# Snowkit (npm · snowkit)

Private tools that run on your computer: PDFs, QR codes, JSON, SQL, text, colours and cron.

- Trust score: 65/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `snowkit`: 65/100 (this document), [markdown](https://verifymcp.io/servers/io-snowkit-snowkit/snowkit.md), [page](https://verifymcp.io/servers/io-snowkit-snowkit/snowkit)

## Channel facts

- Registry: `npm`
- Package: `snowkit`
- Version: `0.1.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 80/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects zod 4.6.5, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - 33 of 98 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2292 tokens (~127/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 3/100
  - Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Snowkit MCP server?

Snowkit runs locally as an npm package, launched with npx -y snowkit. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add io-snowkit-snowkit -- npx -y snowkit
```

### Cursor

```json
{
  "mcpServers": {
    "io-snowkit-snowkit": {
      "command": "npx",
      "args": [
        "-y",
        "snowkit"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-snowkit-snowkit": {
      "command": "npx",
      "args": [
        "-y",
        "snowkit"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add io-snowkit-snowkit -- npx -y snowkit
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-snowkit-snowkit": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "snowkit"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-snowkit-snowkit --command npx --arg -y --arg snowkit
```

### Hermes

```yaml
mcp_servers:
  io-snowkit-snowkit:
    command: "npx"
    args: ["-y", "snowkit"]
```

### Netclaw

```json
{
  "McpServers": {
    "io-snowkit-snowkit": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "snowkit"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-snowkit-snowkit -t stdio -c npx -a -y snowkit
```

### Other

```json
{
  "mcpServers": {
    "io-snowkit-snowkit": {
      "command": "npx",
      "args": [
        "-y",
        "snowkit"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 0 to 3. That category is still filling its 30-day observation window: 0 days of observed history at the previous scan, 1 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-04 (score 64)

First indexed and scored.

## MCP tools (18)

### `pdf_merge` (~100 tokens)

Merge PDFs

Combine two or more PDF files into one, in the order given. Saves next to the first file as name-merged.pdf unless output is set.

Input parameters:

- `inputs` (array, required): Paths of the PDF files, in order.
- `output` (string): Where to save the result. Defaults to the first file's name with -merged, in the same folder.
- `overwrite` (boolean): Replace the output file if it already exists. Defaults to false.

### `pdf_split` (~147 tokens)

Split a PDF

Split a PDF into several files: one per page by default, every N pages, or one file for each page range. Files are saved beside the original unless output_folder is set.

Input parameters:

- `every` (integer): Start a new file every this many pages. Defaults to 1.
- `input` (string, required): Path of the PDF to split.
- `output_folder` (string): An existing folder for the new files. Defaults to the original's folder.
- `overwrite` (boolean): Replace the output file if it already exists. Defaults to false.
- `ranges` (array): One file per range, such as ["1-3", "4-10", "11-"].

### `pdf_extract_pages` (~148 tokens)

Extract PDF pages

Copy chosen pages of a PDF into a new PDF, in the order listed. Also works to reorder, duplicate or drop pages. Saves as name-extracted.pdf beside the original unless output is set.

Input parameters:

- `input` (string, required): Path of the PDF.
- `output` (string): Where to save the result. Defaults to the original's name with -extracted, in the same folder.
- `overwrite` (boolean): Replace the output file if it already exists. Defaults to false.
- `pages` (string, required): Pages in order, such as "1-3, 7, 10-", "5-1" for reverse, "odd", "even" or "last".

### `pdf_rotate` (~160 tokens)

Rotate PDF pages

Turn all or some pages of a PDF by 90, 180 or 270 degrees clockwise, or -90 for anticlockwise. Everything else in the file is kept. Saves as name-rotated.pdf unless output is set.

Input parameters:

- `angle` (required): Degrees clockwise: 90, 180, 270, or -90.
- `input` (string, required): Path of the PDF.
- `output` (string): Where to save the result. Defaults to the original's name with -rotated, in the same folder.
- `overwrite` (boolean): Replace the output file if it already exists. Defaults to false.
- `pages` (string): Which pages to turn, such as "2, 4-6". Defaults to all pages.

