io.github.Distribea/distribea-mcp
REMOTE · DISTRIBEA.COM · 2 COMPONENTS · SCANNED SEP 27
Generate images, video, music and voice from your CLI or AI agent. On-brand AI media toolkit.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security94
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- The endpoint enforces authorisation, advertised via RFC 9728 protected-resource metadata. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability0
- Transport blocked by authentication: the endpoint requires auth we don't have to verify streamable-http. See how to fix → View diagnostics → Unverified
Schema Quality & AI Usability0
- Schema blocked by authentication: the endpoint requires auth we don't have to read it. See how to fix → Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage blocked by authentication: the endpoint requires auth we don't have to read its tools.Unverified
Tool Safety0
- Tool safety blocked by authentication: the endpoint requires auth we don't have to read its tools.Unverified
Capabilities0
- Capabilities blocked by authentication: the endpoint requires auth we don't have to read them. See how to fix → Unverified
Unverified: 6 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm. Claim this server and supply a read-only token to verify it and lift the score.
How do I install the io.github.Distribea/distribea-mcp server?
io.github.Distribea/distribea-mcp is a hosted endpoint at https://distribea.com/api/mcp/remote, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · distribea.com
claude mcp add --transport http distribea-distribea-mcp 'https://distribea.com/api/mcp/remote'
{
"mcpServers": {
"distribea-distribea-mcp": {
"url": "https://distribea.com/api/mcp/remote"
}
}
} {
"servers": {
"distribea-distribea-mcp": {
"type": "http",
"url": "https://distribea.com/api/mcp/remote"
}
}
} [mcp_servers.distribea-distribea-mcp] url = "https://distribea.com/api/mcp/remote"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"distribea-distribea-mcp": {
"type": "remote",
"url": "https://distribea.com/api/mcp/remote",
"enabled": true
}
}
} openclaw mcp add distribea-distribea-mcp --url 'https://distribea.com/api/mcp/remote' --transport streamable-http
mcp_servers:
distribea-distribea-mcp:
url: "https://distribea.com/api/mcp/remote" {
"McpServers": {
"distribea-distribea-mcp": {
"Transport": "http",
"Url": "https://distribea.com/api/mcp/remote"
}
}
} assistant mcp add distribea-distribea-mcp -t streamable-http -u 'https://distribea.com/api/mcp/remote'
{
"mcpServers": {
"distribea-distribea-mcp": {
"type": "http",
"url": "https://distribea.com/api/mcp/remote"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 2 Sept 26 −40
- Endpoint reachability: reachable → behind authorisation ▼ security
- Transport: pass → unverified ▼ security
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Authorization: unverified → pass ▲ security
- First check of Authorization: partial security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: Schema blocked by authentication: the endpoint requires auth we don't have to read it. functional
- 28 Aug 26 0
- Stability: unverified → pass ▲ security
- HTTPS: unverified → pass ▲ security
- Injection markers: unverified → pass ▲ security
- HSTS header: fail → pass ▲ security
- Transport: fail → pass ▲ security
- First check of Judged manipulation: pass security
- Authorization: Authorisation not fully verified: no authorisation is required to call this server, and 12 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. security
- Endpoint reachability: not serving MCP → reachable ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Destructive annotations: 0 functional
- Schema quality: fair → excellent functional
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- HTTPS: pass → unverified ▼ security
- HSTS header: pass → fail ▼ security
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 9 Aug 26 0
- Endpoint reachability: reachable → not serving MCP ▼ security
- Stability: 0.43 → unverified ▼ security
- Transport: pass → fail ▼ security
- Authorization: Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the whole tool list to see what that exposes. security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 31 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 27 Sept 2026 · Probed https://distribea.com/api/mcp/remote
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=distribea.com | CN=YE2,O=Let's Encrypt,C=US | 8 Aug 2026 | 6 Nov 2026 | ECDSA 256 | ECDSA-SHA384 | 5434195d1fa561748f9abe1ddcabc81e2c7 |
| SANs: *.distribea.com, distribea.com | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of distribea.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| distribea.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On connection |
| HTTP status | 401 |
WWW-Authenticate challenge Bearer resource_metadata="https://distribea.com/.well-known/oauth-protected-resource/api/mcp/remote"
