# io.github.maginaryai/maginary-mcp (remote · mcp.maginary.ai)

AI image + video generation for agents: --flag prompt DSL, async generate/poll, x402 pay-per-use.

- Trust score: 60/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- remote · `mcp.maginary.ai`: 60/100 (this document), [markdown](https://verifymcp.io/servers/maginaryai-maginary-mcp/mcp.md), [page](https://verifymcp.io/servers/maginaryai-maginary-mcp/mcp)
- pypi · `maginary-mcp`: 69/100, [markdown](https://verifymcp.io/servers/maginaryai-maginary-mcp/maginary-mcp.md), [page](https://verifymcp.io/servers/maginaryai-maginary-mcp/maginary-mcp)

## Channel facts

- Endpoint: `https://mcp.maginary.ai/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.3.18`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (create_wallet_account).
  - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 406, which proves neither a plaintext path nor enforcement.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 5954 tokens (~372/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 17/100
  - Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the io.github.maginaryai/maginary-mcp server?

io.github.maginaryai/maginary-mcp is a hosted endpoint at https://mcp.maginary.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http maginaryai-maginary-mcp 'https://mcp.maginary.ai/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "maginaryai-maginary-mcp": {
      "url": "https://mcp.maginary.ai/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "maginaryai-maginary-mcp": {
      "type": "http",
      "url": "https://mcp.maginary.ai/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.maginaryai-maginary-mcp]
url = "https://mcp.maginary.ai/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "maginaryai-maginary-mcp": {
      "type": "remote",
      "url": "https://mcp.maginary.ai/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add maginaryai-maginary-mcp --url 'https://mcp.maginary.ai/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  maginaryai-maginary-mcp:
    url: "https://mcp.maginary.ai/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "maginaryai-maginary-mcp": {
      "Transport": "http",
      "Url": "https://mcp.maginary.ai/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add maginaryai-maginary-mcp -t streamable-http -u 'https://mcp.maginary.ai/mcp'
```

### Other

```json
{
  "mcpServers": {
    "maginaryai-maginary-mcp": {
      "type": "http",
      "url": "https://mcp.maginary.ai/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-18 (score 60, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 59, +1)

- [functional improvement] Stability: unverified → 0.03

### 2026-09-15 (score 58)

First indexed and scored.

## MCP tools (16)

### `list_parameters` (~232 tokens)

List parameters

List Maginary prompt-DSL parameters.

    Args:
        category: Restrict to one category (e.g. ``composition``, ``video``,
            ``model``, ``outpaint``). Call with no filters once — the response's
            ``categories`` / ``statuses`` maps are the full taxonomy.
        status: Restrict to one status (``live``, ``mostly-dead``,
            ``unimplemented``).
        include_reserved: When False (default) drop ``unimplemented``
            (recognized-but-blocked) parameters from the result.

    Returns:
        A dict with ``count``, ``source`` (``live`` vs. ``bundled-snapshot``),
        ``categories`` / ``statuses`` (the filter taxonomy), and ``parameters``
        (the array of matching entries).

Input parameters:

- `category`: Filter by category, e.g. composition, video, model, outpaint.
- `include_reserved` (boolean): Include unimplemented (blocked) parameters.
- `status`: Filter by status: live, mostly-dead, or unimplemented.

### `search_parameters` (~145 tokens)

Search parameters

Text-search over parameter names, aliases, descriptions, values, examples.

    Args:
        query: Substring match, case-insensitive.
        category: Optional single-category restriction.
        include_reserved: Whether to include ``unimplemented`` parameters.

    Returns:
        Dict with ``count``, ``source`` (``live`` vs. ``bundled-snapshot``),
        and ``parameters`` (ordered as they appear in the catalog).

Input parameters:

- `category`: Filter by category, e.g. composition, video, model.
- `include_reserved` (boolean): Include unimplemented (blocked) parameters.
- `query` (string, required): Search term (case-insensitive substring match).

### `get_parameter` (~112 tokens)

Get parameter

Return the full record for a single parameter (canonical name or alias).

