Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.maginaryai/maginary-mcp

PYPI · MAGINARY-MCP · 2 COMPONENTS · SCANNED SEP 20

AI image + video generation for agents: --flag prompt DSL, async generate/poll, x402 pay-per-use.

69 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
  • 0 of 29 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency45
Schema Quality & AI Usability64
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 5855 tokens (~365/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the io.github.maginaryai/maginary-mcp server?

io.github.maginaryai/maginary-mcp runs locally as a PyPI package, launched with uvx maginary-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · maginary-mcp

# add to Claude Code
claude mcp add maginaryai-maginary-mcp -- uvx maginary-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "maginaryai-maginary-mcp": {
      "command": "uvx",
      "args": [
        "maginary-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "maginaryai-maginary-mcp": {
      "command": "uvx",
      "args": [
        "maginary-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add maginaryai-maginary-mcp -- uvx maginary-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "maginaryai-maginary-mcp": {
      "type": "local",
      "command": [
        "uvx",
        "maginary-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add maginaryai-maginary-mcp --command uvx --arg maginary-mcp
# ~/.hermes/config.yaml
mcp_servers:
  maginaryai-maginary-mcp:
    command: "uvx"
    args: ["maginary-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "maginaryai-maginary-mcp": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "maginary-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add maginaryai-maginary-mcp -t stdio -c uvx -a maginary-mcp
// mcp.json
{
  "mcpServers": {
    "maginaryai-maginary-mcp": {
      "command": "uvx",
      "args": [
        "maginary-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 16 Sept 26 +15
    • Malware scan: unverified → pass security
  • 15 Sept 26 54

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed pypi/maginary-mcp@0.3.18

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem pypi

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 29 packages
Packages resolved 29
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 16 exposed · ~4,731 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
check_account_status ~152

Check account verification status, credit balance, and API key count. Use this after ``create_account`` to poll whether the user has clicked the verification link. Pass ``email`` + ``password`` (from ``create_account``) for Basic auth, or omit both to use the configured API key. Args: email: Account email (for Basic auth). password: Account password (for Basic auth). Returns: Dict with ``verified`` (bool), ``email``, ``api_key_count``, ``credits_remaining``, ``uploads_remaining``.

NameTypeReqDescription
emailAccount email (for Basic auth). Omit to use API key.
passwordAccount password (for Basic auth).

Structured output declared, but exposes no named fields.

No examples provided.

checkout ~239

Create a Stripe checkout session for purchasing a product. Returns a ``checkout_url`` — the user must open it in a browser to complete payment. After payment, credits are provisioned automatically via webhook. **Present the URL exactly as returned, including the ``#fragment`` — do not truncate, reformat, or strip any part of it.** If the agent has a USDC wallet, skip this entirely — just call ``generate`` and the x402 protocol handles payment on-chain. Args: product_id: Product ID from ``get_products``. email: Account email (for Basic auth during onboarding). password: Account password (for Basic auth during onboarding). Returns: Dict with ``checkout_url``. On failure, an ``isError`` result — e.g. ``error: "email_not_verified"`` until the user clicks the verification link, or ``"auth"`` / ``"failed"``.

NameTypeReqDescription
emailAccount email (for Basic auth during onboarding).
passwordAccount password (for Basic auth).
product_idintegeryesProduct ID from get_products.

Structured output declared, but exposes no named fields.

No examples provided.

configure_api_key ~181

Activate an API key. Local (stdio) servers persist it; hosted does not. Call this after ``manage_api_key(action='create')`` returns a ``raw_key``. On a local server the key is saved to ``~/.config/maginary/api_key`` (chmod 600) and survives restarts. On the hosted server (mcp.maginary.ai) nothing can be stored — auth is per-request: the response will say ``persisted: false`` and the key must be sent as an ``Authorization: Bearer <key>`` header on every request (set it in the MCP client's connection config). Args: api_key: The full API key string returned by ``manage_api_key``. Returns: Confirmation dict.

NameTypeReqDescription
api_keystringyesFull API key string from manage_api_key.

Structured output declared, but exposes no named fields.

No examples provided.

create_account ~193

Create a new Maginary account for the given email address. Returns the auto-generated password — display it to the user ONCE so they can save it. A verification email is sent; the user must click the link before the account can generate images. After verification, use ``manage_api_key(action='create')`` with ``email`` + ``password`` to get an API key, then ``configure_api_key`` to activate it. Args: email: The user's email address. Returns: Dict with ``email``, ``password``, and ``message``. On failure, an ``isError`` result — e.g. ``error: "already_exists"`` (email taken: ask the user for their password or a different email), ``"rate_limited"``, or ``"failed"``.

