Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

FindMe Photo

NPM · FINDME-MCP

Create wedding galleries, upload photos, and pull analytics on FindMe Photo from any AI assistant.

Available components

−1 this week 75 Trust /100

Last scanned (8 hours ago)

Scores higher than 50% of npm servers

Category E-commerce

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 30 of 125 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability71
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2454 tokens (~175/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
  • Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage91
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 73% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_event" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 −1
    • Stability: pass → 0.93 functional
  • 29 Oct 26 +1
    • Stability: 0.97 → pass security
    • Security disclosure: unverified → fail ▼ functional
  • 28 Oct 26 −1
    • Security disclosure: fail → unverified ▼ functional
    • Stability: pass → 0.97 functional
  • 24 Oct 26 −5
    • CVE-2023-54404 affects this package: high ▼ security
    • Known CVEs: pass → fail ▼ security
  • 22 Oct 26 0
    • Stability: 0.97 → pass security
  • 21 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 20 Oct 26 −1
    • Stability: pass → 0.93 functional
  • 17 Oct 26 +3
    • Stability: 0.80 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/findme-mcp@0.7.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 125 packages
Packages resolved 125
Stale 30
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 14 exposed · ~2,148 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
create_event ~462

Create a new FindMe event (a wedding/photo gallery). Returns the event id, a shareable access code, and gallery + QR URLs. Use when the photographer says things like "create an event for Sarah & Mike on April 22" or "make a new gallery called Johnson Wedding". CRITICAL — three album settings are user preferences: album_quality (storage resolution; tier-capped), enable_downloads (guest downloads on/off), is_collaborative (others can upload). DO NOT guess, infer, or fill in defaults for these three fields yourself — you have no way to know what the photographer prefers. On the FIRST call, omit all three of these fields (only pass name + optional date/description/tag). The tool will respond with either an interactive form (clients with elicitation support) or a structured needs_input JSON listing tier-allowed options and recommended defaults — surface those options to the photographer as a numbered multiple-choice list, never as an open-ended question, and wait for their answer. Only then call create_event again with the photographer's chosen values. The only exception: if the photographer explicitly states a preference in their initial message (e.g. "make it collaborative" or "use 4000px quality"), you may include those specific stated preferences. FindMe has a playful, confident voice — when the event is created, give a short upbeat reaction that names the gallery and its access code, and mention the album_quality (e.g. "stored at 4000px, your plan's top setting"). Do not use the same phrasing twice.

NameTypeReqDescription
album_qualitystring–Storage resolution. Tier-capped — call without this and the tool will return your allowed options.
descriptionstring–Optional description.
enable_downloadsboolean–Whether guests can download photos from the gallery.
event_datestring–Event date in YYYY-MM-DD format. Optional.
is_collaborativeboolean–Whether the album is shareable/collaborative — other people can upload photos to it.
namestringyesEvent name, e.g. "Sarah & Mike Wedding"
tagstring–Optional tag/category (e.g. "wedding", "corporate").

No output schema declared.

No examples provided.

delete_event ~66

Soft-delete an event. The event is hidden immediately and photos stop appearing in the gallery, but the data is kept for 7 days so it can be restored with restore_event if needed. After 7 days, the data is permanently purged.

NameTypeReqDescription
event_idstringyes–

No output schema declared.

No examples provided.

get_account_info ~147

Confirm which FindMe account and Google Drive connection this MCP session is operating on. Returns the FindMe email, plan tier, active event count, and the Google email that Drive is connected with (or null if not connected). ALWAYS call this once at the start of any conversation that involves listing events, uploading photos, importing from Drive, or any account-scoped action — and surface the result to the photographer in one short sentence so they can confirm or correct before any action is taken. If the FindMe email and the Drive Google email differ, name both explicitly. If Drive is not connected and the user asks to import, point them at https://findme.photo/profile to connect it.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_event ~60

Get full details for one event — includes stats: photo_count, video_count, total storage, guest visits, selfie searches. Use when the photographer asks about the status or stats of a specific gallery.

NameTypeReqDescription
event_idstringyesUUID of the event.

No output schema declared.

No examples provided.

get_event_analytics ~98

Get aggregated analytics for an event: guest visits, unique visitors, photos downloaded, selfie searches, and per-day breakdown. Default window is event creation to now. Use when the photographer asks things like "how many people viewed the Johnson wedding?" or "what was the download count?"

NameTypeReqDescription
event_idstringyes–
fromstring–YYYY-MM-DD start date
tostring–YYYY-MM-DD end date

No output schema declared.

No examples provided.

get_event_qr ~77

Get a QR code image (PNG) for an event's public gallery URL. Returns the image so the AI can display it to the photographer or save it. Useful for printing signage at events.

NameTypeReqDescription
event_idstringyes–
sizeinteger–Pixel size per side (128-2048). Default 512.

No output schema declared.

No examples provided.

get_upload_link ~187

Get a no-login "tap-to-upload" link for an event. Returns a URL the photographer opens on any device (phone or computer) to upload photos through the browser's native picker — no account or login required. THIS IS THE WAY TO UPLOAD when you can't read the photographer's local files (i.e. always, in ChatGPT and in Claude web/mobile — anywhere except a locally-installed Claude Desktop with the findme-mcp filesystem tool). When the photographer asks to add or upload photos, call this, then give them the link and tell them to tap it and pick their photos. The link is reusable and scoped to this one event; photos are resized to the album's quality automatically. FindMe has a playful, confident voice — hand over the link with a short, specific one-liner.