### `pdf_info` (~52 tokens)

PDF details

Read a PDF's page count, page sizes, file size, PDF version, form fields, password protection and document details such as title and author. Changes nothing.

Input parameters:

- `input` (string, required): Path of the PDF.

### `markdown_to_pdf` (~188 tokens)

Markdown to PDF

Turn Markdown into a clean, paginated PDF with headings, lists, tables, code blocks and links. Uses built-in fonts for Western European text; images are left out. Saves beside the Markdown file unless output is set.

Input parameters:

- `input` (string): Path to a Markdown file. Use this or markdown.
- `markdown` (string): The Markdown text itself. Needs an output path.
- `output` (string): Where to save the result. Defaults to the Markdown file's name with .pdf, in the same folder.
- `overwrite` (boolean): Replace the output file if it already exists. Defaults to false.
- `page` (string): Paper size. Defaults to Letter or A4 based on the computer's region.
- `page_numbers` (boolean): Add page numbers at the foot of each page.
- `title` (string): Document title. Defaults to the first heading.

### `qr_code` (~159 tokens)

Make a QR code

Make a QR code for a link or any text, as SVG or PNG. Without an output path the SVG is returned as text. The content lives in the code itself, so it never expires.

Input parameters:

- `format` (string): Defaults to the output file's extension, or svg.
- `level` (string): Error correction: L 7%, M 15%, Q 25%, H 30%. Defaults to M.
- `output` (string): File to save, ending in .svg or .png.
- `overwrite` (boolean): Replace the output file if it already exists. Defaults to false.
- `size` (integer): Width in pixels. Defaults to 512.
- `text` (string, required): The link or text to encode.

### `json_format` (~142 tokens)

Format JSON

Pretty-print or minify JSON, optionally sorting keys. Large numbers keep every digit and errors point to the line and column.

Input parameters:

- `indent` (integer): Spaces per level. Defaults to 2.
- `input` (string): Path to a file to read instead of text.
- `minify` (boolean): Put everything on one line.
- `output` (string): Save the result to this file instead of returning it.
- `overwrite` (boolean): Replace the output file if it already exists. Defaults to false.
- `sort_keys` (boolean): Sort object keys A to Z.
- `text` (string): The text itself. Use this or input.

### `json_validate` (~97 tokens)

Validate JSON

Check that JSON is valid and, optionally, that it matches a JSON Schema. Reports the line and column of syntax errors and the path of every schema problem.

Input parameters:

- `input` (string): Path to a file to read instead of text.
- `schema` (string): A JSON Schema as text.
- `schema_path` (string): Path to a JSON Schema file.
- `text` (string): The text itself. Use this or input.

### `sql_format` (~159 tokens)

Format SQL

Tidy SQL into readable, indented lines, or minify it onto one line. Works with common dialects such as PostgreSQL, MySQL, SQLite and SQL Server.

Input parameters:

- `indent` (integer): Spaces per level. Defaults to 2.
- `input` (string): Path to a file to read instead of text.
- `keyword_case` (string): How to write keywords. Defaults to upper.
- `minify` (boolean): Put the query on one line and drop comments.
- `output` (string): Save the result to this file instead of returning it.
- `overwrite` (boolean): Replace the output file if it already exists. Defaults to false.
- `text` (string): The text itself. Use this or input.

### `text_stats` (~63 tokens)

Text statistics

Count words, characters, sentences, paragraphs and lines, estimate reading and speaking time, and score readability for English text.

Input parameters:

- `input` (string): Path to a file to read instead of text.
- `text` (string): The text itself. Use this or input.

### `text_transform` (~189 tokens)

Transform text

Change text case (upper, lower, title, sentence, camel, pascal, snake, kebab, constant), turn each line into a URL slug, or remove duplicate lines while keeping the original order.

Input parameters:

- `action` (string, required): What to do.
- `ignore_case` (boolean): For dedupe: treat Apple and apple as the same line.
- `input` (string): Path to a file to read instead of text.
- `output` (string): Save the result to this file instead of returning it.
- `overwrite` (boolean): Replace the output file if it already exists. Defaults to false.
- `remove_empty` (boolean): For dedupe: also drop empty lines.
- `text` (string): The text itself. Use this or input.
- `trim` (boolean): For dedupe: ignore spaces at the start and end of lines when comparing. Defaults to true.

