Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

SpicyAPI MCP

NPM · @SPICYAPI/MCP

Image, video and audio generation APIs with USD quotes and confirmation before paid requests.

Available components

+4 this week 79 Trust /100

Last scanned (22 hours ago)

Scores higher than 61% of npm servers

Category Design and Media

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security83
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects @modelcontextprotocol/node 2.0.0, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 0 of 10 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to spicyapi-ai/spicy-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability75
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 3982 tokens (~165/item across 24 items; 22 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage83
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 39% of tool parameters carry a description.Partial
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +16
    • Malware scan: unverified → pass ▲ security
  • 3 Nov 26 −12
    • Malware scan: pass → unverified ▼ security
    • Schema quality: 146 → 165 ▼ functional
    • Stability: unverified → 0.23 ▲ functional
    • Package version: 0.6.1 → 0.6.2 functional
  • 29 Oct 26 0
    • CVE-2026-118663 affects this package: high ▼ security
  • 28 Oct 26 +15
    • GHSA-f897-62hf-6gxq affects this package: high ▼ security
    • Malware scan: unverified → pass ▲ security
  • 27 Oct 26 60

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed npm/@spicyapi/mcp@0.6.2

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo spicyapi-ai/spicy-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/spicyapi-ai/spicy-mcp/.github/workflows/release.yml@refs/heads/main
Rekor log index 3673933967
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:bd011d61d14370fbe546b30c54bc3314fdb28d9bd4671f20a96d0cb26b319b6f850017417da32307991f91a63da92ee77f36a37f8f350d0155800f28b

Background: How many MCP packages publish verified provenance →

Vulnerabilities 6 findings
ID CVE Severity Vector Fix available
GHSA-rmxm-3fg6-px4f CVE-2026-118663 medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N yes
GHSA-f897-62hf-6gxq high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-46jr-4wx8-v453 CVE-2026-111768 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-jm63-cq47-j5jp CVE-2026-111770 high CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H yes
GHSA-rvq5-wwqv-78pq CVE-2026-111771 medium CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N yes
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 10 packages
Packages resolved 10
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 22 exposed · ~3,691 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
spicyapi_asset_delete ~116

Permanently delete one asset from the library this key reaches. Its spicy://a/<id> uri stops working in new requests at once and the stored file is removed; there is no undo. In a team library, developers can delete only what they saved. Deleting does not give back today's allowance of new assets. Only delete an asset the user named. Requires a user confirmation round.

NameTypeReqDescription
assetIdstringyesThe asset id (ast_…) or its spicy://a/<id> reference; both are accepted.
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_asset_rename ~74

Change an asset's name. Its spicy://a/<id> uri stays the same, so model inputs that already use it keep working.

NameTypeReqDescription
assetIdstringyesThe asset id (ast_…) or its spicy://a/<id> reference; both are accepted.
namestringyes–
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_asset_save ~369

Keep a file in the asset library this key reaches (personal, or the team's shared library for a team key) until it is deleted, and return its spicy://a/<id> uri for later model inputs made with keys of the same workspace. Give exactly one source: taskId (an output of one of the user's own successful tasks, or of the team's with a team key; index or key picks which, the first output by default), path (an absolute path to a file on this computer, uploaded first), url (a public http or https file), or fileId (a committed spicy://f/ upload). Saving the same task output, upload or URL again returns the existing asset. Storage unlocks with lifetime top-ups; a refusal carries a reason (asset_library_locked, asset_library_full, asset_file_too_large, asset_daily_limit, asset_storage_full) — call spicyapi_assets_usage_get to explain the plan rather than retrying.

NameTypeReqDescription
contentTypestring–With path: only when the file extension is missing or wrong.
fileIdstring–A committed upload: fil_… or spicy://f/…
idempotencyKeystring–Reuse the key from an uncertain earlier attempt to replay that save. Not used with path, which uploads again on every call.
indexinteger–With taskId: zero-based position in output.assets.
keystring–With taskId: the output key, instead of index.
namestring–Up to 80 characters; a path defaults to its file name.
pathstring–Absolute path to a file on this computer, as the user gave it.
taskIdstring––
urlstring––
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_assets_list ~343

List files in the asset library this key reaches — the personal library for a personal key, the team's shared library for a team key — newest first unless sort says otherwise, one page at a time; pass nextCursor back as cursor with the same filters and sort to continue (a cursor from another sort is rejected with 400). Narrow it with favorite, collectionId (a folder; folders are created on the web, and an id outside this library is a 404), entityId (the images of one character) and query. Each item's uri (spicy://a/<id>) goes straight into any media field of a model input — no upload or download step. previewUrl is a private preview signed for at most 20 minutes; use it to show the file, never store it. A change the key's team role does not allow gets 403 with reason asset_permission_denied; a key that cannot reach the library gets 403 with asset_workspace_forbidden.