NameTypeReqDescription
emailstringyesEmail address for the new account.

Structured output declared, but exposes no named fields.

No examples provided.

create_wallet_account ~339

Create (or access) a Maginary account using a wallet signature. Sign the message ``Maginary: authenticate <address> at <timestamp>. This does not move funds.`` with EIP-191 ``personal_sign`` and pass all three values. On success, an API key is returned immediately — no email verification needed. Use this when you have a wallet but no email. The returned ``api_key`` should be passed as ``Authorization: Bearer <key>`` in the MCP client config, or via ``configure_api_key`` (stdio) / ``_meta["maginary/api_key"]`` (hosted, per-call). If the wallet already has an account, returns the existing account with a fresh API key. Args: address: EVM wallet address (0x..., 42 chars). signature: Hex-encoded EIP-191 personal_sign of the auth message. timestamp: Unix epoch seconds used in the signed message (must be within the last 5 minutes). Returns: Dict with ``address``, ``api_key`` (full key — show once), ``key_prefix``, ``created`` (bool), ``message``. On failure: ``isError`` with ``error`` = ``"validation"``, ``"signature_failed"``, or ``"rate_limited"``.

NameTypeReqDescription
addressstringyesEVM wallet address (0x..., 42 chars).
signaturestringyesHex EIP-191 personal_sign of the auth message.
timestampintegeryesUnix epoch seconds used in the signed message.

Structured output declared, but exposes no named fields.

No examples provided.

execute_action ~468

Run a follow-up action on a completed generation's image. After ``generate`` → ``wait_for_generation``, the response's ``processing_result.available_actions`` lists what's possible per slot. Call this tool with one of those action types. Args: generation_uuid: UUID of the parent generation (from ``generate``). action_type: One of the values from ``available_actions`` — e.g. ``"upscale_2x"``, ``"upscale_1_5x"``, ``"vary_strong"``, ``"vary_subtle"``, ``"pan_left"``, ``"pan_right"``, ``"pan_up"``, ``"pan_down"``, ``"zoom_out_2x"``, ``"zoom_out_1_5x"``, ``"img2vid_basic"``, ``"reroll"``. parent_image_index: The slot index of the image to act on (0, 1, 2, or 3 for a 4-image grid). Required for per-slot actions; omit for ``"reroll"`` (global action). prompt: Optional replacement prompt. For ``vary_*`` you can steer the variation with a new prompt; for ``img2vid_basic`` you can describe the desired motion. callback_url: Optional webhook URL (same as ``generate``). Returns: The newly created child generation record (same shape as ``generate``'s return — poll it with ``wait_for_generation``). On failure, same ``isError`` contract as ``generate``: ``"auth"``, ``"payment_required"`` (with x402 challenge), or ``"failed"``.

NameTypeReqDescription
action_typestringyesAction from available_actions, e.g. upscale_2x, vary_strong, img2vid_basic, reroll.
callback_urlHTTPS webhook URL for done/failed notifications.
generation_uuidstringyesUUID of the parent generation.
parent_image_indexSlot index (0-3) of the image to act on. Omit for global actions like reroll.
promptOptional replacement prompt for vary/img2vid actions.

Structured output declared, but exposes no named fields.

No examples provided.

generate ~1,365

Kick off a generation via POST /api/gens/. Args: prompt: The user's words, passed through as-is. Do NOT add flags the user did not ask for — no ``--ar``, no ``--flagship``, no model flags. Every extra flag costs credits; adding them unrequested is wrong. Standard quality is the default and is cheap; ``--flagship`` is ~4× more expensive and must only be used when the user explicitly asks for best quality. If the user asks about quality or aspect ratio: ask them first (standard vs flagship, landscape vs portrait) before generating. Flags go at the END, only when the user asked: ``--1``/``--2``/``--3``/``--4`` = image count (default 4), ``--ar 16:9`` = aspect ratio, ``--flagship`` = best quality. Unknown flag: call ``get_parameter(name)`` first — never guess. Examples — user says "a fox": prompt is ``"a fox"``. User says "a fox, landscape, best quality": prompt is ``"a fox --ar 16:9 --flagship"``. **Image-to-image (img2img):** Place one or more public image URLs in the prompt, followed by editing instructions: ``"https://cdn.example.com/photo.webp reimagine as oil painting --ar 16:9"`` The engine extracts URLs automatically and switches to img2img mode. Multiple URLs trigger multi-input mode (compositing/combining). Use ``upload_image`` first if images aren't already hosted. **Image-to-video:** Place an image URL in the prompt AND add ``--mp4`` plus video flags (``--5sec``, ``--1080p``). Or use ``execute_action`` with ``action_type="img2vid_basic"`` on a completed generation's image. **Style reference (--sref) is NOT img2img:** ``--sref <url>`` copies the visual *style* of a reference image (colors, mood, composition) without using the image content as input. A bare URL in the prompt edits the actual image; ``--sref`` transfers style.…