### `color_convert` (~99 tokens)

Convert a colour

Show a colour as hex, RGB, HSL, HSV and OKLCH with its nearest named colour. Give a second colour to get the WCAG contrast ratio and pass or fail results.

Input parameters:

- `against` (string): A second colour, such as a background, to check contrast.
- `color` (string, required): Such as #336699, rgb(51 102 153), hsl(210 50% 40%) or teal.

### `cron_explain` (~83 tokens)

Explain a cron schedule

Describe a five-field cron expression in plain English and list its next run times.

Input parameters:

- `count` (integer): How many upcoming runs to list. Defaults to 5.
- `expression` (string, required): Such as "*/15 9-17 * * 1-5".
- `utc` (boolean): List times in UTC instead of this computer's time zone.

### `image_info` (~51 tokens)

Image metadata

Show what a JPEG, PNG or WebP photo reveals about itself: camera, date, editing software and the GPS location where it was taken, if any.

Input parameters:

- `input` (string, required): Path to the image.

### `image_strip_metadata` (~126 tokens)

Remove image metadata

Remove the hidden location, camera details, dates and comments from a JPEG, PNG or WebP photo without changing the picture. Saves next to the original as name-clean unless output is set.

Input parameters:

- `input` (string, required): Path to the image.
- `keep_color_profile` (boolean): Keep the colour profile so colours look the same. Defaults to true.
- `output` (string): Where to save the result. Defaults to the image's name with -clean, in the same folder.
- `overwrite` (boolean): Replace the output file if it already exists. Defaults to false.

### `head_tags` (~196 tokens)

Make head tags

Write the title, description, canonical, Open Graph and Twitter tags for a web page, ready to paste into its <head>.

Input parameters:

- `description` (string): One or two sentences, about 155 characters at most.
- `image` (string): Full address of a 1200 x 630 share image.
- `image_alt` (string): A short description of the share image.
- `noindex` (boolean): Ask search engines not to list the page. Defaults to false.
- `site_name` (string): The site or app name.
- `theme_color` (string): A hex colour for the browser bar, such as #2f7cf6.
- `title` (string): The page title, about 60 characters at most.
- `twitter` (string): The site's X handle, with or without @.
- `url` (string): The page's full address, used as the canonical and og:url.

### `head_check` (~69 tokens)

Check head tags

Check a web page's HTML for a missing or too-long title and description, share image, canonical and other head tags, with what to fix.

Input parameters:

- `html` (string): The page's HTML. Use this or input.
- `input` (string): Path to an HTML file to read instead.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/io-snowkit-snowkit/snowkit#diagnostics

## Score history

- 2026-11-05: 65
- 2026-11-04: 64

## Common questions

### What is the Snowkit MCP server?

Snowkit is an MCP server listed in the public MCP registry as io.snowkit/snowkit. Private tools that run on your computer: PDFs, QR codes, JSON, SQL, text, colours and cron. This page covers its npm package (snowkit).

### Is the Snowkit MCP server safe to use?

Snowkit scores 65 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Snowkit MCP server expose?

Snowkit exposes 18 tools: pdf_merge, pdf_split, pdf_extract_pages, pdf_rotate, pdf_info, and 13 more. Their descriptions and schemas cost roughly 2,228 tokens of context every time the server is loaded.

### Is the Snowkit MCP server still maintained?

Snowkit is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Snowkit MCP server under?

Snowkit declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/snowkit
- Socket report: https://socket.dev/npm/package/snowkit
- Repository: https://github.com/snowkit-io/snowkit
- Website: https://snowkit.io/docs/ai-apps/
- Changelog RSS feed: https://verifymcp.io/servers/io-snowkit-snowkit/snowkit.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-snowkit-snowkit/snowkit.json
- HTML version of this page: https://verifymcp.io/servers/io-snowkit-snowkit/snowkit