    Args:
        name: Parameter name with or without leading ``--`` (e.g. ``ar``,
            ``--ar``, ``aspect``). Case-insensitive.

    Returns:
        The parameter dict. Not-found is an ``isError`` result — surface it
        rather than fabricating a param.

Input parameters:

- `name` (string, required): Parameter name with or without --, e.g. ar, --ar, aspect.

### `generate` (~1367 tokens)

Generate image or video

Kick off a generation via POST /api/gens/.

    Args:
        prompt: The user's words, passed through as-is. Do NOT add flags the
            user did not ask for — no ``--ar``, no ``--flagship``, no model
            flags. Every extra flag costs credits; adding them unrequested is
            wrong. Standard quality is the default and is cheap; ``--flagship``
            is ~4× more expensive and must only be used when the user
            explicitly asks for best quality.

            If the user asks about quality or aspect ratio: ask them first
            (standard vs flagship, landscape vs portrait) before generating.

            Flags go at the END, only when the user asked:
            ``--1``/``--2``/``--3``/``--4`` = image count (default 4),
            ``--ar 16:9`` = aspect ratio, ``--flagship`` = best quality.
            Unknown flag: call ``get_parameter(name)`` first — never guess.

            Examples — user says "a fox": prompt is ``"a fox"``.
            User says "a fox, landscape, best quality":
            prompt is ``"a fox --ar 16:9 --flagship"``.

            **Image-to-image (img2img):** Place one or more public image URLs
            in the prompt, followed by editing instructions:
            ``"https://cdn.example.com/photo.webp reimagine as oil painting --ar 16:9"``
            The engine extracts URLs automatically and switches to img2img mode.
            Multiple URLs trigger multi-input mode (compositing/combining).
            Use ``upload_image`` first if images aren't already hosted.

            **Image-to-video:** Place an image URL in the prompt AND add
            ``--mp4`` plus video flags (``--5sec``, ``--1080p``). Or use
            ``execute_action`` with ``action_type="img2vid_basic"`` on a
            completed generation's image.

            **Style reference (--sref) is NOT img2img:** ``--sref <url>``
            copies the visual *style* of a reference image (colors, mood,
            composition) without using…

Input parameters:

- `callback_url`: HTTPS webhook URL for done/failed notifications.
- `prompt` (string, required): The user's words as-is, flags at the end. Do NOT add flags the user did not ask for.

### `get_generation` (~256 tokens)

Get generation

Fetch a generation by UUID (GET /api/gens/{uuid}/).

    Args:
        uuid: The UUID returned by ``generate``.

    Returns:
        The full generation record. If terminal, ``image_urls[]`` holds the
        finished outputs and ``processing_result.slots[]`` the per-slot detail.
        NOTE: a generation that failed server-side is a SUCCESSFUL tool call
        returning ``processing_state: "failed"`` — always check the state,
        never infer success from the absence of a tool error.

        **Follow-up actions:** A completed generation's
        ``processing_result.available_actions`` maps slot indices to valid
        action types. E.g. ``{"0": ["upscale_2x", "vary_strong", ...],
        "global": ["reroll"]}``. Use ``execute_action`` with the ``uuid``,
        a chosen ``action_type``, and the ``parent_image_index`` (the slot
        key as an int) to run an action.

        Hosted: a key obtained mid-session may be passed as
        ``_meta["maginary/api_key"]``.

Input parameters:

- `uuid` (string, required): Generation UUID from generate or execute_action.

### `wait_for_generation` (~380 tokens)

Wait for generation

Poll ``get_generation`` on a backoff until it reaches done / failed.

    Args:
        uuid: The UUID returned by ``generate``.
        timeout_s: Return after this many seconds even if still running.
            Default 45 stays under the 60 s per-call limit most MCP clients
            enforce; a ``timeout`` result just means "call again". Only raise
            it (e.g. for video) on clients you know allow long tool calls.

