Compositor
NPM · COMPOSITOR-MCP · SCANNED SEP 26
Read and edit Compositor .comp projects: layers, folders, masks, transforms, previews and exports
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 127 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability46
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1611 tokens (~100/item across 16 items; 15 tools + 1 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage90
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 71% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Compositor MCP server?
Compositor runs locally as an npm package, launched with npx -y compositor-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · compositor-mcp
claude mcp add josusanz-compositor -- npx -y compositor-mcp
{
"mcpServers": {
"josusanz-compositor": {
"command": "npx",
"args": [
"-y",
"compositor-mcp"
]
}
}
} {
"servers": {
"josusanz-compositor": {
"command": "npx",
"args": [
"-y",
"compositor-mcp"
]
}
}
} codex mcp add josusanz-compositor -- npx -y compositor-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"josusanz-compositor": {
"type": "local",
"command": [
"npx",
"-y",
"compositor-mcp"
],
"enabled": true
}
}
} openclaw mcp add josusanz-compositor --command npx --arg -y --arg compositor-mcp
mcp_servers:
josusanz-compositor:
command: "npx"
args: ["-y", "compositor-mcp"] {
"McpServers": {
"josusanz-compositor": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"compositor-mcp"
]
}
}
} assistant mcp add josusanz-compositor -t stdio -c npx -a -y compositor-mcp
{
"mcpServers": {
"josusanz-compositor": {
"command": "npx",
"args": [
"-y",
"compositor-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Sept 26 +3
- Tool safety: pass → unverified ▼ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Schema quality: 0 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Stability: unverified → 0.10 ▲ functional
- Destructive annotations: All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation. functional
- Package version: 0.1.2 → 0.1.4 functional
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 22 Sept 26 63
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 26 Sept 2026 · Analysed npm/compositor-mcp@0.1.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 127 packages
| Packages resolved | 127 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_folder Add folder ~99
Creates an empty layer folder (group).
| Name | Type | Req | Description |
|---|---|---|---|
| above | string | – | Place directly above this layer (id or name) |
| below | string | – | Place directly below this layer (id or name) |
| name | string | yes | – |
| parent | string | – | Folder (id or name) to put the layer in; omit for the root |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
No output schema declared.
No examples provided.
add_image_layer Add image layer ~238
Imports an image file (PNG, JPEG, HEIC, TIFF, WebP…) as a new pixel layer. The pixels are stored as-is; the placement only sets the layer's transform.
| Name | Type | Req | Description |
|---|---|---|---|
| above | string | – | Place directly above this layer (id or name) |
| below | string | – | Place directly below this layer (id or name) |
| blendMode | string | – | – |
| imagePath | string | yes | Image file to import |
| name | string | – | Layer name (defaults to the file name) |
| opacity | number | – | – |
| origin | array | – | Explicit top-left position in canvas pixels; overrides centering |
| parent | string | – | Folder (id or name) to put the layer in; omit for the root |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
| placement | string | – | original: 1:1 pixels centered; fit: scale to fit inside the canvas; fill: scale to cover the canvas; stretch: match canvas size |
| size | array | – | Explicit display size in canvas pixels; overrides placement |
No output schema declared.
No examples provided.
create_project Create project ~111
Creates a new empty .comp project. Optionally adds a solid background layer. Overwrites the manifest of an existing package at that path.
| Name | Type | Req | Description |
|---|---|---|---|
| background | string | – | CSS color for a Background layer, e.g. #ffffff. Omit for a transparent document. |
| height | integer | yes | – |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
| resolution | number | – | Pixels per inch (default 72) |
| width | integer | yes | – |
No output schema declared.
No examples provided.
export_flattened Export flattened image ~78
Renders the whole project at full resolution to a PNG or JPEG file.
| Name | Type | Req | Description |
|---|---|---|---|
| outputPath | string | yes | Destination file; .png keeps transparency, .jpg flattens onto white |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
| quality | integer | – | JPEG quality |
No output schema declared.
No examples provided.
export_layer Export a layer's pixels ~79
Copies a pixel layer's source PNG (untransformed, original resolution) or its mask to a file.
| Name | Type | Req | Description |
|---|---|---|---|
| layer | string | yes | Layer UUID or its exact name |
| outputPath | string | yes | – |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
| what | string | – | – |
No output schema declared.
No examples provided.
inspect_project Inspect project ~65
Reads a Compositor .comp project and returns the canvas info plus every layer in stacking order (bottom to top), with folder depth, visibility, opacity, blend mode and transform.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
No output schema declared.
