# Compositor (npm · compositor-mcp)

Read and edit Compositor .comp projects: layers, folders, masks, transforms, previews and exports

- Trust score: 66/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-26

## Components

- npm · `compositor-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/josusanz-compositor/compositor-mcp.md), [page](https://verifymcp.io/servers/josusanz-compositor/compositor-mcp)

## Channel facts

- Registry: `npm`
- Package: `compositor-mcp`
- Version: `0.1.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-26.

- **Supply Chain Security**: 99/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 127 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 46/100
  - 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1611 tokens (~100/item across 16 items; 15 tools + 1 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 13/100
  - Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 90/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 71% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Compositor MCP server?

Compositor runs locally as an npm package, launched with npx -y compositor-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add josusanz-compositor -- npx -y compositor-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "josusanz-compositor": {
      "command": "npx",
      "args": [
        "-y",
        "compositor-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "josusanz-compositor": {
      "command": "npx",
      "args": [
        "-y",
        "compositor-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add josusanz-compositor -- npx -y compositor-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "josusanz-compositor": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "compositor-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add josusanz-compositor --command npx --arg -y --arg compositor-mcp
```

### Hermes

```yaml
mcp_servers:
  josusanz-compositor:
    command: "npx"
    args: ["-y", "compositor-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "josusanz-compositor": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "compositor-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add josusanz-compositor -t stdio -c npx -a -y compositor-mcp
```

### Other

```json
{
  "mcpServers": {
    "josusanz-compositor": {
      "command": "npx",
      "args": [
        "-y",
        "compositor-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-25 (score 66, +3)

- [security regression] Tool safety: pass → unverified
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional regression] Schema quality: 0 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.10
- [functional] Destructive annotations: All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
- [functional] Package version: 0.1.2 → 0.1.4
- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-22 (score 63)

First indexed and scored.

## MCP tools (15)

### `inspect_project` (~65 tokens)

Inspect project

Reads a Compositor .comp project and returns the canvas info plus every layer in stacking order (bottom to top), with folder depth, visibility, opacity, blend mode and transform.

Input parameters:

- `path` (string, required): Path to the .comp project package (a directory ending in .comp)

### `list_layers` (~55 tokens)

List layers

Compact list of layers (id, name, kind, visibility) from top to bottom as shown in Compositor's Layers panel.

Input parameters:

- `path` (string, required): Path to the .comp project package (a directory ending in .comp)

### `render_preview` (~117 tokens)

Render preview

Flattens the project and returns a PNG preview image so the model can see the composition. Optionally saves it to a file. Clipping masks, adjustment layers and layer effects are not rendered; the response lists what was skipped.

Input parameters:

- `maxSize` (integer): Longest side of the preview in pixels
- `outputPath` (string): If given, also writes the preview (PNG or JPEG by extension) to this path
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)

### `export_flattened` (~78 tokens)

Export flattened image

Renders the whole project at full resolution to a PNG or JPEG file.

Input parameters:

- `outputPath` (string, required): Destination file; .png keeps transparency, .jpg flattens onto white
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)
- `quality` (integer): JPEG quality

### `export_layer` (~79 tokens)

Export a layer's pixels

Copies a pixel layer's source PNG (untransformed, original resolution) or its mask to a file.

Input parameters:

- `layer` (string, required): Layer UUID or its exact name
- `outputPath` (string, required)
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)
- `what` (string)

### `create_project` (~111 tokens)

Create project

Creates a new empty .comp project. Optionally adds a solid background layer. Overwrites the manifest of an existing package at that path.

Input parameters:

- `background` (string): CSS color for a Background layer, e.g. #ffffff. Omit for a transparent document.
- `height` (integer, required)
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)
- `resolution` (number): Pixels per inch (default 72)
- `width` (integer, required)

### `add_image_layer` (~238 tokens)

Add image layer

Imports an image file (PNG, JPEG, HEIC, TIFF, WebP…) as a new pixel layer. The pixels are stored as-is; the placement only sets the layer's transform.

Input parameters:

- `above` (string): Place directly above this layer (id or name)
- `below` (string): Place directly below this layer (id or name)
- `blendMode` (string)
- `imagePath` (string, required): Image file to import
- `name` (string): Layer name (defaults to the file name)
- `opacity` (number)
- `origin` (array): Explicit top-left position in canvas pixels; overrides centering
- `parent` (string): Folder (id or name) to put the layer in; omit for the root
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)
- `placement` (string): original: 1:1 pixels centered; fit: scale to fit inside the canvas; fill: scale to cover the canvas; stretch: match canvas size
- `size` (array): Explicit display size in canvas pixels; overrides placement

### `add_folder` (~99 tokens)

Add folder

Creates an empty layer folder (group).