    Returns:
        The terminal generation record — which includes generations that
        failed server-side: those are SUCCESSFUL tool calls returning
        ``processing_state: "failed"`` with empty ``image_urls``, so always
        check the state. On tool failure, an ``isError`` result whose
        ``error`` field is ``"timeout"`` (``message`` names the last
        observed state — the generation keeps running server-side and can be
        re-fetched with ``get_generation`` later), ``"auth"``, or
        ``"failed"``.

        **Follow-up actions:** A ``done`` generation's
        ``processing_result.available_actions`` maps slot indices to valid
        action types — e.g. ``{"0": ["upscale_2x", "vary_strong",
        "pan_left", "zoom_out_2x", "img2vid_basic", ...], "global":
        ["reroll"]}``. Use ``execute_action`` with the ``uuid``, a chosen
        ``action_type``, and the ``parent_image_index`` (the slot key as an
        int) to run an action on a specific output image.

Input parameters:

- `timeout_s` (number): Max seconds to wait before returning a timeout result.
- `uuid` (string, required): Generation UUID to poll.

### `upload_image` (~211 tokens)

Upload image

Upload a local image and get a CDN URL for img2img or ``--sref``.

    Only available on local (stdio) connections.  On hosted/remote
    connections, place an existing image URL directly in the prompt.

    Place the returned ``url`` in a ``generate`` prompt:
    ``generate("https://cdn.maginary.ai/…/photo.webp reimagine as oil painting")``

    Args:
        file_path: Path to an image file on disk (JPEG, PNG, WebP, HEIC).
        filename: Original filename.  Inferred from ``file_path`` if omitted.

    Returns:
        Dict with ``url`` (the public CDN URL), ``exists`` (deduplicated),
        ``credits_deducted``, and ``message``.

Input parameters:

- `file_path` (string, required): Path to a local image (JPEG, PNG, WebP, HEIC).
- `filename`: Override filename. Inferred from file_path if omitted.

### `execute_action` (~475 tokens)

Run action on image

Run a follow-up action on a completed generation's image.

    After ``generate`` → ``wait_for_generation``, the response's
    ``processing_result.available_actions`` lists what's possible per slot.
    Call this tool with one of those action types.

    Args:
        generation_uuid: UUID of the parent generation (from ``generate``).
        action_type: One of the values from ``available_actions`` — e.g.
            ``"upscale_2x"``, ``"upscale_1_5x"``, ``"vary_strong"``,
            ``"vary_subtle"``, ``"pan_left"``, ``"pan_right"``,
            ``"pan_up"``, ``"pan_down"``, ``"zoom_out_2x"``,
            ``"zoom_out_1_5x"``, ``"img2vid_basic"``, ``"reroll"``.
        parent_image_index: The slot index of the image to act on (0, 1,
            2, or 3 for a 4-image grid). Required for per-slot actions;
            omit for ``"reroll"`` (global action).
        prompt: Optional replacement prompt. For ``vary_*`` you can steer
            the variation with a new prompt; for ``img2vid_basic`` you can
            describe the desired motion.
        callback_url: Optional webhook URL (same as ``generate``).

    Returns:
        The newly created child generation record (same shape as
        ``generate``'s return — poll it with ``wait_for_generation``).

        On failure, same ``isError`` contract as ``generate``:
        ``"auth"``, ``"payment_required"`` (with x402 challenge),
        or ``"failed"``.

Input parameters:

- `action_type` (string, required): Action from available_actions, e.g. upscale_2x, vary_strong, img2vid_basic, reroll.
- `callback_url`: HTTPS webhook URL for done/failed notifications.
- `generation_uuid` (string, required): UUID of the parent generation.
- `parent_image_index`: Slot index (0-3) of the image to act on. Omit for global actions like reroll.
- `prompt`: Optional replacement prompt for vary/img2vid actions.

### `create_account` (~203 tokens)

Create account

Create a new Maginary account for the given email address.

    Returns the auto-generated password — display it to the user ONCE so they
    can save it. A verification email is sent; the user must click the link
    before the account can generate images.