Bearer resource_metadata="https://distribea.com/.well-known/oauth-protected-resource/api/mcp/remote"| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| content-security-policy | default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'wasm-unsafe-eval' https://www.clarity.ms https://scripts.clarity.ms https://www.googletagmanager.com https://www.googleadservices.com https://js.stripe.com https://vercel.live https://unpkg.com https://fpnpmcdn.net https://fpjscdn.net https://connect.facebook.net https://www.redditstatic.com https://cdn.promotekit.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob: https://cdn.sanity.io https://distribea-categories-images.fra1.cdn.digitaloceanspaces.com https://distribea-categories-images.fra1.digitaloceanspaces.com https://distribea-music-uploads.fra1.cdn.digitaloceanspaces.com https://distribea-music-uploads.fra1.digitaloceanspaces.com https://images.unsplash.com https://images.pexels.com https://assets.mixkit.co https://i.pravatar.cc https://lh3.googleusercontent.com https://ui-avatars.com https://v3.fal.media https://v3b.fal.media https://v2.fal.media https://fal.media https://storage.googleapis |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | accelerometer=(), autoplay=(self), camera=(self), clipboard-read=(), clipboard-write=(self), display-capture=(), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(), hid=(), identity-credentials-get=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(self "https://js.stripe.com" "https://checkout.stripe.com"), picture-in-picture=(self), publickey-credentials-create=(self), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), storage-access=(self), usb=(), web-share=(self), window-management=(), xr-spatial-tracking=(), interest-cohort=(), browsing-topics=(), join-ad-interest-group=(), run-ad-auction=(), attribution-reporting=() |
| www-authenticate | Bearer resource_metadata="https://distribea.com/.well-known/oauth-protected-resource/api/mcp/remote" |
Protected resource metadata
| Document | https://distribea.com/.well-known/oauth-protected-resource/api/mcp/remote |
|---|---|
| Retrieved | Yes |
| Resource | https://distribea.com/api/mcp/remote |
| Authorisation server | https://tcvpvraivvwxfrlymqgn.supabase.co/auth/v1 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://distribea.com/api/mcp/remote | Auth required | 401 | |
| http (plaintext) | http://distribea.com/api/mcp/remote | HTTPS enforced | 308 | https://distribea.com/api/mcp/remote |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
blog_cover Cover (and illustrations) for an article ~226
Generates the 16:9 cover of an editorial article from ITS specific topic (never a generic photo), consistent with the site's style. Returns the CDN URL + an <img> tag. Provide the article via article_text (pasted text) or article_url (public link). illustrations:N adds N images inside the article.
| Name | Type | Req | Description |
|---|---|---|---|
| article_text | string | – | The article text (title + body), pasted directly |
| article_url | string | – | Public URL of the article — its text is read for you |
| character | string | – | Optional: name/role of a locked character to deliberately feature on the cover |
| illustrations | number | – | Extra images inside the article (default 0, max 5) |
| orientation | string | – | Cover shape — default "wide" (16:9) |
| product | string | – | Optional: name of a locked product to deliberately feature on the cover |
| project | string | – | Optional: site identifier. Default: "lovable". |
| title | string | – | Optional title (overrides the one read from the source) |
No output schema declared.
No examples provided.
brand_pack Logo, favicon pack, social (link-preview) image ~289
The brand finishing pack. action 'all' (default) chains: logo (clean lettering, correct spelling) + favicon pack (favicon.ico, apple-touch-icon, 192/512 PNG incl. maskable, site.webmanifest) + social image (og:image, needs a title). Or one piece: 'logo' | 'favicons' | 'social_image'. Returns the logo as an <img> to place in the header, the favicon FILES (base64) to write into /public + the <head> tags, and the og:image <meta> tags. Optionally derive the favicon from a given logo via image_base64/image_url.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Default 'all' |
| background | string | – | favicons: solid background colour behind the icon (default white) |
| image_base64 | string | – | favicons: optional existing logo/icon (base64) to derive the pack from |
| image_url | string | – | favicons: optional logo/icon URL to derive the pack from |
| project | string | – | Optional: site identifier. Default: "lovable". |
| subtitle | string | – | social_image: optional smaller subtitle |
| tagline | string | – | logo: optional small tagline under the brand name |
| title | string | – | social_image: title written on the image (required for social_image; also enables it in 'all') |
No output schema declared.