NameTypeReqDescription
collectionIdstring–Only the assets in this folder (a collection of the same library).
cursorstring––
entityIdstring–Only the images of this character, from spicyapi_characters_list.
favoriteboolean–true lists only favorites, false only assets that are not favorites.
kindstring––
limitinteger––
querystring–Case-insensitive part of the asset name.
sortstring–recent (default, newest first), oldest, name (A to Z) or size (largest first).
sourcearray–Only assets saved from these sources.
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_assets_usage_get ~117

Return which library the key reaches (scope), the storage plan, what is stored against its limits, how many assets were saved today against the daily limit, and the next plan with how much more to top up. Usage covers the owner's whole allowance, shared by their personal and team libraries; the top-up amounts are absent when scope.canTopUp is false. Plans unlock with lifetime top-ups and never go down; byte values use binary units (500 MB = 524288000 bytes). Use it to explain a refused save.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_balance_get ~41

Return available, held, and total balance as exact decimal USD strings when requested or diagnosing funds. Task creation already checks funds; this is not a prerequisite.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_character_get ~171

Read one character with its images in order, each with its uri and a fresh private previewUrl (signed for at most 20 minutes; never store it). An unknown character and one outside this key's library both return 404. To use a character, put the uri (spicy://a/<id>) of its images, in the order given, into the reference image field of the model's input (spicyapi_model_get shows which field), and refer to them in the prompt the way that model's page describes. Characters are created and edited on the web; these tools only read them. Older spicy://p/<id> persona references still resolve to the same images, in the personal library only.

NameTypeReqDescription
characterIdstringyesThe character id from spicyapi_characters_list.
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_characters_list ~204

List the characters in the asset library this key reaches: named sets of images, each image an asset with its own uri. Newest first, one page at a time; pass nextCursor back as cursor to continue. Pass assetId to find the characters that contain one asset. To use a character, put the uri (spicy://a/<id>) of its images, in the order given, into the reference image field of the model's input (spicyapi_model_get shows which field), and refer to them in the prompt the way that model's page describes. Characters are created and edited on the web; these tools only read them. Older spicy://p/<id> persona references still resolve to the same images, in the personal library only.

NameTypeReqDescription
assetIdstring–Only the characters that contain this asset (ast_… or spicy://a/<id>).
cursorstring––
limitinteger––
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_docs_search ~35

Search the bundled index of verified first-party documentation URLs.

NameTypeReqDescription
limitinteger––
querystring––
NameTypeReqDescription
resultarrayyes–

No examples provided.

spicyapi_download_url_create ~82

Create a short-lived signed URL for an output owned by the current task and API key, for legacy integrations or explicit link renewal. Prefer existing ready output.assets[].url from task_get, task_wait, or a verified v2 webhook; no ticket call is needed for those links.

NameTypeReqDescription
keystring––
taskIdstringyes–
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_model_get ~94

Return one exact model, its live input schema, pricing, policy and availability. Reuse a complete record already obtained from models_list with includeSchema. The input schema is plain JSON Schema; display-only and rate-card annotations are removed. Some input values change the price; task_create obtains the exact request quote for confirmation. Use pricing entries for comparisons rather than calculating the accepted charge yourself.

NameTypeReqDescription
modelstringyes–
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_models_list ~235

Discover enabled models and account-specific prices. Fetch only the selected model for its schema, or set includeSchema to reuse complete records without another model_get call. Returned input schemas are plain JSON Schema; display-only and rate-card annotations are removed. Some input values change the price; task_create obtains the exact request quote for confirmation. Use pricing entries for comparisons rather than calculating the accepted charge yourself. Models with task `realtime` or `realtime-transcription` take one bounded turn as a task from their input schema; live, continuous audio needs a server-side WebSocket to wss://api.spicyapi.ai/v1/realtime, which this server does not open. Embedding models (task `embedding`) and text-to-speech models are also served by OpenAI-compatible POST /v1/embeddings and POST /v1/audio/speech for applications that want vectors or audio bytes directly.