No examples provided.
list_layers List layers ~55
Compact list of layers (id, name, kind, visibility) from top to bottom as shown in Compositor's Layers panel.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
No output schema declared.
No examples provided.
move_layer Move layer in the stack ~148
Reorders a layer (with its subtree if it is a folder): to the top or bottom of a folder or the root, or directly above/below another layer.
| Name | Type | Req | Description |
|---|---|---|---|
| above | string | – | Place directly above this layer (id or name) |
| below | string | – | Place directly below this layer (id or name) |
| layer | string | yes | Layer UUID or its exact name |
| parent | string | – | Folder (id or name) to put the layer in; omit for the root |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
| to | string | – | Top or bottom of the destination folder (or root) |
No output schema declared.
No examples provided.
open_in_compositor Open in Compositor ~65
Opens (or reloads) the project in the Compositor app on this Mac so the user can see the result. Compositor reads the package from disk on open.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
No output schema declared.
No examples provided.
remove_layer Remove layer ~64
Deletes a layer (and, for a folder, everything inside it) together with its image and mask files.
| Name | Type | Req | Description |
|---|---|---|---|
| layer | string | yes | Layer UUID or its exact name |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
No output schema declared.
No examples provided.
render_preview Render preview ~117
Flattens the project and returns a PNG preview image so the model can see the composition. Optionally saves it to a file. Clipping masks, adjustment layers and layer effects are not rendered; the response lists what was skipped.
| Name | Type | Req | Description |
|---|---|---|---|
| maxSize | integer | – | Longest side of the preview in pixels |
| outputPath | string | – | If given, also writes the preview (PNG or JPEG by extension) to this path |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
No output schema declared.
No examples provided.
replace_layer_image Replace layer pixels ~115
Swaps the source pixels of a pixel layer with another image file, keeping its transform, mask and properties. Use it to round-trip a layer through an external editor or a generated image.
| Name | Type | Req | Description |
|---|---|---|---|
| imagePath | string | yes | – |
| keepDisplaySize | boolean | – | true keeps the on-canvas size; false shows the new image 1:1 |
| layer | string | yes | Layer UUID or its exact name |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
No output schema declared.
No examples provided.
resize_canvas Resize canvas ~71
Changes the document size without resampling layers. Layers keep their pixels and are offset according to the anchor.
| Name | Type | Req | Description |
|---|---|---|---|
| anchor | string | – | – |
| height | integer | yes | – |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
| width | integer | yes | – |
No output schema declared.
No examples provided.
set_layer Set layer properties ~190
Changes name, visibility, opacity, blend mode, mask enablement or transform (origin, size, rotation, flips) of a layer. Only the given fields change.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | Make it the selected layer in Compositor |
| blendMode | string | – | – |
| flipX | boolean | – | – |
| flipY | boolean | – | – |
| layer | string | yes | Layer UUID or its exact name |
| maskEnabled | boolean | – | – |
| name | string | – | – |
| opacity | number | – | – |
| origin | array | – | Top-left in canvas pixels |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
| rotation | number | – | Clockwise degrees |
| sampling | string | – | – |
| size | array | – | Display size in canvas pixels; source pixels are untouched |
| visible | boolean | – | – |
No output schema declared.
No examples provided.
set_layer_mask Set or clear a layer mask ~112
Attaches a raster mask from a grayscale image (white reveals, black hides) to a layer, or removes the existing mask. The mask is stretched over the layer's own rectangle.
| Name | Type | Req | Description |
|---|---|---|---|
| invert | boolean | – | – |
| layer | string | yes | Layer UUID or its exact name |
| maskPath | string | – | Grayscale or any image; luminance becomes coverage. Omit to clear the mask. |
| path | string | yes | Path to the .comp project package (a directory ending in .comp) |
No output schema declared.
No examples provided.
What is the Compositor MCP server?
Compositor is an MCP server listed in the public MCP registry as io.github.Josusanz/compositor. Read and edit Compositor .comp projects: layers, folders, masks, transforms, previews and exports. This page covers its npm package (compositor-mcp).
Is the Compositor MCP server safe to use?
Compositor scores 66 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 26 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Compositor MCP server expose?
Compositor exposes 15 tools: inspect_project, list_layers, render_preview, export_flattened, export_layer, and 10 more. Their descriptions and schemas cost roughly 1,607 tokens of context every time the server is loaded.
Is the Compositor MCP server still maintained?
Compositor is still listed as active in the MCP registry. We last reached this channel on 26 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Compositor MCP server under?
Compositor declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.