No examples provided.
bring_alive Bring a page to life (propose new spots + replace existing images) ~242
Make an EXISTING page feel alive with on-brand imagery. It PROPOSES (free, generates nothing): (1) where to ADD images in sections that have none (hero, testimonials, team/about, a key benefit, gallery…), and (2) it returns the page's EXISTING <img> tags so you can REPLACE them too. DEFAULT BEHAVIOR — replace every existing image with an on-brand one UNLESS the user explicitly asks to keep a specific image; if the user only wants to add images, leave the existing ones untouched. WORKFLOW: show both lists, ask which to KEEP; then for approved NEW spots insert the given <img> placeholder at its anchor and call generate_image to fill it, AND for each existing image to replace, call generate_image with a matching subject and swap that image's src. Use this BEFORE generate_image whenever a page's imagery is missing or off-brand. Pass the page's current code as page_text.
| Name | Type | Req | Description |
|---|---|---|---|
| page_text | string | yes | The current code (or visible text) of the page to bring alive |
| project | string | – | Optional: site identifier. Default: "lovable". |
No output schema declared.
No examples provided.
create_reference Lock a real photo (face, product or shop) reused identically ~316
Register a REAL photo so Distribea reuses it IDENTICALLY in generated images — the user's own person, product or place. kind 'character' = a recurring face (founder, baker…), 'product' = the exact same object, 'place' = the real shop/location. Give the photo as image_base64 (the uploaded file's bytes — MOST RELIABLE) or image_url (a PUBLIC image URL). Free (0 credits) when a photo is given. AFTER this, call generate_image with character:"<name>" (or product:"<name>") to feature that exact reference in a scene. For a whole product range at once, pass items:[{name,image_base64|image_url}].
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Optional physical description (product/place) |
| image_base64 | string | – | The photo bytes as base64 (raw or data-uri). Preferred — works even when the image isn't on a public URL. |
| image_url | string | – | Public URL of the photo (fallback if no base64) |
| items | array | – | Register several products/places at once: each {name, image_base64 or image_url, description?}. |
| kind | string | – | Default 'character' (a recurring face) |
| name | string | – | What to call it: a role ("le boulanger"), a product name ("Tarte pralinée"), or a place ("la boulangerie") |
| project | string | – | Optional: site identifier. Default: "lovable". |
No output schema declared.
No examples provided.
edit_image Retouch an existing image (edit, redo, cutout, upscale, extend) ~269
Retouch an image the user already has (pass it as image_base64 or image_url). action 'edit' (default): a plain-language change (remove an object, change the background, relight; apply_style=true to also match the site's locked look); 'redo': a feedback tweak; 'remove_background': transparent PNG cutout; 'upscale': ×4; 'extend': widen to a new aspect_ratio, the scene continues seamlessly. Returns the NEW image's CDN URL + an <img> tag — swap the original's src with it. Billed; use only on the user's explicit request.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Default 'edit' |
| apply_style | boolean | – | edit only: also match the site's locked style |
| aspect_ratio | string | – | extend only: target frame (default 21:9) |
| image_base64 | string | – | The image to retouch, as base64 (preferred) |
| image_url | string | – | Public URL of the image to retouch (fallback) |
| instruction | string | – | edit/redo: what to change, plain language |
| out_format | string | – | Output format (default webp; cutouts stay png) |
| project | string | – | Optional: site identifier. Default: "lovable". |
No output schema declared.
No examples provided.
forget_project Forget a project's memory (start fresh) ~65
Wipe a project's saved memory (locked style, characters, products) so it starts fresh. Nothing on the page is touched. Free. Use when a reused project carries over unwanted style or products.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | – | Site identifier to wipe. Default: "lovable". |
No output schema declared.
No examples provided.
generate_image Generate a brand image for a site ~234
Generates ONE image consistent with the site's style and returns its CDN URL + a ready-to-paste <img> tag. A subject mentioning a review/testimonial/avatar automatically switches to a realistic customer selfie (UGC). Ideal for heroes, about, sections, cards…
| Name | Type | Req | Description |
|---|---|---|---|
| brand_text | boolean | – | If true, the brand name appears as a clean physical sign in the image |
| character | string | – | Optional: name/role of a locked character to feature (same face). Pass "none" to FORCE no face (stops a locked founder/team face being auto-attached here). |
| cross_site_unique | boolean | – | Review/avatar subjects only. Default false. true = reviewer faces never repeat across ALL the user's sites. |
| orientation | string | – | Default: landscape |
| product | string | – | Optional: name of a locked product to show (identical object) |
| project | string | – | Optional: site identifier (to keep a consistent style across its images). Default: "lovable". |
| subject | string | yes | What the image shows, e.g. "hero photo: modern villa at sunrise" |
No output schema declared.
