpoint, error_code, vehicle id, view, color): the team sees exactly what happened. Private to the human and the team. Similar open reports come back first, as with request_feature: upvote_feedback one that matches. The human gets an acknowledgement and an email when it is picked up and when it is fixed. Not for a vehicle the catalog lacks, and never include API keys.
Input parameters:
- `body` (string): What was called, what was expected, what happened.
- `context` (object): The identifiers of what went wrong. Checked against the account's own requests; never shown publicly.
- `force` (boolean): File it even though similar reports exist.
- `request_id` (string): The request_id of the failed call (from its error or X-Request-Id). The single most useful thing to attach.
- `title` (string, required): What went wrong, in a line, e.g. "Side views of the 2024 Camry return 502". No keys or personal data.
Output parameters:
- `created` (boolean)
- `data`
- `request_id` (string)
- `similar` (array)
### `upvote_feedback` (~89 tokens)
Upvote a feedback item
Free. Add the human's vote to a feature, vehicle request or published issue (idempotent): the way to say "me too" instead of filing a duplicate. They follow it from then on and hear about every status change. A vote on a merged item lands on the item it was merged into.
Input parameters:
- `id` (string, required): The item id to upvote. Idempotent.
Output parameters:
- `data` (object)
- `request_id` (string)
### `submit_review` (~248 tokens)
Review Car Image
Free. Post or edit the human's public review of Car Image (one per account, 1-5 stars, their own words; never invent or nudge a rating). Shown on the reviews page with the team's answer once it passes a quick check. Set marketing_consent only when they agree to be quoted. Editing replaces the displayed public review; confirm the replacement text with the human. One edit an hour; the first post gets a thank-you email.
Input parameters:
- `body` (string): The review, in the human's words.
- `dislikes` (string): What could be better.
- `display_company` (string): A company to show, only if they want one.
- `display_name` (string): The name to show. Defaults to their first name.
- `likes` (string): What works well.
- `marketing_consent` (boolean): true only if the human agreed that Car Image may quote it in marketing. Default false.
- `rating` (integer, required): 1 to 5 stars, the human's own rating.
- `title` (string): A headline, in the human's words.
- `use_case` (string): What they use the API for.
Output parameters:
- `created` (boolean)
- `data` (object)
- `request_id` (string)
## Diagnostics
Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/dev-carimage-car-image/meterapp-car-image#diagnostics
## Score history
- 2026-11-04: 62
- 2026-11-03: 47
## Common questions
### What is the Car Image API MCP server?
Car Image API is an MCP server listed in the public MCP registry as dev.carimage/car-image. Studio-quality images and 3D models of any real car, 1990-2027, by make, model, year or VIN. This page covers its npm package (@meterapp/car-image).
### Is the Car Image API MCP server safe to use?
Car Image API scores 62 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
### What tools does the Car Image API MCP server expose?
Car Image API exposes 12 tools: get_car_image, create_car_image_urls, search_vehicles, resolve_vehicle, decode_vin, and 7 more. Their descriptions and schemas cost roughly 4,309 tokens of context every time the server is loaded.
### Is the Car Image API MCP server still maintained?
Car Image API is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
### What licence is the Car Image API MCP server under?
Car Image API declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
## Links
- npm package: https://www.npmjs.com/package/@meterapp/car-image
- Socket report: https://socket.dev/npm/package/@meterapp/car-image
- Website: https://carimage.dev/
- Changelog RSS feed: https://verifymcp.io/servers/dev-carimage-car-image/meterapp-car-image.xml
- Changelog JSON feed: https://verifymcp.io/servers/dev-carimage-car-image/meterapp-car-image.json
- HTML version of this page: https://verifymcp.io/servers/dev-carimage-car-image/meterapp-car-image