# io.github.MohamedAbdallah-14/prompt-to-asset (npm · prompt-to-asset)

Generate app icons, favicons, OG images, and logos by routing across 30+ image models.

- Trust score: 71/100 (medium)
- Change this week: +30
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `prompt-to-asset`: 71/100 (this document), [markdown](https://verifymcp.io/servers/mohamedabdallah-14-prompt-to-asset/prompt-to-asset.md), [page](https://verifymcp.io/servers/mohamedabdallah-14-prompt-to-asset/prompt-to-asset)

## Channel facts

- Registry: `npm`
- Package: `prompt-to-asset`
- Version: `0.4.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 70/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (196 of 200), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to MohamedAbdallah-14/prompt-to-asset).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 98 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3912 tokens (~163/item across 24 items; 24 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 80/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 40% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add mohamedabdallah-14-prompt-to-asset -- npx -y prompt-to-asset
```

### Codex

```bash
codex mcp add mohamedabdallah-14-prompt-to-asset -- npx -y prompt-to-asset
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mohamedabdallah-14-prompt-to-asset": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "prompt-to-asset"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add mohamedabdallah-14-prompt-to-asset --command npx --arg -y --arg prompt-to-asset
```

### Hermes

```yaml
mcp_servers:
  mohamedabdallah-14-prompt-to-asset:
    command: "npx"
    args: ["-y", "prompt-to-asset"]
```

### Other

```json
{
  "mcpServers": {
    "mohamedabdallah-14-prompt-to-asset": {
      "command": "npx",
      "args": [
        "-y",
        "prompt-to-asset"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 70, +53)

- [security regression] GHSA-f88m-g3jw-g9cj affects this package: high
- [security regression] Known CVEs: unverified → fail
- [security improvement] Provenance: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] The attested source repository moved: MohamedAbdallah-14/prompt-to-asset
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-08-01 (score 17, +11)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 6, −35)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-29 (score 41, +16)

- [functional regression] Dependency health: partial → unverified
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 25, −16)

- [functional regression] Security disclosure: unverified → fail
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 41)

First indexed and scored.

## MCP tools (24)

### `asset_capabilities` (~110 tokens)

Report which of the three execution modes this server can run RIGHT NOW given the current env: inline_svg (zero key — hosting LLM authors the SVG), external_prompt_only (zero key — paste prompt into Ideogram/Nano Banana/Midjourney/Recraft/Flux UIs, then asset_ingest_external), api (requires provider key). Read-only; no network. Call before offering the user options.

Input parameters:

- `asset_type` (string): Narrow the modes-by-asset-type section to one type.

### `asset_enhance_prompt` (~216 tokens)

Classify an asset brief, route to the right model, rewrite the prompt in that model's dialect, and report which execution modes are available (inline_svg / external_prompt_only / api). Returns an AssetSpec JSON including modes_available, optional svg_brief (for inline_svg), optional paste_targets (for external_prompt_only), and — when the brief leaves a material ambiguity — a `clarifying_questions[]` array the host LLM should surface via AskUserQuestion (or the equivalent) BEFORE calling a generator. Each entry has {id, header, question, options[], required, why}. Read-only; idempotent; no network.

Input parameters:

- `asset_type` (string)
- `brand_bundle` (object)
- `brief` (string, required): Plain-English description of the desired asset
- `target_model` (string): Force a specific model; otherwise selected by router
- `text_content` (string): Literal text to render in the asset
- `transparent` (boolean)
- `vector` (boolean)

### `asset_generate_logo` (~140 tokens)

Generate a logo. Three modes: inline_svg (Claude emits SVG — zero key), external_prompt_only (returns prompt + paste targets — zero key), api (server runs the provider pipeline — requires key). Omit mode to auto-select. Returns an AssetBundle / InlineSvgPlan / ExternalPromptPlan discriminated by the mode field.