No examples provided.
generate_with_model Generate an image with a chosen model + settings ~263
Advanced/manual mode: generate an image with a SPECIFIC model and settings the user picked, billed at the regular site price. Use this when the user names a model or wants control over quality/format/number of images; otherwise use generate_image (auto robot). Get valid ids + options from list_models. Returns CDN URL(s) + ready-to-paste <img> tag(s).
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | Optional number of images (1..max for the model, see list_models). Default 1. Free/trial accounts are limited to 1. |
| format | string | – | Optional aspect ratio, e.g. "16:9", "1:1", "9:16" (see list_models for what the model supports). |
| model | string | yes | Model id from list_models, e.g. "flux-2.0-pro" or "nano-banana-pro". |
| project | string | – | Optional: site identifier. Default: "lovable". |
| quality | string | – | Optional quality tier, e.g. "1K"/"2K"/"4K" (see list_models). Ignored when the model has a fixed native size. |
| subject | string | yes | What the image shows (the prompt). |
No output schema declared.
No examples provided.
list_models List the image models the user can pick ~70
Returns the catalog of image models to choose from: id, name, what it's best at, quality tiers, formats, max images per call, and an indicative price in credits. Call this BEFORE generate_with_model when the user wants to pick a specific model or compare options/prices. Image only for now.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_projects List your Distribea projects ~63
List the projects saved on the account (name, brand, image count, products). To keep working on one, reuse its name in the project: parameter of your calls. Free.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | – | Optional: current site identifier. Default: "lovable". |
No output schema declared.
No examples provided.
pack_status Credit balance and current style ~51
Shows the Distribea credit balance, the locked style, the known characters/products/avatars, and the latest generated images. Free.
| Name | Type | Req | Description |
|---|---|---|---|
| project | string | – | Optional: site identifier. Default: "lovable". |
No output schema declared.
No examples provided.
site_style Set or adjust the site's visual style ~294
The site's art direction. action "setup": locks the style from a brief and/or the URL of an existing site (run this FIRST for consistent images). action "refine": plain-language feedback ("warmer") OR a correction of a misrepresented subject — the rule is recorded and honored by every subsequent image.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | "setup" (default) to set the style, "refine" to adjust/correct it, "lock_image" to anchor the style on an approved image (pass image_base64/image_url) |
| brief | string | – | setup: plain-language brand brief (business, mood…) |
| feedback | string | – | refine: what to change or correct, in plain language |
| force | boolean | – | setup: true to let the engine guess if the brief is short |
| image_base64 | string | – | lock_image: the approved image's bytes as base64 — its look becomes the permanent style anchor |
| image_url | string | – | lock_image: public URL of the approved image (fallback) |
| moodboard | boolean | – | setup, ONLY on request: also generate a 2×2 moodboard image of the locked style (billed as 1 image) |
| project | string | – | Optional: site identifier. Default: "lovable". |
| site_url | string | – | setup: URL of an existing site to draw inspiration from (optional) |
No output schema declared.
No examples provided.
What is the io.github.Distribea/distribea-mcp server?
io.github.Distribea/distribea-mcp is listed in the public MCP registry as io.github.Distribea/distribea-mcp. Generate images, video, music and voice from your CLI or AI agent. On-brand AI media toolkit. This page covers its hosted endpoint (https://distribea.com/api/mcp/remote).
Is the io.github.Distribea/distribea-mcp server safe to use?
io.github.Distribea/distribea-mcp scores 38 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.Distribea/distribea-mcp server expose?
io.github.Distribea/distribea-mcp exposes 12 tools: generate_image, list_models, generate_with_model, create_reference, blog_cover, and 7 more. Their descriptions and schemas cost roughly 2,382 tokens of context every time the server is loaded.
Does the io.github.Distribea/distribea-mcp server require authentication?
Yes. io.github.Distribea/distribea-mcp asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the io.github.Distribea/distribea-mcp server still maintained?
io.github.Distribea/distribea-mcp is still listed as active in the MCP registry. We last reached this channel on 27 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.