NameTypeReqDescription
callback_urlHTTPS webhook URL for done/failed notifications.
promptstringyesThe user's words as-is, flags at the end. Do NOT add flags the user did not ask for.

Structured output declared, but exposes no named fields.

No examples provided.

get_balance ~76

Check remaining credits and uploads for the authenticated account. Args: email: Account email (for Basic auth). password: Account password (for Basic auth). Returns: Dict with ``credits_remaining`` and ``uploads_remaining``.

NameTypeReqDescription
emailAccount email (for Basic auth).
passwordAccount password (for Basic auth).

Structured output declared, but exposes no named fields.

No examples provided.

get_generation ~252

Fetch a generation by UUID (GET /api/gens/{uuid}/). Args: uuid: The UUID returned by ``generate``. Returns: The full generation record. If terminal, ``image_urls[]`` holds the finished outputs and ``processing_result.slots[]`` the per-slot detail. NOTE: a generation that failed server-side is a SUCCESSFUL tool call returning ``processing_state: "failed"`` — always check the state, never infer success from the absence of a tool error. **Follow-up actions:** A completed generation's ``processing_result.available_actions`` maps slot indices to valid action types. E.g. ``{"0": ["upscale_2x", "vary_strong", ...], "global": ["reroll"]}``. Use ``execute_action`` with the ``uuid``, a chosen ``action_type``, and the ``parent_image_index`` (the slot key as an int) to run an action. Hosted: a key obtained mid-session may be passed as ``_meta["maginary/api_key"]``.

NameTypeReqDescription
uuidstringyesGeneration UUID from generate or execute_action.

Structured output declared, but exposes no named fields.

No examples provided.

get_parameter ~109

Return the full record for a single parameter (canonical name or alias). Args: name: Parameter name with or without leading ``--`` (e.g. ``ar``, ``--ar``, ``aspect``). Case-insensitive. Returns: The parameter dict. Not-found is an ``isError`` result — surface it rather than fabricating a param.

NameTypeReqDescription
namestringyesParameter name with or without --, e.g. ar, --ar, aspect.

Structured output declared, but exposes no named fields.

No examples provided.

get_products ~141

List available Maginary products/plans with pricing. No authentication required. Use this to present purchase options to the user. The ``novice_pack`` ($10, 150 credits) is the recommended starting point. Returns: Dict with ``count`` and ``products`` — each product carries ``id``, ``short_name``, ``title``, ``description``, ``price_cents``, ``credits``, ``uploads``, ``is_subscription``. (The backend sends a bare array; it is wrapped here because FastMCP validates tool output against the dict annotation and rejects a top-level list.)

Input schema present but exposes no named parameters.

Structured output declared, but exposes no named fields.

No examples provided.

list_parameters ~229

List Maginary prompt-DSL parameters. Args: category: Restrict to one category (e.g. ``composition``, ``video``, ``model``, ``outpaint``). Call with no filters once — the response's ``categories`` / ``statuses`` maps are the full taxonomy. status: Restrict to one status (``live``, ``mostly-dead``, ``unimplemented``). include_reserved: When False (default) drop ``unimplemented`` (recognized-but-blocked) parameters from the result. Returns: A dict with ``count``, ``source`` (``live`` vs. ``bundled-snapshot``), ``categories`` / ``statuses`` (the filter taxonomy), and ``parameters`` (the array of matching entries).

NameTypeReqDescription
categoryFilter by category, e.g. composition, video, model, outpaint.
include_reservedbooleanInclude unimplemented (blocked) parameters.
statusFilter by status: live, mostly-dead, or unimplemented.

Structured output declared, but exposes no named fields.