Input parameters:

- `brand_bundle` (object)
- `brief` (string, required)
- `mode` (string): Execution mode. Omit for auto-select (prefers inline_svg → api → external_prompt_only).
- `output_dir` (string)
- `text_content` (string)
- `vector` (boolean)

### `asset_generate_app_icon` (~193 tokens)

Generate an app icon (iOS AppIconSet, Android adaptive, PWA maskable, visionOS 1024² master + placeholder parallax layers). Three modes (inline_svg / external_prompt_only / api). In non-api modes only the master mark is produced; call asset_ingest_external afterwards to run the platform fan-out. Set ios_18_appearances=true to also emit dark and tinted 1024² variants for iOS 18 tintable icons.

Input parameters:

- `brand_bundle` (object)
- `brief` (string, required)
- `ios_18_appearances` (boolean): Also emit iOS 18 dark (flattened on #000) and tinted (greyscale luminance map) 1024² variants and add `appearances` to Contents.json.
- `mode` (string)
- `output_dir` (string)
- `platforms` (array)

### `asset_generate_favicon` (~120 tokens)

Generate a favicon bundle (favicon-{16,32,48}.png + icon.svg + icon-dark.svg + apple-touch + PWA 192/512/512-maskable + <link> snippet). Three modes — inline_svg is the best fit for simple glyph marks (legible at 16×16).

Input parameters:

- `brand_bundle` (object)
- `brief` (string, required)
- `dark_mode` (boolean)
- `existing_mark_svg` (string)
- `mode` (string)
- `output_dir` (string)

### `asset_generate_og_image` (~138 tokens)

Render a 1200×630 OG image via Satori template (deterministic typography, no diffusion). Default mode=api renders server-side without any API key. external_prompt_only is only meaningful when with_background_image is set. inline_svg is not supported (web-font loading + precise text layout beyond LLM reach).

Input parameters:

- `background_brief` (string)
- `brand_bundle` (object)
- `mode` (string)
- `output_dir` (string)
- `subtitle` (string)
- `template` (string)
- `title` (string, required)
- `with_background_image` (boolean)

### `asset_generate_illustration` (~108 tokens)

Generate one or more brand-locked illustrations. Two modes (external_prompt_only / api); inline_svg is not supported — path budget too small for a composed scene. Injects brand bundle (palette, style_refs, LoRA, style_id) where supported.

Input parameters:

- `aspect_ratio` (string)
- `brand_bundle` (object)
- `brief` (string, required)
- `count` (integer)
- `mode` (string)
- `output_dir` (string)

### `asset_generate_splash_screen` (~183 tokens)

Generate a cross-platform splash-screen bundle from a brand mark. Two modes (external_prompt_only / api); inline_svg is not supported (splash screens are PNG bundles — generate a logo inline_svg first, then call this with existing_mark_svg). api mode composites the mark onto background_color and emits ios/LaunchScreen-2732.png, android/mipmap-*dpi/splash.png, android/themes-splash.xml, pwa/splash-1200.png, and a README describing how to wire each.

Input parameters:

- `background_color` (string)
- `brand_bundle` (object)
- `brief` (string, required)
- `existing_mark_svg` (string): Path to an existing brand-mark SVG to center on the splash. Preferred over regenerating.
- `mode` (string)
- `output_dir` (string)
- `platforms` (array)

### `asset_generate_hero` (~119 tokens)

Generate marketing-hero / landing-page banner art. Two modes (external_prompt_only / api); inline_svg is not supported. Accepts aspect_ratio (16:9 / 21:9 / 3:2 / 2:1). Injects brand bundle where supported. Returns N variants if count>1.

Input parameters:

- `aspect_ratio` (string)
- `brand_bundle` (object)
- `brief` (string, required)
- `count` (integer)
- `mode` (string)
- `output_dir` (string)

### `asset_remove_background` (~72 tokens)

Matte an image to transparent background (BiRefNet / BRIA RMBG / U²-Net via remote endpoint; local white-chroma fallback). Returns RGBA PNG path.