Input parameters:

- `above` (string): Place directly above this layer (id or name)
- `below` (string): Place directly below this layer (id or name)
- `name` (string, required)
- `parent` (string): Folder (id or name) to put the layer in; omit for the root
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)

### `set_layer` (~190 tokens)

Set layer properties

Changes name, visibility, opacity, blend mode, mask enablement or transform (origin, size, rotation, flips) of a layer. Only the given fields change.

Input parameters:

- `active` (boolean): Make it the selected layer in Compositor
- `blendMode` (string)
- `flipX` (boolean)
- `flipY` (boolean)
- `layer` (string, required): Layer UUID or its exact name
- `maskEnabled` (boolean)
- `name` (string)
- `opacity` (number)
- `origin` (array): Top-left in canvas pixels
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)
- `rotation` (number): Clockwise degrees
- `sampling` (string)
- `size` (array): Display size in canvas pixels; source pixels are untouched
- `visible` (boolean)

### `move_layer` (~148 tokens)

Move layer in the stack

Reorders a layer (with its subtree if it is a folder): to the top or bottom of a folder or the root, or directly above/below another layer.

Input parameters:

- `above` (string): Place directly above this layer (id or name)
- `below` (string): Place directly below this layer (id or name)
- `layer` (string, required): Layer UUID or its exact name
- `parent` (string): Folder (id or name) to put the layer in; omit for the root
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)
- `to` (string): Top or bottom of the destination folder (or root)

### `remove_layer` (~64 tokens)

Remove layer

Deletes a layer (and, for a folder, everything inside it) together with its image and mask files.

Input parameters:

- `layer` (string, required): Layer UUID or its exact name
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)

### `replace_layer_image` (~115 tokens)

Replace layer pixels

Swaps the source pixels of a pixel layer with another image file, keeping its transform, mask and properties. Use it to round-trip a layer through an external editor or a generated image.

Input parameters:

- `imagePath` (string, required)
- `keepDisplaySize` (boolean): true keeps the on-canvas size; false shows the new image 1:1
- `layer` (string, required): Layer UUID or its exact name
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)

### `set_layer_mask` (~112 tokens)

Set or clear a layer mask

Attaches a raster mask from a grayscale image (white reveals, black hides) to a layer, or removes the existing mask. The mask is stretched over the layer's own rectangle.

Input parameters:

- `invert` (boolean)
- `layer` (string, required): Layer UUID or its exact name
- `maskPath` (string): Grayscale or any image; luminance becomes coverage. Omit to clear the mask.
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)

### `resize_canvas` (~71 tokens)

Resize canvas

Changes the document size without resampling layers. Layers keep their pixels and are offset according to the anchor.

Input parameters:

- `anchor` (string)
- `height` (integer, required)
- `path` (string, required): Path to the .comp project package (a directory ending in .comp)
- `width` (integer, required)

### `open_in_compositor` (~65 tokens)

Open in Compositor

Opens (or reloads) the project in the Compositor app on this Mac so the user can see the result. Compositor reads the package from disk on open.

Input parameters:

- `path` (string, required): Path to the .comp project package (a directory ending in .comp)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/josusanz-compositor/compositor-mcp#diagnostics

## Score history

- 2026-09-26: 66
- 2026-09-25: 66
- 2026-09-24: 63
- 2026-09-23: 63
- 2026-09-22: 63

## Common questions

### What is the Compositor MCP server?

Compositor is an MCP server listed in the public MCP registry as io.github.Josusanz/compositor. Read and edit Compositor .comp projects: layers, folders, masks, transforms, previews and exports. This page covers its npm package (compositor-mcp).

### Is the Compositor MCP server safe to use?

Compositor scores 66 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 26 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Compositor MCP server expose?

Compositor exposes 15 tools: inspect_project, list_layers, render_preview, export_flattened, export_layer, and 10 more. Their descriptions and schemas cost roughly 1,607 tokens of context every time the server is loaded.

### Is the Compositor MCP server still maintained?

Compositor is still listed as active in the MCP registry. We last reached this channel on 26 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Compositor MCP server under?

Compositor declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/compositor-mcp
- Socket report: https://socket.dev/npm/package/compositor-mcp
- Repository: https://github.com/Josusanz/compositor-mcp
- Changelog RSS feed: https://verifymcp.io/servers/josusanz-compositor/compositor-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/josusanz-compositor/compositor-mcp.json
- HTML version of this page: https://verifymcp.io/servers/josusanz-compositor/compositor-mcp