NameTypeReqDescription
event_idstringyesUUID of the event to upload to.

No output schema declared.

No examples provided.

get_usage ~58

Get the current-month usage for your FindMe account: API requests used/limit, rate limit per minute, storage used/limit, and active event count. Use when the photographer asks about their usage, quota, remaining requests, or plan limits.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_events ~93

List the photographer's events, most recent first. Returns up to 20 by default; use `cursor` for pagination. Filter with `created_after` (ISO date) to only show recent events.

NameTypeReqDescription
created_afterstring–ISO datetime. Only show events created after this.
cursorstring–Pagination cursor from a previous response.
limitinteger–Max 100. Default 20.

No output schema declared.

No examples provided.

restore_event ~46

Restore a soft-deleted event within the 7-day recovery window. Fails if the event is already active or past the 7-day cutoff.

NameTypeReqDescription
event_idstringyes–

No output schema declared.

No examples provided.

update_event ~269

Update fields on an existing event: name, event_date, description, tag, access_code, album_quality (storage resolution; changeable only before the first photo is uploaded, and tier-capped), enable_downloads (toggle guest downloads on/off), or is_collaborative (toggle whether other people can upload). Only include the fields you want to change. Use when the photographer wants to rename, re-date, re-code, change quality (pre-upload), or flip the downloads/collaborative toggles. If the photographer asks to change album_quality on an album that already has photos, the API will return a `conflict` error — relay that politely and explain they'd need to delete photos first.

NameTypeReqDescription
access_codestring–4-12 uppercase alphanumeric characters
album_qualitystring–Storage resolution. Changeable only before the first photo is uploaded; tier-capped.
descriptionstring|null––
enable_downloadsboolean–Whether guests can download photos.
event_datestring|null–YYYY-MM-DD or null to clear
event_idstringyes–
is_collaborativeboolean–Whether other people can upload to this album.
namestring––
tagstring|null––

No output schema declared.

No examples provided.

upload_photos_from_drive_folder ~152

Attempt to import photos from a Google Drive folder. IMPORTANT: this is not supported in chat-based AI assistants because Google's drive.file scope (the only Drive scope FindMe is verified for) does not allow apps to list folder contents. The tool always returns a redirect message pointing the photographer at the FindMe web app, where the Google Picker handles authorization in one click. Surface the message verbatim — do not retry or guess folder contents.

NameTypeReqDescription
event_idstring––
folder_idstring–Google Drive folder ID (optional, ignored).
folder_namestring–Optional folder name for display.
folder_urlstring–Google Drive folder URL (optional, ignored).

No output schema declared.

No examples provided.

upload_photos_from_paths ~280

Upload photos or videos from local file paths on the photographer's computer to a FindMe event. Each path can be a file, a directory (all supported files inside are uploaded), or a glob (basic). Supported formats: .jpg .jpeg .png .webp .mp4 .mov .webm. Max 50 files per call; auto-chunks if more are found. Max size per file: 50 MB for photos, 500 MB for videos. Photos are automatically resized to the album's storage quality before upload (full-size albums keep originals). This is the primary upload tool — prefer it when the photographer says things like "upload all photos in ~/Pictures/Sarah" or "add these files to the Johnson event". On success the response includes rich stats (duration, size, photo/video counts, faces indexing). FindMe has a playful, confident voice — present completions with a specific, upbeat one-liner that cites real numbers. Do not use the same phrasing twice.

NameTypeReqDescription
event_idstringyesUUID of the target event.
pathsarrayyesFile paths or directory paths. `~` expansion supported. Directories upload all supported files inside (non-recursive by default).
recursiveboolean–If true, recurse into subdirectories (max depth 10). Default false.

No output schema declared.

No examples provided.

upload_photos_from_urls ~153

Upload photos/videos from public URLs to a FindMe event. Useful when the photographer shares Dropbox links, direct Drive download URLs, or similar. The MCP server downloads each URL to a temp buffer and streams it to the event. Photos are automatically resized to the album's storage quality before upload (full-size albums keep originals). Max 50 URLs per call. On success the response includes rich stats (duration, size, photo/video counts). FindMe has a playful, confident voice — celebrate completions with a specific, upbeat one-liner that cites real numbers. Do not use the same phrasing twice.

NameTypeReqDescription
event_idstringyes–
urlsarrayyesPublic URLs returning image/video bytes.

No output schema declared.

No examples provided.

Install

How do I install the FindMe Photo MCP server?

FindMe Photo runs locally as an npm package, launched with npx -y findme-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · findme-mcp

# add to Claude Code
claude mcp add findmephoto-findme-mcp -- npx -y findme-mcp
Common questions

What is the FindMe Photo MCP server?

FindMe Photo is an MCP server listed in the public MCP registry as io.github.findmephoto/findme-mcp. Create wedding galleries, upload photos, and pull analytics on FindMe Photo from any AI assistant. This page covers its npm package (findme-mcp).

Is the FindMe Photo MCP server safe to use?

FindMe Photo scores 75 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the FindMe Photo MCP server expose?

FindMe Photo exposes 14 tools: get_account_info, get_upload_link, upload_photos_from_paths, upload_photos_from_urls, upload_photos_from_drive_folder, and 9 more. Their descriptions and schemas cost roughly 2,148 tokens of context every time the server is loaded.

Is the FindMe Photo MCP server still maintained?

FindMe Photo is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the FindMe Photo MCP server under?

FindMe Photo declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.