Input parameters:

- `image` (string, required): Path or URL to input image
- `mode` (string)
- `output_dir` (string)

### `asset_vectorize` (~111 tokens)

Convert a raster image to SVG. Tries in order: Recraft /vectorize (if PROMPT_TO_BUNDLE_RECRAFT_VECTORIZE_URL is set), vtracer on PATH, potrace on PATH, then a built-in posterize run-length fallback. Passes all output through SVGO when installed.

Input parameters:

- `image` (string, required)
- `max_paths` (integer)
- `mode` (string)
- `output_dir` (string)
- `palette_size` (integer)

### `asset_upscale_refine` (~91 tokens)

Upscale / refine an image, asset-type-aware. DAT2 for flat logos/icons, Real-ESRGAN/SUPIR for photoreal, img2img for diffusion polish. Lanczos fallback.

Input parameters:

- `asset_type` (string)
- `image` (string, required)
- `mode` (string)
- `output_dir` (string)
- `target_size` (integer)

### `asset_validate` (~126 tokens)

Run tier-0 deterministic validators on an asset (dimensions, alpha presence, checkerboard-pattern heuristic on tile-luma alternation, safe-zone bbox, palette ΔE2000 against brand, WCAG contrast of brand primary vs light and dark tabs, OCR Levenshtein against intended_text). Optional tier-2 VLM-as-judge via PROMPT_TO_BUNDLE_VLM_URL.

Input parameters:

- `asset_type` (string, required)
- `brand_bundle` (object)
- `image` (string, required)
- `intended_text` (string)
- `run_vlm` (boolean)

### `asset_brand_bundle_parse` (~54 tokens)

Parse a brand source (brand.json, DTCG tokens, AdCP spec, brand.md, or raw text) into the canonical BrandBundle schema.

Input parameters:

- `source` (string, required): Path to file or raw text

### `asset_save_inline_svg` (~354 tokens)

Round-trip endpoint for inline_svg mode. After you (the LLM) emit the <svg>…</svg> in chat, immediately call this tool with that SVG text so the server writes a complete asset bundle to disk: master.svg + (for favicon) icon.svg + icon-dark.svg + favicon-{16,32,48}.png + favicon.ico + apple-touch-icon.png (opaque) + pwa-192.png + pwa-512.png + pwa-512-maskable.png + manifest.webmanifest + head-snippet.html + (for app_icon) the full iOS AppIconSet + Android adaptive (foreground+background+monochrome) + PWA maskable + visionOS. Returns an AssetBundle with file paths the user can open. Validates the SVG against the original svg_brief (viewBox, path count, palette, forbidden elements).

Input parameters:

- `app_name` (string): For asset_type=favicon: name/short_name written into manifest.webmanifest.
- `asset_type` (string, required)
- `background_color` (string): For asset_type=favicon: PWA splash background_color hex.
- `brand_bundle` (object)
- `dark_mode` (boolean): For asset_type=favicon: also emit icon-dark.svg (prefers-color-scheme: dark). Default true.
- `expected_text` (string)
- `output_dir` (string)
- `platforms` (array): For asset_type=app_icon. Defaults to ['all'].
- `svg` (string, required): The full <svg>...</svg> text you just emitted in chat.
- `theme_color` (string): For asset_type=favicon: theme_color hex for manifest + <meta>.

### `asset_ingest_external` (~131 tokens)

Ingest an image the user generated in an external tool (Midjourney, Nano Banana, Ideogram web, Recraft, Flux Playground, etc.) and run the matte → vectorize (where applicable) → tier-0 validation pipeline. The round-trip endpoint for external_prompt_only mode.

