Snowkit
NPM · SNOWKIT
Private tools that run on your computer: PDFs, QR codes, JSON, SQL, text, colours and cron.
Available components
Last scanned (4 hours ago)
Scores higher than 33% of npm servers
Category Documents and Files
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security80
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 4.6.5, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 33 of 98 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability71
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2292 tokens (~127/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
- Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 0 to 3. That category is still filling its 30-day observation window: 0 days of observed history at the previous scan, 1 at this one. The score rises as the window fills, whether or not the server changes.
- 4 Nov 26 64
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/snowkit@0.1.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 98 packages
| Packages resolved | 98 |
|---|---|
| Stale | 33 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
color_convert Convert a colour ~99
Show a colour as hex, RGB, HSL, HSV and OKLCH with its nearest named colour. Give a second colour to get the WCAG contrast ratio and pass or fail results.
| Name | Type | Req | Description |
|---|---|---|---|
| against | string | – | A second colour, such as a background, to check contrast. |
| color | string | yes | Such as #336699, rgb(51 102 153), hsl(210 50% 40%) or teal. |
No output schema declared.
No examples provided.
cron_explain Explain a cron schedule ~83
Describe a five-field cron expression in plain English and list its next run times.
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | How many upcoming runs to list. Defaults to 5. |
| expression | string | yes | Such as "*/15 9-17 * * 1-5". |
| utc | boolean | – | List times in UTC instead of this computer's time zone. |
No output schema declared.
No examples provided.
head_check Check head tags ~69
Check a web page's HTML for a missing or too-long title and description, share image, canonical and other head tags, with what to fix.
| Name | Type | Req | Description |
|---|---|---|---|
| html | string | – | The page's HTML. Use this or input. |
| input | string | – | Path to an HTML file to read instead. |
No output schema declared.
No examples provided.
head_tags Make head tags ~196
Write the title, description, canonical, Open Graph and Twitter tags for a web page, ready to paste into its <head>.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | One or two sentences, about 155 characters at most. |
| image | string | – | Full address of a 1200 x 630 share image. |
| image_alt | string | – | A short description of the share image. |
| noindex | boolean | – | Ask search engines not to list the page. Defaults to false. |
| site_name | string | – | The site or app name. |
| theme_color | string | – | A hex colour for the browser bar, such as #2f7cf6. |
| title | string | – | The page title, about 60 characters at most. |
| string | – | The site's X handle, with or without @. | |
| url | string | – | The page's full address, used as the canonical and og:url. |
No output schema declared.
No examples provided.
image_info Image metadata ~51
Show what a JPEG, PNG or WebP photo reveals about itself: camera, date, editing software and the GPS location where it was taken, if any.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Path to the image. |
No output schema declared.
No examples provided.
image_strip_metadata Remove image metadata ~126
Remove the hidden location, camera details, dates and comments from a JPEG, PNG or WebP photo without changing the picture. Saves next to the original as name-clean unless output is set.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Path to the image. |
| keep_color_profile | boolean | – | Keep the colour profile so colours look the same. Defaults to true. |
| output | string | – | Where to save the result. Defaults to the image's name with -clean, in the same folder. |
| overwrite | boolean | – | Replace the output file if it already exists. Defaults to false. |
No output schema declared.
No examples provided.
json_format Format JSON ~142
Pretty-print or minify JSON, optionally sorting keys. Large numbers keep every digit and errors point to the line and column.
| Name | Type | Req | Description |
|---|---|---|---|
| indent | integer | – | Spaces per level. Defaults to 2. |
| input | string | – | Path to a file to read instead of text. |
| minify | boolean | – | Put everything on one line. |
| output | string | – | Save the result to this file instead of returning it. |
| overwrite | boolean | – | Replace the output file if it already exists. Defaults to false. |
| sort_keys | boolean | – | Sort object keys A to Z. |
| text | string | – | The text itself. Use this or input. |
No output schema declared.
No examples provided.
json_validate Validate JSON ~97
Check that JSON is valid and, optionally, that it matches a JSON Schema. Reports the line and column of syntax errors and the path of every schema problem.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | – | Path to a file to read instead of text. |
| schema | string | – | A JSON Schema as text. |
| schema_path | string | – | Path to a JSON Schema file. |
| text | string | – | The text itself. Use this or input. |
No output schema declared.
No examples provided.
markdown_to_pdf Markdown to PDF ~188
Turn Markdown into a clean, paginated PDF with headings, lists, tables, code blocks and links. Uses built-in fonts for Western European text; images are left out. Saves beside the Markdown file unless output is set.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | – | Path to a Markdown file. Use this or markdown. |
| markdown | string | – | The Markdown text itself. Needs an output path. |
| output | string | – | Where to save the result. Defaults to the Markdown file's name with .pdf, in the same folder. |
| overwrite | boolean | – | Replace the output file if it already exists. Defaults to false. |
| page | string | – | Paper size. Defaults to Letter or A4 based on the computer's region. |
| page_numbers | boolean | – | Add page numbers at the foot of each page. |
| title | string | – | Document title. Defaults to the first heading. |
No output schema declared.
No examples provided.
pdf_extract_pages Extract PDF pages ~148
Copy chosen pages of a PDF into a new PDF, in the order listed. Also works to reorder, duplicate or drop pages. Saves as name-extracted.pdf beside the original unless output is set.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Path of the PDF. |
| output | string | – | Where to save the result. Defaults to the original's name with -extracted, in the same folder. |
| overwrite | boolean | – | Replace the output file if it already exists. Defaults to false. |
| pages | string | yes | Pages in order, such as "1-3, 7, 10-", "5-1" for reverse, "odd", "even" or "last". |
No output schema declared.
