FindMe Photo
NPM · FINDME-MCP · SCANNED AUG 4
Create wedding galleries, upload photos, and pull analytics on FindMe Photo from any AI assistant.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security83
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (127 of 131), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 42 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability70
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2454 tokens (~175/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage91
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 73% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · findme-mcp
claude mcp add findmephoto-findme-mcp -- npx -y findme-mcp
codex mcp add findmephoto-findme-mcp -- npx -y findme-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"findmephoto-findme-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"findme-mcp"
],
"enabled": true
}
}
} openclaw mcp add findmephoto-findme-mcp --command npx --arg -y --arg findme-mcp
mcp_servers:
findmephoto-findme-mcp:
command: "npx"
args: ["-y", "findme-mcp"] {
"mcpServers": {
"findmephoto-findme-mcp": {
"command": "npx",
"args": [
"-y",
"findme-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Aug 26 0
- CVE-2026-69207 affects this package: medium ▼ security
- Known CVEs: partial → fail ▼ security
- 3 Aug 26 +4
- Stability: unverified → 0.27 ▲ functional
- 2 Aug 26 +40
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Maintenance: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 +5
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → pass ▲ functional
- 31 Jul 26 −6
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −1
- Malware scan: pass → unverified ▼ security
- Dependency health: partial → unverified ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: unverified functional
- First check of Schema quality: fail functional
- First check of Schema quality: fail functional
- First check of Tool coverage: 73 functional
- 28 Jul 26 +1
- Dependency health: unverified → partial ▲ functional
- 27 Jul 26 24
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-8j4g-w8fx-2239 | CVE-2026-69207 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | yes |
Dependencies 127 packages
127 packages in the resolved dependency tree · 127 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
create_event ~462
Create a new FindMe event (a wedding/photo gallery). Returns the event id, a shareable access code, and gallery + QR URLs. Use when the photographer says things like "create an event for Sarah & Mike on April 22" or "make a new gallery called Johnson Wedding". CRITICAL — three album settings are user preferences: album_quality (storage resolution; tier-capped), enable_downloads (guest downloads on/off), is_collaborative (others can upload). DO NOT guess, infer, or fill in defaults for these three fields yourself — you have no way to know what the photographer prefers. On the FIRST call, omit all three of these fields (only pass name + optional date/description/tag). The tool will respond with either an interactive form (clients with elicitation support) or a structured needs_input JSON listing tier-allowed options and recommended defaults — surface those options to the photographer as a numbered multiple-choice list, never as an open-ended question, and wait for their answer. Only then call create_event again with the photographer's chosen values. The only exception: if the photographer explicitly states a preference in their initial message (e.g. "make it collaborative" or "use 4000px quality"), you may include those specific stated preferences. FindMe has a playful, confident voice — when the event is created, give a short upbeat reaction that names the gallery and its access code, and mention the album_quality (e.g. "stored at 4000px, your plan's top setting"). Do not use the same phrasing twice.
| Name | Type | Req | Description |
|---|---|---|---|
| album_quality | string | — | Storage resolution. Tier-capped — call without this and the tool will return your allowed options. |
| description | string | — | Optional description. |
| enable_downloads | boolean | — | Whether guests can download photos from the gallery. |
| event_date | string | — | Event date in YYYY-MM-DD format. Optional. |
| is_collaborative | boolean | — | Whether the album is shareable/collaborative — other people can upload photos to it. |
| name | string | yes | Event name, e.g. "Sarah & Mike Wedding" |
| tag | string | — | Optional tag/category (e.g. "wedding", "corporate"). |
No output schema declared.
No examples provided.
delete_event ~66
Soft-delete an event. The event is hidden immediately and photos stop appearing in the gallery, but the data is kept for 7 days so it can be restored with restore_event if needed. After 7 days, the data is permanently purged.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | — |
No output schema declared.
No examples provided.
get_account_info ~147
Confirm which FindMe account and Google Drive connection this MCP session is operating on. Returns the FindMe email, plan tier, active event count, and the Google email that Drive is connected with (or null if not connected). ALWAYS call this once at the start of any conversation that involves listing events, uploading photos, importing from Drive, or any account-scoped action — and surface the result to the photographer in one short sentence so they can confirm or correct before any action is taken. If the FindMe email and the Drive Google email differ, name both explicitly. If Drive is not connected and the user asks to import, point them at https://findme.photo/profile to connect it.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_event ~60
Get full details for one event — includes stats: photo_count, video_count, total storage, guest visits, selfie searches. Use when the photographer asks about the status or stats of a specific gallery.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | UUID of the event. |
No output schema declared.
No examples provided.
get_event_analytics ~98
Get aggregated analytics for an event: guest visits, unique visitors, photos downloaded, selfie searches, and per-day breakdown. Default window is event creation to now. Use when the photographer asks things like "how many people viewed the Johnson wedding?" or "what was the download count?"
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | — |
| from | string | — | YYYY-MM-DD start date |
| to | string | — | YYYY-MM-DD end date |
No output schema declared.
No examples provided.
get_event_qr ~77
Get a QR code image (PNG) for an event's public gallery URL. Returns the image so the AI can display it to the photographer or save it. Useful for printing signage at events.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | — |
| size | integer | — | Pixel size per side (128-2048). Default 512. |
No output schema declared.
