io.github.MohamedAbdallah-14/prompt-to-asset
NPM · PROMPT-TO-ASSET · SCANNED AUG 3
Generate app icons, favicons, OG images, and logos by routing across 30+ image models.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security70
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (196 of 200), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to MohamedAbdallah-14/prompt-to-asset). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 98 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3912 tokens (~163/item across 24 items; 24 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage80
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 40% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · prompt-to-asset
claude mcp add mohamedabdallah-14-prompt-to-asset -- npx -y prompt-to-asset
codex mcp add mohamedabdallah-14-prompt-to-asset -- npx -y prompt-to-asset
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"mohamedabdallah-14-prompt-to-asset": {
"type": "local",
"command": [
"npx",
"-y",
"prompt-to-asset"
],
"enabled": true
}
}
} openclaw mcp add mohamedabdallah-14-prompt-to-asset --command npx --arg -y --arg prompt-to-asset
mcp_servers:
mohamedabdallah-14-prompt-to-asset:
command: "npx"
args: ["-y", "prompt-to-asset"] {
"mcpServers": {
"mohamedabdallah-14-prompt-to-asset": {
"command": "npx",
"args": [
"-y",
"prompt-to-asset"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Aug 26 +53
- GHSA-f88m-g3jw-g9cj affects this package: high ▼ security
- Known CVEs: unverified → fail ▼ security
- Provenance: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- The attested source repository moved: MohamedAbdallah-14/prompt-to-asset security
- Tool coverage: 100 → unverified ▼ functional
- Stability: unverified → 0.23 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Dependency health: unverified → partial ▲ functional
- Licence: MIT functional
- 1 Aug 26 +11
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 −35
- Malware scan: pass → unverified ▼ security
- Tool coverage: 100 → unverified ▼ functional
- 29 Jul 26 +16
- Dependency health: partial → unverified ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- 28 Jul 26 −16
- Security disclosure: unverified → fail ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- First check of Schema quality: unverified functional
- 27 Jul 26 41
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance verified
Ecosystem: npm · Outcome: verified
Reason: verified
- Source repo:
- MohamedAbdallah-14/prompt-to-asset
- Certificate issuer:
- https://token.actions.githubusercontent.com
- Certificate SAN:
- https://github.com/MohamedAbdallah-14/prompt-to-asset/.github/workflows/publish.yml@refs/tags/mcp-server-v0.4.2
- Rekor log index:
- 1354840876
- Predicate type:
- https://slsa.dev/provenance/v1
- Subject digest:
- sha512:ec22978feb8cbb1944c5ea98c98e0c970f1cda06c35b9458e139735d98d15950d5f728b9975f92389e6a7b91ca97c514a09fcd34aeaf20f9cf021621d
- Discovery method:
- attestation_endpoint
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-f88m-g3jw-g9cj | high | yes |
Dependencies 196 packages
196 packages in the resolved dependency tree · 193 deprecated · 51 stale · 2 without a linked repository.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
asset_brand_bundle_parse ~54
Parse a brand source (brand.json, DTCG tokens, AdCP spec, brand.md, or raw text) into the canonical BrandBundle schema.
| Name | Type | Req | Description |
|---|---|---|---|
| source | string | yes | Path to file or raw text |
No output schema declared.
No examples provided.
asset_capabilities ~110
Report which of the three execution modes this server can run RIGHT NOW given the current env: inline_svg (zero key — hosting LLM authors the SVG), external_prompt_only (zero key — paste prompt into Ideogram/Nano Banana/Midjourney/Recraft/Flux UIs, then asset_ingest_external), api (requires provider key). Read-only; no network. Call before offering the user options.
| Name | Type | Req | Description |
|---|---|---|---|
| asset_type | string | — | Narrow the modes-by-asset-type section to one type. |
No output schema declared.