    After verification, use ``manage_api_key(action='create')`` with
    ``email`` + ``password`` to get an API key, then ``configure_api_key``
    to activate it.

    Args:
        email: The user's email address.

    Returns:
        Dict with ``email``, ``password``, and ``message``. On failure, an
        ``isError`` result — e.g. ``error: "already_exists"`` (email taken:
        ask the user for their password or a different email),
        ``"rate_limited"``, or ``"failed"``.

Input parameters:

- `email` (string, required): Email address for the new account.

### `create_wallet_account` (~354 tokens)

Create wallet account

Create (or access) a Maginary account using a wallet signature.

    Sign the message ``Maginary: authenticate <address> at <timestamp>.
    This does not move funds.`` with EIP-191 ``personal_sign`` and pass all
    three values. On success, an API key is returned immediately — no email
    verification needed.

    Use this when you have a wallet but no email. The returned ``api_key``
    should be passed as ``Authorization: Bearer <key>`` in the MCP client
    config, or via ``configure_api_key`` (stdio) / ``_meta["maginary/api_key"]``
    (hosted, per-call).

    If the wallet already has an account, returns the existing account with
    a fresh API key.

    Args:
        address: EVM wallet address (0x..., 42 chars).
        signature: Hex-encoded EIP-191 personal_sign of the auth message.
        timestamp: Unix epoch seconds used in the signed message (must be
            within the last 5 minutes).

    Returns:
        Dict with ``address``, ``api_key`` (full key — show once),
        ``key_prefix``, ``created`` (bool), ``message``.
        On failure: ``isError`` with ``error`` = ``"validation"``,
        ``"signature_failed"``, or ``"rate_limited"``.

Input parameters:

- `address` (string, required): EVM wallet address (0x..., 42 chars).
- `signature` (string, required): Hex EIP-191 personal_sign of the auth message.
- `timestamp` (integer, required): Unix epoch seconds used in the signed message.

### `check_account_status` (~159 tokens)

Check account status

Check account verification status, credit balance, and API key count.

    Use this after ``create_account`` to poll whether the user has clicked the
    verification link. Pass ``email`` + ``password`` (from ``create_account``)
    for Basic auth, or omit both to use the configured API key.

    Args:
        email: Account email (for Basic auth).
        password: Account password (for Basic auth).

    Returns:
        Dict with ``verified`` (bool), ``email``, ``api_key_count``,
        ``credits_remaining``, ``uploads_remaining``.

Input parameters:

- `email`: Account email (for Basic auth). Omit to use API key.
- `password`: Account password (for Basic auth).

### `manage_api_key` (~270 tokens)

Manage API key

Create, list, or revoke Maginary API keys (up to 10 per account).

    Auth: pass ``email`` + ``password`` for Basic auth (onboarding), or omit
    both to use the configured API key (normal operation).

    Args:
        action: One of ``create``, ``list``, ``revoke``.
        name: Key name (required for ``create``).
        key_prefix: 8-char prefix of the key to revoke (required for ``revoke``).
        email: Account email (for Basic auth).
        password: Account password (for Basic auth).

    Returns:
        For ``create``: dict with ``raw_key`` (the full key — show once, then
        use ``configure_api_key`` to activate it), ``key_prefix``, ``name``.
        For ``list``: dict with ``keys`` array.
        For ``revoke``: success/error message.

Input parameters:

- `action` (string, required): One of: create, list, revoke.
- `email`: Account email (for Basic auth).
- `key_prefix`: 8-char prefix of key to revoke (required for revoke).
- `name`: Key name (required for create).
- `password`: Account password (for Basic auth).

### `configure_api_key` (~191 tokens)

Configure API key

Activate an API key. Local (stdio) servers persist it; hosted does not.

    Call this after ``manage_api_key(action='create')`` returns a ``raw_key``.
    On a local server the key is saved to ``~/.config/maginary/api_key``
    (chmod 600) and survives restarts. On the hosted server
    (mcp.maginary.ai) nothing can be stored — auth is per-request: the
    response will say ``persisted: false`` and the key must be sent as an
    ``Authorization: Bearer <key>`` header on every request (set it in the
    MCP client's connection config).