NameTypeReqDescription
includeExamplesboolean––
includeSchemaboolean––
modalitystring––
providerstring––
searchstring––
taskstring––
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_service_status ~96

Read public health and readiness endpoints for diagnostics or an explicit status request. Not a prerequisite for task creation. No API key is required. Report the `operational` field. On the public surface /readyz answers 404 by design — readiness exposes database and Redis state, so it is registered only on the admin process — and `operational` already accounts for that. Do not report a 404 there as an outage.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_task_create ~306

Obtain the exact request quote, show its USD estimate and maximum charge for user confirmation, then reserve funds and create an asynchronous task. Do not call task_quote first unless independently comparing prices. The confirmation needs an MCP client that supports form elicitation; if the client does not, the call fails after the free quote and no task is created or charged. Models with task `realtime` or `realtime-transcription` take one bounded turn as a task from their input schema; live, continuous audio needs a server-side WebSocket to wss://api.spicyapi.ai/v1/realtime, which this server does not open. Embedding models (task `embedding`) and text-to-speech models are also served by OpenAI-compatible POST /v1/embeddings and POST /v1/audio/speech for applications that want vectors or audio bytes directly.

NameTypeReqDescription
callBackUrlstring––
idempotencyKeystring––
inputobjectyes–
modelstringyes–
retentionSecondsinteger–How long SpicyAPI keeps this task's generated media, result payload, prompt and other input text, in seconds. Only ever shortens: the account settings and platform maximum still apply, so this cannot…
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_task_get ~269

Read a task created by the current API key, including ready output.assets[].url links. Use those URLs directly without your API key; query again if assets are pending or URLs have expired. A verified complete v2 webhook already contains the result. Unknown and inaccessible IDs are both 404. Some models answer in words instead of a file: speech-to-text and other text results arrive in output.text with no assets, and a transcription may add output.transcript with word timings, timed segments (output.transcript.segments, with speaker labels when available) and the detected language. Embedding models return vectors in output.embeddings (inputTokens and data[].index/embedding); large results are summarized here, see output.embeddings.summary. Layer decomposition returns one image asset per layer; stack them by ascending output.assets[].layer.zIndex. Other asset roles: image-to-3d and text-to-3d return one `mesh` asset (a binary glTF .glb, mime model/gltf-binary); vector endpoints return `image` assets with mime image/svg+xml; video translation can add a `subtitle` asset (.srt); video extension that joins the source clip returns the joined `video` first and the new part as `segment`.

NameTypeReqDescription
taskIdstringyes–
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_task_purge ~207

Permanently destroy one terminal task's stored content: generated media, result payload, prompt, and input text. This destroys content, not the record of what it cost — the ledger entry, charged amount, model, state, timestamps and request ID all stay queryable afterwards, so this never hides or reverses a charge and never refunds anything. It cannot be undone and there is no per-output granularity: the unit is one whole task. Download any result the user still wants before calling this. Only tasks in a terminal state are accepted. An accepted task cannot be canceled and there is no cancellation API, so for a queued or running task wait until it finishes (task_wait), then purge it. Repeating the call on an already destroyed task succeeds and changes nothing. Requires a user confirmation round.

NameTypeReqDescription
taskIdstringyesThe exact task whose content should be destroyed. Only call this for a task the user named; never sweep task history on your own initiative.
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_task_quote ~77

Compare an exact request price without creating a task or reserving funds. Returns a five-minute USD estimate and maximum charge. task_create already obtains its own quote and confirmation; do not call this tool as a routine prerequisite.

NameTypeReqDescription
callBackUrlstring––
inputobjectyes–
modelstringyes–
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_task_retry ~45

Create a new task from a failed or expired source. Requires a user confirmation round.