No examples provided.
asset_doctor ~271
Structured environment inventory — MCP equivalent of `p2a doctor`. Returns native-dependency status (sharp, vtracer, potrace, png-to-ico, satori, resvg-js, tesseract.js, svgo), free-tier routes ranked best-first, paid-provider keys, paste-only providers, pipeline extension URLs, which modes are available right now, and a concrete 'what to try next' suggestion list. Read-only by default. Pass check_data=true to also run the model-registry/routing-table integrity check. Pass auto_fix=true to install missing native binaries (Homebrew / cargo / scoop — never sudo); pair with auto_fix_dry_run=true to preview without executing.
| Name | Type | Req | Description |
|---|---|---|---|
| auto_fix | boolean | — | Run the auto-installer for missing native binaries (vtracer, potrace). Homebrew on macOS, cargo as fallback, scoop on Windows. Linux distro installs and npm optional deps are surfaced as manual hints… |
| auto_fix_dry_run | boolean | — | Only meaningful when auto_fix=true. Plan steps without executing. Defaults to false. |
| check_data | boolean | — | Also run data-integrity check (equivalent to `p2a doctor --data`). Useful in CI after data edits. |
No output schema declared.
No examples provided.
asset_enhance_prompt ~216
Classify an asset brief, route to the right model, rewrite the prompt in that model's dialect, and report which execution modes are available (inline_svg / external_prompt_only / api). Returns an AssetSpec JSON including modes_available, optional svg_brief (for inline_svg), optional paste_targets (for external_prompt_only), and — when the brief leaves a material ambiguity — a `clarifying_questions[]` array the host LLM should surface via AskUserQuestion (or the equivalent) BEFORE calling a generator. Each entry has {id, header, question, options[], required, why}. Read-only; idempotent; no network.
| Name | Type | Req | Description |
|---|---|---|---|
| asset_type | string | — | — |
| brand_bundle | object | — | — |
| brief | string | yes | Plain-English description of the desired asset |
| target_model | string | — | Force a specific model; otherwise selected by router |
| text_content | string | — | Literal text to render in the asset |
| transparent | boolean | — | — |
| vector | boolean | — | — |
No output schema declared.
No examples provided.
asset_export_bundle ~267
Fan out a 1024² master PNG into the full platform bundle (iOS AppIconSet, Android adaptive, PWA maskable, visionOS parallax, Flutter launcher, favicon set). MCP equivalent of `p2a export master.png`. No API key required; runs entirely on sharp. Use when the LLM has a master (inline_svg saved, api-mode result, or user-supplied hand-authored PNG) and needs the platform fan-out.
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | — | Short name for the PWA manifest. |
| bg | string | — | Background color hex for iOS 1024 marketing (opaque), Android adaptive BG, favicon apple-touch. Defaults white. |
| ios18 | boolean | — | When true, also emit iOS 18 dark + tinted 1024² appearance variants. |
| master_path | string | yes | Absolute path to the 1024² master PNG. Resized up front to RGBA 1024². |
| out_dir | string | — | Output directory. Defaults to ./assets/bundle-<stem>-<timestamp> so repeated runs don't clobber. |
| platforms | array | — | Which platform bundles to emit. Defaults to all. |
| theme | string | — | theme_color hex for the PWA manifest. |
No output schema declared.
No examples provided.
asset_generate_app_icon ~193
Generate an app icon (iOS AppIconSet, Android adaptive, PWA maskable, visionOS 1024² master + placeholder parallax layers). Three modes (inline_svg / external_prompt_only / api). In non-api modes only the master mark is produced; call asset_ingest_external afterwards to run the platform fan-out. Set ios_18_appearances=true to also emit dark and tinted 1024² variants for iOS 18 tintable icons.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_bundle | object | — | — |
| brief | string | yes | — |
| ios_18_appearances | boolean | — | Also emit iOS 18 dark (flattened on #000) and tinted (greyscale luminance map) 1024² variants and add `appearances` to Contents.json. |
| mode | string | — | — |
| output_dir | string | — | — |
| platforms | array | — | — |
No output schema declared.
No examples provided.
asset_generate_favicon ~120
Generate a favicon bundle (favicon-{16,32,48}.png + icon.svg + icon-dark.svg + apple-touch + PWA 192/512/512-maskable + <link> snippet). Three modes — inline_svg is the best fit for simple glyph marks (legible at 16×16).
| Name | Type | Req | Description |
|---|---|---|---|
| brand_bundle | object | — | — |
| brief | string | yes | — |
| dark_mode | boolean | — | — |
| existing_mark_svg | string | — | — |
| mode | string | — | — |
| output_dir | string | — | — |
No output schema declared.