No examples provided.
get_upload_link ~187
Get a no-login "tap-to-upload" link for an event. Returns a URL the photographer opens on any device (phone or computer) to upload photos through the browser's native picker — no account or login required. THIS IS THE WAY TO UPLOAD when you can't read the photographer's local files (i.e. always, in ChatGPT and in Claude web/mobile — anywhere except a locally-installed Claude Desktop with the findme-mcp filesystem tool). When the photographer asks to add or upload photos, call this, then give them the link and tell them to tap it and pick their photos. The link is reusable and scoped to this one event; photos are resized to the album's quality automatically. FindMe has a playful, confident voice — hand over the link with a short, specific one-liner.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | UUID of the event to upload to. |
No output schema declared.
No examples provided.
get_usage ~58
Get the current-month usage for your FindMe account: API requests used/limit, rate limit per minute, storage used/limit, and active event count. Use when the photographer asks about their usage, quota, remaining requests, or plan limits.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_events ~93
List the photographer's events, most recent first. Returns up to 20 by default; use `cursor` for pagination. Filter with `created_after` (ISO date) to only show recent events.
| Name | Type | Req | Description |
|---|---|---|---|
| created_after | string | — | ISO datetime. Only show events created after this. |
| cursor | string | — | Pagination cursor from a previous response. |
| limit | integer | — | Max 100. Default 20. |
No output schema declared.
No examples provided.
restore_event ~46
Restore a soft-deleted event within the 7-day recovery window. Fails if the event is already active or past the 7-day cutoff.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | — |
No output schema declared.
No examples provided.
update_event ~269
Update fields on an existing event: name, event_date, description, tag, access_code, album_quality (storage resolution; changeable only before the first photo is uploaded, and tier-capped), enable_downloads (toggle guest downloads on/off), or is_collaborative (toggle whether other people can upload). Only include the fields you want to change. Use when the photographer wants to rename, re-date, re-code, change quality (pre-upload), or flip the downloads/collaborative toggles. If the photographer asks to change album_quality on an album that already has photos, the API will return a `conflict` error — relay that politely and explain they'd need to delete photos first.
| Name | Type | Req | Description |
|---|---|---|---|
| access_code | string | — | 4-12 uppercase alphanumeric characters |
| album_quality | string | — | Storage resolution. Changeable only before the first photo is uploaded; tier-capped. |
| description | string|null | — | — |
| enable_downloads | boolean | — | Whether guests can download photos. |
| event_date | string|null | — | YYYY-MM-DD or null to clear |
| event_id | string | yes | — |
| is_collaborative | boolean | — | Whether other people can upload to this album. |
| name | string | — | — |
| tag | string|null | — | — |
No output schema declared.
No examples provided.
upload_photos_from_drive_folder ~152
Attempt to import photos from a Google Drive folder. IMPORTANT: this is not supported in chat-based AI assistants because Google's drive.file scope (the only Drive scope FindMe is verified for) does not allow apps to list folder contents. The tool always returns a redirect message pointing the photographer at the FindMe web app, where the Google Picker handles authorization in one click. Surface the message verbatim — do not retry or guess folder contents.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | — | — |
| folder_id | string | — | Google Drive folder ID (optional, ignored). |
| folder_name | string | — | Optional folder name for display. |
| folder_url | string | — | Google Drive folder URL (optional, ignored). |
No output schema declared.
No examples provided.
upload_photos_from_paths ~280
Upload photos or videos from local file paths on the photographer's computer to a FindMe event. Each path can be a file, a directory (all supported files inside are uploaded), or a glob (basic). Supported formats: .jpg .jpeg .png .webp .mp4 .mov .webm. Max 50 files per call; auto-chunks if more are found. Max size per file: 50 MB for photos, 500 MB for videos. Photos are automatically resized to the album's storage quality before upload (full-size albums keep originals). This is the primary upload tool — prefer it when the photographer says things like "upload all photos in ~/Pictures/Sarah" or "add these files to the Johnson event". On success the response includes rich stats (duration, size, photo/video counts, faces indexing). FindMe has a playful, confident voice — present completions with a specific, upbeat one-liner that cites real numbers. Do not use the same phrasing twice.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | UUID of the target event. |
| paths | array | yes | File paths or directory paths. `~` expansion supported. Directories upload all supported files inside (non-recursive by default). |
| recursive | boolean | — | If true, recurse into subdirectories (max depth 10). Default false. |
No output schema declared.
No examples provided.
upload_photos_from_urls ~153
Upload photos/videos from public URLs to a FindMe event. Useful when the photographer shares Dropbox links, direct Drive download URLs, or similar. The MCP server downloads each URL to a temp buffer and streams it to the event. Photos are automatically resized to the album's storage quality before upload (full-size albums keep originals). Max 50 URLs per call. On success the response includes rich stats (duration, size, photo/video counts). FindMe has a playful, confident voice — celebrate completions with a specific, upbeat one-liner that cites real numbers. Do not use the same phrasing twice.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | — |
| urls | array | yes | Public URLs returning image/video bytes. |
No output schema declared.
No examples provided.