NameTypeReqDescription
idempotencyKeystring––
taskIdstringyes–
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_task_wait ~328

Wait for a task for up to 300 seconds and read ready output.assets[].url directly without a download-ticket call. By default, polling backs off from about 2 to at most 10 seconds; an explicit intervalSeconds stays fixed. Prefer signed webhooks for production; a complete verified v2 callback needs no extra task_get. A local wait timeout does not cancel the task. Some models answer in words instead of a file: speech-to-text and other text results arrive in output.text with no assets, and a transcription may add output.transcript with word timings, timed segments (output.transcript.segments, with speaker labels when available) and the detected language. Embedding models return vectors in output.embeddings (inputTokens and data[].index/embedding); large results are summarized here, see output.embeddings.summary. Layer decomposition returns one image asset per layer; stack them by ascending output.assets[].layer.zIndex. Other asset roles: image-to-3d and text-to-3d return one `mesh` asset (a binary glTF .glb, mime model/gltf-binary); vector endpoints return `image` assets with mime image/svg+xml; video translation can add a `subtitle` asset (.srt); video extension that joins the source clip returns the joined `video` first and the new part as `segment`.

NameTypeReqDescription
intervalSecondsinteger–Fixed polling interval in seconds. Omit to use adaptive SDK backoff from about 2 to at most 10 seconds.
taskIdstringyes–
timeoutSecondsinteger––
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_tasks_list ~148

Discover current-key task history with metadata only, without fetching each result. Dates are UTC [from,to), default seven days, at most 92 days. Keep from/to fixed across pages and pass nextCursor unchanged. Limit defaults to 20, maximum 100. Cost is an exact USD string and is final only when settled. Use task_get only for selected results; use usage_get for settled spending including hidden tasks. This is not a polling endpoint or a prerequisite to generation.

NameTypeReqDescription
cursorstring––
fromstring––
limitinteger––
modelstring––
statestring––
tostring––
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_upload_file ~185

Read a file from this computer, upload it, and return the spicy:// URI to put in a model input field. Use this whenever the user refers to a file on their machine. Images (JPEG, PNG, WebP, GIF) up to 10 MiB; MP4/WebM video and MP3/WAV audio up to 90 MiB; reference documents (PDF, Word, Excel, PowerPoint, Keynote, Pages, Numbers, TXT, Markdown) up to 90 MiB for fields such as reference_file_url. Public HTTPS media URLs need no upload at all — pass them straight to the model input when its schema accepts a URL.

NameTypeReqDescription
contentTypestring–Only when the file extension is missing or wrong; otherwise inferred.
pathstringyesAbsolute path to the file on this computer, as the user gave it.
NameTypeReqDescription
resultobjectyes–

No examples provided.

spicyapi_usage_get ~149

Read task counts and settled actual USD spend for the current API key, grouped by creation day and model. Only from/to dates are accepted: UTC [from,to), at most 92 days; defaults to seven days ending tomorrow UTC. Money is returned as exact decimal strings; pending holds are excluded and late settlement can change prior-day spend. This is not account balance or remaining key budget, and is not a generation prerequisite. Use for requested usage reports; respect Retry-After on rate limits.

NameTypeReqDescription
fromstring–Inclusive UTC date, YYYY-MM-DD. Defaults to seven days before to.
tostring–Exclusive UTC date, YYYY-MM-DD. Defaults to tomorrow UTC.
NameTypeReqDescription
resultobjectyes–

No examples provided.

Install

How do I install the SpicyAPI MCP server?

SpicyAPI MCP runs locally as an npm package, launched with npx -y @spicyapi/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @spicyapi/mcp

# add to Claude Code
claude mcp add spicyapi-ai-mcp -- npx -y @spicyapi/mcp
Common questions

What is the SpicyAPI MCP server?

SpicyAPI MCP is listed in the public MCP registry as io.github.spicyapi-ai/mcp. Image, video and audio generation APIs with USD quotes and confirmation before paid requests. This page covers its npm package (@spicyapi/mcp).

Is the SpicyAPI MCP server safe to use?

SpicyAPI MCP scores 79 out of 100 on VerifyMCP. We recorded 6 known advisories against it as of 4 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the SpicyAPI MCP server expose?

SpicyAPI MCP exposes 22 tools: spicyapi_service_status, spicyapi_docs_search, spicyapi_models_list, spicyapi_model_get, spicyapi_balance_get, and 17 more. Their descriptions and schemas cost roughly 3,691 tokens of context every time the server is loaded.

Is the SpicyAPI MCP server still maintained?

SpicyAPI MCP is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the SpicyAPI MCP server under?

SpicyAPI MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.