No examples provided.

manage_api_key ~265

Create, list, or revoke Maginary API keys (up to 10 per account). Auth: pass ``email`` + ``password`` for Basic auth (onboarding), or omit both to use the configured API key (normal operation). Args: action: One of ``create``, ``list``, ``revoke``. name: Key name (required for ``create``). key_prefix: 8-char prefix of the key to revoke (required for ``revoke``). email: Account email (for Basic auth). password: Account password (for Basic auth). Returns: For ``create``: dict with ``raw_key`` (the full key — show once, then use ``configure_api_key`` to activate it), ``key_prefix``, ``name``. For ``list``: dict with ``keys`` array. For ``revoke``: success/error message.

NameTypeReqDescription
actionstringyesOne of: create, list, revoke.
emailAccount email (for Basic auth).
key_prefix8-char prefix of key to revoke (required for revoke).
nameKey name (required for create).
passwordAccount password (for Basic auth).

Structured output declared, but exposes no named fields.

No examples provided.

search_parameters ~142

Text-search over parameter names, aliases, descriptions, values, examples. Args: query: Substring match, case-insensitive. category: Optional single-category restriction. include_reserved: Whether to include ``unimplemented`` parameters. Returns: Dict with ``count``, ``source`` (``live`` vs. ``bundled-snapshot``), and ``parameters`` (ordered as they appear in the catalog).

NameTypeReqDescription
categoryFilter by category, e.g. composition, video, model.
include_reservedbooleanInclude unimplemented (blocked) parameters.
querystringyesSearch term (case-insensitive substring match).

Structured output declared, but exposes no named fields.

No examples provided.

upload_image ~203

Upload a local image and get a CDN URL for img2img or ``--sref``. Only available on local (stdio) connections. On hosted/remote connections, place an existing image URL directly in the prompt. Place the returned ``url`` in a ``generate`` prompt: ``generate("https://cdn.maginary.ai/…/photo.webp reimagine as oil painting")`` Args: file_path: Path to an image file on disk (JPEG, PNG, WebP, HEIC). filename: Original filename. Inferred from ``file_path`` if omitted. Returns: Dict with ``url`` (the public CDN URL), ``exists`` (deduplicated), ``credits_deducted``, and ``message``.

NameTypeReqDescription
file_pathstringyesPath to a local image (JPEG, PNG, WebP, HEIC).
filenameOverride filename. Inferred from file_path if omitted.

Structured output declared, but exposes no named fields.

No examples provided.

wait_for_generation ~377

Poll ``get_generation`` on a backoff until it reaches done / failed. Args: uuid: The UUID returned by ``generate``. timeout_s: Return after this many seconds even if still running. Default 45 stays under the 60 s per-call limit most MCP clients enforce; a ``timeout`` result just means "call again". Only raise it (e.g. for video) on clients you know allow long tool calls. Returns: The terminal generation record — which includes generations that failed server-side: those are SUCCESSFUL tool calls returning ``processing_state: "failed"`` with empty ``image_urls``, so always check the state. On tool failure, an ``isError`` result whose ``error`` field is ``"timeout"`` (``message`` names the last observed state — the generation keeps running server-side and can be re-fetched with ``get_generation`` later), ``"auth"``, or ``"failed"``. **Follow-up actions:** A ``done`` generation's ``processing_result.available_actions`` maps slot indices to valid action types — e.g. ``{"0": ["upscale_2x", "vary_strong", "pan_left", "zoom_out_2x", "img2vid_basic", ...], "global": ["reroll"]}``. Use ``execute_action`` with the ``uuid``, a chosen ``action_type``, and the ``parent_image_index`` (the slot key as an int) to run an action on a specific output image.

NameTypeReqDescription
timeout_snumberMax seconds to wait before returning a timeout result.
uuidstringyesGeneration UUID to poll.

Structured output declared, but exposes no named fields.

No examples provided.

Common questions

What is the io.github.maginaryai/maginary-mcp server?

io.github.maginaryai/maginary-mcp is listed in the public MCP registry as io.github.maginaryai/maginary-mcp. AI image + video generation for agents: --flag prompt DSL, async generate/poll, x402 pay-per-use. This page covers its PyPI package (maginary-mcp).

Is the io.github.maginaryai/maginary-mcp server safe to use?

io.github.maginaryai/maginary-mcp scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.maginaryai/maginary-mcp server expose?

io.github.maginaryai/maginary-mcp exposes 16 tools: list_parameters, search_parameters, get_parameter, generate, get_generation, and 11 more. Their descriptions and schemas cost roughly 4,731 tokens of context every time the server is loaded.

Is the io.github.maginaryai/maginary-mcp server still maintained?

io.github.maginaryai/maginary-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.maginaryai/maginary-mcp server under?

io.github.maginaryai/maginary-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.