No examples provided.
asset_generate_hero ~119
Generate marketing-hero / landing-page banner art. Two modes (external_prompt_only / api); inline_svg is not supported. Accepts aspect_ratio (16:9 / 21:9 / 3:2 / 2:1). Injects brand bundle where supported. Returns N variants if count>1.
| Name | Type | Req | Description |
|---|---|---|---|
| aspect_ratio | string | — | — |
| brand_bundle | object | — | — |
| brief | string | yes | — |
| count | integer | — | — |
| mode | string | — | — |
| output_dir | string | — | — |
No output schema declared.
No examples provided.
asset_generate_illustration ~108
Generate one or more brand-locked illustrations. Two modes (external_prompt_only / api); inline_svg is not supported — path budget too small for a composed scene. Injects brand bundle (palette, style_refs, LoRA, style_id) where supported.
| Name | Type | Req | Description |
|---|---|---|---|
| aspect_ratio | string | — | — |
| brand_bundle | object | — | — |
| brief | string | yes | — |
| count | integer | — | — |
| mode | string | — | — |
| output_dir | string | — | — |
No output schema declared.
No examples provided.
asset_generate_logo ~140
Generate a logo. Three modes: inline_svg (Claude emits SVG — zero key), external_prompt_only (returns prompt + paste targets — zero key), api (server runs the provider pipeline — requires key). Omit mode to auto-select. Returns an AssetBundle / InlineSvgPlan / ExternalPromptPlan discriminated by the mode field.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_bundle | object | — | — |
| brief | string | yes | — |
| mode | string | — | Execution mode. Omit for auto-select (prefers inline_svg → api → external_prompt_only). |
| output_dir | string | — | — |
| text_content | string | — | — |
| vector | boolean | — | — |
No output schema declared.
No examples provided.
asset_generate_og_image ~138
Render a 1200×630 OG image via Satori template (deterministic typography, no diffusion). Default mode=api renders server-side without any API key. external_prompt_only is only meaningful when with_background_image is set. inline_svg is not supported (web-font loading + precise text layout beyond LLM reach).
| Name | Type | Req | Description |
|---|---|---|---|
| background_brief | string | — | — |
| brand_bundle | object | — | — |
| mode | string | — | — |
| output_dir | string | — | — |
| subtitle | string | — | — |
| template | string | — | — |
| title | string | yes | — |
| with_background_image | boolean | — | — |
No output schema declared.
No examples provided.
asset_generate_splash_screen ~183
Generate a cross-platform splash-screen bundle from a brand mark. Two modes (external_prompt_only / api); inline_svg is not supported (splash screens are PNG bundles — generate a logo inline_svg first, then call this with existing_mark_svg). api mode composites the mark onto background_color and emits ios/LaunchScreen-2732.png, android/mipmap-*dpi/splash.png, android/themes-splash.xml, pwa/splash-1200.png, and a README describing how to wire each.
| Name | Type | Req | Description |
|---|---|---|---|
| background_color | string | — | — |
| brand_bundle | object | — | — |
| brief | string | yes | — |
| existing_mark_svg | string | — | Path to an existing brand-mark SVG to center on the splash. Preferred over regenerating. |
| mode | string | — | — |
| output_dir | string | — | — |
| platforms | array | — | — |
No output schema declared.
No examples provided.
asset_ingest_external ~131
Ingest an image the user generated in an external tool (Midjourney, Nano Banana, Ideogram web, Recraft, Flux Playground, etc.) and run the matte → vectorize (where applicable) → tier-0 validation pipeline. The round-trip endpoint for external_prompt_only mode.
| Name | Type | Req | Description |
|---|---|---|---|
| asset_type | string | yes | — |
| brand_bundle | object | — | — |
| expected_text | string | — | — |
| image_path | string | yes | Absolute path to the locally-saved image. |
| output_dir | string | — | — |
| transparent | boolean | — | — |
| vector | boolean | — | — |
No output schema declared.