Input parameters:

- `asset_type` (string, required)
- `brand_bundle` (object)
- `expected_text` (string)
- `image_path` (string, required): Absolute path to the locally-saved image.
- `output_dir` (string)
- `transparent` (boolean)
- `vector` (boolean)

### `asset_train_brand_lora` (~239 tokens)

Train a brand-consistent LoRA from 20-50 sample images, returning a `lora_id` the `comfyui-*` and SDXL-family providers can reference. Requires a user-owned training endpoint (Modal / Runpod / self-host) at PROMPT_TO_BUNDLE_MODAL_LORA_TRAIN_URL. Phase-4 scaffold: the MCP tool does the packaging, validation, and HTTP; the user owns the deployment and pricing. See docs/research/06-stable-diffusion-flux/6d-lora-training-for-brand-style.md.

Input parameters:

- `base_model` (string): Base model to fine-tune (sdxl-1.0 / flux-1-dev / sd-1.5).
- `captions` (array): Per-image caption overrides. Auto-captioned if omitted.
- `name` (string, required): Brand slug. Becomes the LoRA trigger token.
- `rank` (number)
- `steps` (number)
- `training_images` (array, required): Local filesystem paths (5-200). 20-50 is the sweet spot. Paths go through the safeReadPath allow-list.

### `asset_doctor` (~271 tokens)

Structured environment inventory — MCP equivalent of `p2a doctor`. Returns native-dependency status (sharp, vtracer, potrace, png-to-ico, satori, resvg-js, tesseract.js, svgo), free-tier routes ranked best-first, paid-provider keys, paste-only providers, pipeline extension URLs, which modes are available right now, and a concrete 'what to try next' suggestion list. Read-only by default. Pass check_data=true to also run the model-registry/routing-table integrity check. Pass auto_fix=true to install missing native binaries (Homebrew / cargo / scoop — never sudo); pair with auto_fix_dry_run=true to preview without executing.

Input parameters:

- `auto_fix` (boolean): Run the auto-installer for missing native binaries (vtracer, potrace). Homebrew on macOS, cargo as fallback, scoop on Windows. Linux distro installs and npm optional deps are surfaced as manual hints…
- `auto_fix_dry_run` (boolean): Only meaningful when auto_fix=true. Plan steps without executing. Defaults to false.
- `check_data` (boolean): Also run data-integrity check (equivalent to `p2a doctor --data`). Useful in CI after data edits.

### `asset_models_list` (~160 tokens)

List the model registry (60+ entries) with optional filters. MCP equivalent of `p2a models list`. Returns id, family, provider, dialect, native_rgba/svg flags, text ceiling, tier (free/paid/paste-only), key_set status. Filter flags: free, paid, paste_only, rgba, svg. Read-only; no network.

Input parameters:

- `free` (boolean): Only zero-key / free-tier models.
- `paid` (boolean): Only paid direct-API models.
- `paste_only` (boolean): Only paste-only surfaces (Midjourney, Firefly, Krea).
- `rgba` (boolean): Only models with native transparent-PNG output.
- `svg` (boolean): Only models with native SVG output.

### `asset_models_inspect` (~114 tokens)

Full capability dump for one model. MCP equivalent of `p2a models inspect <id>`. Accepts a model id or an `aka` alias. Returns the full ModelInfo record, env status, paste targets, routing rules that reference this model (as PRIMARY / fallback / NEVER), and usage notes. Read-only; no network.

Input parameters:

- `id` (string, required): Model id or aka alias (e.g. 'gpt-image-1', 'nano-banana', 'ideogram-3-turbo').

### `asset_export_bundle` (~267 tokens)

Fan out a 1024² master PNG into the full platform bundle (iOS AppIconSet, Android adaptive, PWA maskable, visionOS parallax, Flutter launcher, favicon set). MCP equivalent of `p2a export master.png`. No API key required; runs entirely on sharp. Use when the LLM has a master (inline_svg saved, api-mode result, or user-supplied hand-authored PNG) and needs the platform fan-out.