No examples provided.
pdf_info PDF details ~52
Read a PDF's page count, page sizes, file size, PDF version, form fields, password protection and document details such as title and author. Changes nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Path of the PDF. |
No output schema declared.
No examples provided.
pdf_merge Merge PDFs ~100
Combine two or more PDF files into one, in the order given. Saves next to the first file as name-merged.pdf unless output is set.
| Name | Type | Req | Description |
|---|---|---|---|
| inputs | array | yes | Paths of the PDF files, in order. |
| output | string | – | Where to save the result. Defaults to the first file's name with -merged, in the same folder. |
| overwrite | boolean | – | Replace the output file if it already exists. Defaults to false. |
No output schema declared.
No examples provided.
pdf_rotate Rotate PDF pages ~160
Turn all or some pages of a PDF by 90, 180 or 270 degrees clockwise, or -90 for anticlockwise. Everything else in the file is kept. Saves as name-rotated.pdf unless output is set.
| Name | Type | Req | Description |
|---|---|---|---|
| angle | – | yes | Degrees clockwise: 90, 180, 270, or -90. |
| input | string | yes | Path of the PDF. |
| output | string | – | Where to save the result. Defaults to the original's name with -rotated, in the same folder. |
| overwrite | boolean | – | Replace the output file if it already exists. Defaults to false. |
| pages | string | – | Which pages to turn, such as "2, 4-6". Defaults to all pages. |
No output schema declared.
No examples provided.
pdf_split Split a PDF ~147
Split a PDF into several files: one per page by default, every N pages, or one file for each page range. Files are saved beside the original unless output_folder is set.
| Name | Type | Req | Description |
|---|---|---|---|
| every | integer | – | Start a new file every this many pages. Defaults to 1. |
| input | string | yes | Path of the PDF to split. |
| output_folder | string | – | An existing folder for the new files. Defaults to the original's folder. |
| overwrite | boolean | – | Replace the output file if it already exists. Defaults to false. |
| ranges | array | – | One file per range, such as ["1-3", "4-10", "11-"]. |
No output schema declared.
No examples provided.
qr_code Make a QR code ~159
Make a QR code for a link or any text, as SVG or PNG. Without an output path the SVG is returned as text. The content lives in the code itself, so it never expires.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Defaults to the output file's extension, or svg. |
| level | string | – | Error correction: L 7%, M 15%, Q 25%, H 30%. Defaults to M. |
| output | string | – | File to save, ending in .svg or .png. |
| overwrite | boolean | – | Replace the output file if it already exists. Defaults to false. |
| size | integer | – | Width in pixels. Defaults to 512. |
| text | string | yes | The link or text to encode. |
No output schema declared.
No examples provided.
sql_format Format SQL ~159
Tidy SQL into readable, indented lines, or minify it onto one line. Works with common dialects such as PostgreSQL, MySQL, SQLite and SQL Server.
| Name | Type | Req | Description |
|---|---|---|---|
| indent | integer | – | Spaces per level. Defaults to 2. |
| input | string | – | Path to a file to read instead of text. |
| keyword_case | string | – | How to write keywords. Defaults to upper. |
| minify | boolean | – | Put the query on one line and drop comments. |
| output | string | – | Save the result to this file instead of returning it. |
| overwrite | boolean | – | Replace the output file if it already exists. Defaults to false. |
| text | string | – | The text itself. Use this or input. |
No output schema declared.
No examples provided.
text_stats Text statistics ~63
Count words, characters, sentences, paragraphs and lines, estimate reading and speaking time, and score readability for English text.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | – | Path to a file to read instead of text. |
| text | string | – | The text itself. Use this or input. |
No output schema declared.
No examples provided.
text_transform Transform text ~189
Change text case (upper, lower, title, sentence, camel, pascal, snake, kebab, constant), turn each line into a URL slug, or remove duplicate lines while keeping the original order.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | What to do. |
| ignore_case | boolean | – | For dedupe: treat Apple and apple as the same line. |
| input | string | – | Path to a file to read instead of text. |
| output | string | – | Save the result to this file instead of returning it. |
| overwrite | boolean | – | Replace the output file if it already exists. Defaults to false. |
| remove_empty | boolean | – | For dedupe: also drop empty lines. |
| text | string | – | The text itself. Use this or input. |
| trim | boolean | – | For dedupe: ignore spaces at the start and end of lines when comparing. Defaults to true. |
No output schema declared.
No examples provided.
How do I install the Snowkit MCP server?
Snowkit runs locally as an npm package, launched with npx -y snowkit. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · snowkit
claude mcp add io-snowkit-snowkit -- npx -y snowkit
What is the Snowkit MCP server?
Snowkit is an MCP server listed in the public MCP registry as io.snowkit/snowkit. Private tools that run on your computer: PDFs, QR codes, JSON, SQL, text, colours and cron. This page covers its npm package (snowkit).
Is the Snowkit MCP server safe to use?
Snowkit scores 65 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Snowkit MCP server expose?
Snowkit exposes 18 tools: pdf_merge, pdf_split, pdf_extract_pages, pdf_rotate, pdf_info, and 13 more. Their descriptions and schemas cost roughly 2,228 tokens of context every time the server is loaded.
Is the Snowkit MCP server still maintained?
Snowkit is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Snowkit MCP server under?
Snowkit declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.