    Args:
        api_key: The full API key string returned by ``manage_api_key``.

    Returns:
        Confirmation dict.

Input parameters:

- `api_key` (string, required): Full API key string from manage_api_key.

### `get_products` (~146 tokens)

Get products

List available Maginary products/plans with pricing.

    No authentication required. Use this to present purchase options to the
    user. The ``novice_pack`` ($10, 150 credits) is the recommended starting
    point.

    Returns:
        Dict with ``count`` and ``products`` — each product carries ``id``,
        ``short_name``, ``title``, ``description``, ``price_cents``,
        ``credits``, ``uploads``, ``is_subscription``. (The backend sends a
        bare array; it is wrapped here because FastMCP validates tool output
        against the dict annotation and rejects a top-level list.)

### `checkout` (~249 tokens)

Create checkout link

Create a Stripe checkout session for purchasing a product.

    Returns a ``checkout_url`` — the user must open it in a browser to
    complete payment. After payment, credits are provisioned automatically
    via webhook. **Present the URL exactly as returned, including the
    ``#fragment`` — do not truncate, reformat, or strip any part of it.**

    If the agent has a USDC wallet, skip this entirely — just call
    ``generate`` and the x402 protocol handles payment on-chain.

    Args:
        product_id: Product ID from ``get_products``.
        email: Account email (for Basic auth during onboarding).
        password: Account password (for Basic auth during onboarding).

    Returns:
        Dict with ``checkout_url``. On failure, an ``isError`` result — e.g.
        ``error: "email_not_verified"`` until the user clicks the
        verification link, or ``"auth"`` / ``"failed"``.

Input parameters:

- `email`: Account email (for Basic auth during onboarding).
- `password`: Account password (for Basic auth).
- `product_id` (integer, required): Product ID from get_products.

### `get_balance` (~80 tokens)

Get balance

Check remaining credits and uploads for the authenticated account.

    Args:
        email: Account email (for Basic auth).
        password: Account password (for Basic auth).

    Returns:
        Dict with ``credits_remaining`` and ``uploads_remaining``.

Input parameters:

- `email`: Account email (for Basic auth).
- `password`: Account password (for Basic auth).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/maginaryai-maginary-mcp/mcp#diagnostics

## Score history

- 2026-09-20: 60
- 2026-09-19: 60
- 2026-09-18: 60
- 2026-09-17: 59
- 2026-09-16: 59
- 2026-09-15: 58

## Common questions

### What is the io.github.maginaryai/maginary-mcp server?

io.github.maginaryai/maginary-mcp is listed in the public MCP registry as io.github.maginaryai/maginary-mcp. AI image + video generation for agents: --flag prompt DSL, async generate/poll, x402 pay-per-use. This page covers its hosted endpoint (https://mcp.maginary.ai/mcp).

### Is the io.github.maginaryai/maginary-mcp server safe to use?

io.github.maginaryai/maginary-mcp scores 60 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.maginaryai/maginary-mcp server expose?

io.github.maginaryai/maginary-mcp exposes 16 tools: list_parameters, search_parameters, get_parameter, generate, get_generation, and 11 more. Their descriptions and schemas cost roughly 4,830 tokens of context every time the server is loaded.

### Does the io.github.maginaryai/maginary-mcp server require authentication?

No. We connected to io.github.maginaryai/maginary-mcp without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the io.github.maginaryai/maginary-mcp server still maintained?

io.github.maginaryai/maginary-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://mcp.maginary.ai/mcp
- Repository: https://github.com/maginaryai/maginary-mcp
- Website: https://maginary.ai/mcp
- Changelog RSS feed: https://verifymcp.io/servers/maginaryai-maginary-mcp/mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/maginaryai-maginary-mcp/mcp.json
- HTML version of this page: https://verifymcp.io/servers/maginaryai-maginary-mcp/mcp