No examples provided.
asset_init_brand ~288
Scaffold brand.json in the project root + ensure the assets dir exists. MCP equivalent of the `brand.json` portion of `p2a init`. Auto-detects the framework (Next.js, Expo, Flutter, Xcode, Astro, Vite, Remix, Nuxt, React Native, Electron, Node) and returns platform hints. Deliberately does NOT do IDE MCP registration — that's the one piece the user handles once at install time via a terminal. Call this at the start of a new project so subsequent generator calls have a brand source-of-truth and a known output dir.
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | App / brand name. Goes into brand.json and any PWA manifest. |
| assets_dir | string | — | Where generated assets should live. Defaults to the framework's conventional dir. |
| body_font | string | — | Body font family. Defaults to Inter. |
| cwd | string | — | Project root. Defaults to process.cwd(). |
| display_font | string | — | Display font family. Defaults to Inter. |
| do_not | array | — | Brand constraints to inject as negative anchors. Defaults to drop-shadows / heavy-gradients / skeuomorphic-bevels. |
| overwrite | boolean | — | When true, overwrites an existing brand.json. |
| palette | array | — | Brand palette as hex strings. Defaults to ['#2563eb', '#ffffff']. |
No output schema declared.
No examples provided.
asset_models_inspect ~114
Full capability dump for one model. MCP equivalent of `p2a models inspect <id>`. Accepts a model id or an `aka` alias. Returns the full ModelInfo record, env status, paste targets, routing rules that reference this model (as PRIMARY / fallback / NEVER), and usage notes. Read-only; no network.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Model id or aka alias (e.g. 'gpt-image-1', 'nano-banana', 'ideogram-3-turbo'). |
No output schema declared.
No examples provided.
asset_models_list ~160
List the model registry (60+ entries) with optional filters. MCP equivalent of `p2a models list`. Returns id, family, provider, dialect, native_rgba/svg flags, text ceiling, tier (free/paid/paste-only), key_set status. Filter flags: free, paid, paste_only, rgba, svg. Read-only; no network.
| Name | Type | Req | Description |
|---|---|---|---|
| free | boolean | — | Only zero-key / free-tier models. |
| paid | boolean | — | Only paid direct-API models. |
| paste_only | boolean | — | Only paste-only surfaces (Midjourney, Firefly, Krea). |
| rgba | boolean | — | Only models with native transparent-PNG output. |
| svg | boolean | — | Only models with native SVG output. |
No output schema declared.
No examples provided.
asset_nine_slice ~151
Emit a 9-slice config + CSS border-image snippet + Unity/Godot/Phaser/PixiJS-ready numbers from one image and 4 pixel offsets. Optionally also emit an Android .9.png with the 1px stretchable-region encoding. MCP equivalent of `p2a nine-slice <image>`.
| Name | Type | Req | Description |
|---|---|---|---|
| android_9patch | boolean | — | Also emit <name>.9.png with Android 9-patch 1px-border encoding. |
| guides | object | yes | Pixel offsets from each edge marking the fixed regions. |
| image | string | yes | Path to the source image. |
| out | string | — | Output directory. Defaults to the directory of the input image. |
No output schema declared.
No examples provided.
asset_remove_background ~72
Matte an image to transparent background (BiRefNet / BRIA RMBG / U²-Net via remote endpoint; local white-chroma fallback). Returns RGBA PNG path.
| Name | Type | Req | Description |
|---|---|---|---|
| image | string | yes | Path or URL to input image |
| mode | string | — | — |
| output_dir | string | — | — |
No output schema declared.
No examples provided.
asset_save_inline_svg ~354
Round-trip endpoint for inline_svg mode. After you (the LLM) emit the <svg>…</svg> in chat, immediately call this tool with that SVG text so the server writes a complete asset bundle to disk: master.svg + (for favicon) icon.svg + icon-dark.svg + favicon-{16,32,48}.png + favicon.ico + apple-touch-icon.png (opaque) + pwa-192.png + pwa-512.png + pwa-512-maskable.png + manifest.webmanifest + head-snippet.html + (for app_icon) the full iOS AppIconSet + Android adaptive (foreground+background+monochrome) + PWA maskable + visionOS. Returns an AssetBundle with file paths the user can open. Validates the SVG against the original svg_brief (viewBox, path count, palette, forbidden elements).