Input parameters:

- `app_name` (string): Short name for the PWA manifest.
- `bg` (string): Background color hex for iOS 1024 marketing (opaque), Android adaptive BG, favicon apple-touch. Defaults white.
- `ios18` (boolean): When true, also emit iOS 18 dark + tinted 1024² appearance variants.
- `master_path` (string, required): Absolute path to the 1024² master PNG. Resized up front to RGBA 1024².
- `out_dir` (string): Output directory. Defaults to ./assets/bundle-<stem>-<timestamp> so repeated runs don't clobber.
- `platforms` (array): Which platform bundles to emit. Defaults to all.
- `theme` (string): theme_color hex for the PWA manifest.

### `asset_sprite_sheet` (~156 tokens)

Pack a directory of PNG/WEBP/JPG frames into one sprite sheet + TexturePacker-compatible JSON atlas (works in Phaser, PixiJS, Three.js, Godot, Unity via a light importer). MCP equivalent of `p2a sprite-sheet <dir>`. Offline, no API key.

Input parameters:

- `atlas` (string): Output atlas JSON path. Defaults to the sheet path with .json extension.
- `columns` (integer): Columns (grid only). Defaults to ceil(sqrt(n)).
- `dir` (string, required): Directory containing frames. Sorted by natural filename order.
- `layout` (string)
- `out` (string): Output PNG path. Defaults to ./sprites.png.
- `padding` (integer)

### `asset_nine_slice` (~151 tokens)

Emit a 9-slice config + CSS border-image snippet + Unity/Godot/Phaser/PixiJS-ready numbers from one image and 4 pixel offsets. Optionally also emit an Android .9.png with the 1px stretchable-region encoding. MCP equivalent of `p2a nine-slice <image>`.

Input parameters:

- `android_9patch` (boolean): Also emit <name>.9.png with Android 9-patch 1px-border encoding.
- `guides` (object, required): Pixel offsets from each edge marking the fixed regions.
- `image` (string, required): Path to the source image.
- `out` (string): Output directory. Defaults to the directory of the input image.

### `asset_init_brand` (~288 tokens)

Scaffold brand.json in the project root + ensure the assets dir exists. MCP equivalent of the `brand.json` portion of `p2a init`. Auto-detects the framework (Next.js, Expo, Flutter, Xcode, Astro, Vite, Remix, Nuxt, React Native, Electron, Node) and returns platform hints. Deliberately does NOT do IDE MCP registration — that's the one piece the user handles once at install time via a terminal. Call this at the start of a new project so subsequent generator calls have a brand source-of-truth and a known output dir.

Input parameters:

- `app_name` (string, required): App / brand name. Goes into brand.json and any PWA manifest.
- `assets_dir` (string): Where generated assets should live. Defaults to the framework's conventional dir.
- `body_font` (string): Body font family. Defaults to Inter.
- `cwd` (string): Project root. Defaults to process.cwd().
- `display_font` (string): Display font family. Defaults to Inter.
- `do_not` (array): Brand constraints to inject as negative anchors. Defaults to drop-shadows / heavy-gradients / skeuomorphic-bevels.
- `overwrite` (boolean): When true, overwrites an existing brand.json.
- `palette` (array): Brand palette as hex strings. Defaults to ['#2563eb', '#ffffff'].

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/mohamedabdallah-14-prompt-to-asset/prompt-to-asset#diagnostics

## Score history

- 2026-08-03: 71
- 2026-08-02: 70
- 2026-08-01: 17
- 2026-07-31: 6
- 2026-07-29: 41
- 2026-07-28: 25
- 2026-07-27: 41

## Links

- npm package: https://www.npmjs.com/package/prompt-to-asset
- Socket report: https://socket.dev/npm/package/prompt-to-asset
- Repository: https://github.com/MohamedAbdallah-14/prompt-to-asset
- Changelog RSS feed: https://verifymcp.io/servers/mohamedabdallah-14-prompt-to-asset/prompt-to-asset/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/mohamedabdallah-14-prompt-to-asset/prompt-to-asset/changelog.json
- HTML version of this page: https://verifymcp.io/servers/mohamedabdallah-14-prompt-to-asset/prompt-to-asset