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | — | For asset_type=favicon: name/short_name written into manifest.webmanifest. |
| asset_type | string | yes | — |
| background_color | string | — | For asset_type=favicon: PWA splash background_color hex. |
| brand_bundle | object | — | — |
| dark_mode | boolean | — | For asset_type=favicon: also emit icon-dark.svg (prefers-color-scheme: dark). Default true. |
| expected_text | string | — | — |
| output_dir | string | — | — |
| platforms | array | — | For asset_type=app_icon. Defaults to ['all']. |
| svg | string | yes | The full <svg>...</svg> text you just emitted in chat. |
| theme_color | string | — | For asset_type=favicon: theme_color hex for manifest + <meta>. |
No output schema declared.
No examples provided.
asset_sprite_sheet ~156
Pack a directory of PNG/WEBP/JPG frames into one sprite sheet + TexturePacker-compatible JSON atlas (works in Phaser, PixiJS, Three.js, Godot, Unity via a light importer). MCP equivalent of `p2a sprite-sheet <dir>`. Offline, no API key.
| Name | Type | Req | Description |
|---|---|---|---|
| atlas | string | — | Output atlas JSON path. Defaults to the sheet path with .json extension. |
| columns | integer | — | Columns (grid only). Defaults to ceil(sqrt(n)). |
| dir | string | yes | Directory containing frames. Sorted by natural filename order. |
| layout | string | — | — |
| out | string | — | Output PNG path. Defaults to ./sprites.png. |
| padding | integer | — | — |
No output schema declared.
No examples provided.
asset_train_brand_lora ~239
Train a brand-consistent LoRA from 20-50 sample images, returning a `lora_id` the `comfyui-*` and SDXL-family providers can reference. Requires a user-owned training endpoint (Modal / Runpod / self-host) at PROMPT_TO_BUNDLE_MODAL_LORA_TRAIN_URL. Phase-4 scaffold: the MCP tool does the packaging, validation, and HTTP; the user owns the deployment and pricing. See docs/research/06-stable-diffusion-flux/6d-lora-training-for-brand-style.md.
| Name | Type | Req | Description |
|---|---|---|---|
| base_model | string | — | Base model to fine-tune (sdxl-1.0 / flux-1-dev / sd-1.5). |
| captions | array | — | Per-image caption overrides. Auto-captioned if omitted. |
| name | string | yes | Brand slug. Becomes the LoRA trigger token. |
| rank | number | — | — |
| steps | number | — | — |
| training_images | array | yes | Local filesystem paths (5-200). 20-50 is the sweet spot. Paths go through the safeReadPath allow-list. |
No output schema declared.
No examples provided.
asset_upscale_refine ~91
Upscale / refine an image, asset-type-aware. DAT2 for flat logos/icons, Real-ESRGAN/SUPIR for photoreal, img2img for diffusion polish. Lanczos fallback.
| Name | Type | Req | Description |
|---|---|---|---|
| asset_type | string | — | — |
| image | string | yes | — |
| mode | string | — | — |
| output_dir | string | — | — |
| target_size | integer | — | — |
No output schema declared.
No examples provided.
asset_validate ~126
Run tier-0 deterministic validators on an asset (dimensions, alpha presence, checkerboard-pattern heuristic on tile-luma alternation, safe-zone bbox, palette ΔE2000 against brand, WCAG contrast of brand primary vs light and dark tabs, OCR Levenshtein against intended_text). Optional tier-2 VLM-as-judge via PROMPT_TO_BUNDLE_VLM_URL.
| Name | Type | Req | Description |
|---|---|---|---|
| asset_type | string | yes | — |
| brand_bundle | object | — | — |
| image | string | yes | — |
| intended_text | string | — | — |
| run_vlm | boolean | — | — |
No output schema declared.
No examples provided.
asset_vectorize ~111
Convert a raster image to SVG. Tries in order: Recraft /vectorize (if PROMPT_TO_BUNDLE_RECRAFT_VECTORIZE_URL is set), vtracer on PATH, potrace on PATH, then a built-in posterize run-length fallback. Passes all output through SVGO when installed.
| Name | Type | Req | Description |
|---|---|---|---|
| image | string | yes | — |
| max_paths | integer | — | — |
| mode | string | — | — |
| output_dir | string | — | — |
| palette_size | integer | — | — |
No output schema declared.
No examples provided.