io.github.sudomock/mcp
NPM · @SUDOMOCK/MCP · SCANNED AUG 4
Product mockup API. Render PSD and 2D mockups, generate videos, manage async jobs and webhooks.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security83
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known medium-severity CVE affects @hono/node-server 1.19.17, reached via @modelcontextprotocol/sdk > @hono/node-server. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to sudomock/mcp-server). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 7 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability72
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3876 tokens (~149/item across 26 items; 26 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @sudomock/mcp
claude mcp add sudomock-mcp -- npx -y @sudomock/mcp
codex mcp add sudomock-mcp -- npx -y @sudomock/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"sudomock-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@sudomock/mcp"
],
"enabled": true
}
}
} openclaw mcp add sudomock-mcp --command npx --arg -y --arg @sudomock/mcp
mcp_servers:
sudomock-mcp:
command: "npx"
args: ["-y", "@sudomock/mcp"] {
"mcpServers": {
"sudomock-mcp": {
"command": "npx",
"args": [
"-y",
"@sudomock/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Aug 26 +4
- CVE-2026-69207 affects this package: medium ▼ security
- Stability: unverified → 0.27 ▲ functional
- 2 Aug 26 +21
- Known CVEs: unverified → fail ▼ security
- Provenance: pass → unverified ▼ security
- Install scripts: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- The attested source repository moved: sudomock/mcp-server security
- License: pass → unverified ▼ functional
- Maintenance: pass → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- Licence: MIT functional
- 1 Aug 26 −9
- Known CVEs: fail → unverified ▼ security
- Dependency health: partial → unverified ▼ functional
- 31 Jul 26 +36
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 26
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Aug 2026 · Analysed npm/@sudomock/[email protected]
Provenance verified
Ecosystem: npm · Outcome: verified
Reason: verified
- Source repo:
- sudomock/mcp-server
- Certificate issuer:
- https://token.actions.githubusercontent.com
- Certificate SAN:
- https://github.com/sudomock/mcp-server/.github/workflows/publish.yml@refs/tags/v2.4.0
- Rekor log index:
- 2256687564
- Predicate type:
- https://slsa.dev/provenance/v1
- Subject digest:
- sha512:35818c818aad84dc3c8ef12fbcdb30ecbdb820d9a21240b63201fed934f40efdb31c5548a45bf27d0cee13fff435cdccdb662c11d398460b3e64b439d
- Discovery method:
- attestation_endpoint
Vulnerabilities 2 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-frvp-7c67-39w9 | medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | yes | |
| GHSA-8j4g-w8fx-2239 | CVE-2026-69207 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | yes |
Dependencies 94 packages
94 packages in the resolved dependency tree · 94 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
create_2d_mockup ~197
Create a reusable 2D mockup from a public image URL. Returns the mockup ID and public render targets synchronously. Costs 25 credits. If the image is unsuitable, the 25 credits are refunded automatically. Set is_async=true to queue instead and receive a job_id to poll with get_job or wait_for_job. Use the dashboard for visual fine-tuning.
| Name | Type | Req | Description |
|---|---|---|---|
| idempotency_key | string | — | Optional retry-stable key for this create request |
| is_async | boolean | — | Queue creation instead of waiting. When true the API returns 202 with a job_id immediately -- poll with get_job, or call wait_for_job to block until it finishes and returns the mockup. Default false… |
| name | string | — | Optional display name for the 2D mockup |
| source_url | string | yes | Public HTTPS URL of the product image |
No output schema declared.
No examples provided.
create_webhook_endpoint ~166
Register a webhook endpoint that SudoMock calls when async jobs finish. The signing secret is returned IN FULL exactly once here -- store it to verify the HMAC carried in the X-SudoMock-Signature header (with X-SudoMock-Timestamp) on incoming deliveries. URL must be https and publicly routable.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | — | Optional human-readable label for this endpoint |
| event_types | array | — | Event types to subscribe to. Supports render, upload, video, 2D mockup, 2D render, and webhook.test events. Pass an empty array (the default) to subscribe to ALL events. |
| url | string | yes | https endpoint URL to receive POST deliveries (publicly routable; private/loopback hosts are rejected) |
No output schema declared.
No examples provided.
delete_2d_mockup ~70
Permanently delete a SudoAI 2D mockup template and all of its data. Cannot be undone. Costs 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| mockup_id | string | yes | UUID of the 2D mockup to delete (mockup_id from list_2d_mockups) |
No output schema declared.
No examples provided.
delete_mockup ~38
Permanently delete a mockup template. Cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| mockup_uuid | string | yes | The UUID of the mockup to delete |
No output schema declared.
No examples provided.
delete_webhook_endpoint ~52
Permanently delete a webhook endpoint. SudoMock stops delivering to it. Cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| endpoint_id | string | yes | The id of the webhook endpoint to delete (from list_webhook_endpoints) |
No output schema declared.
No examples provided.
get_2d_mockup ~99
Get one SudoAI 2D mockup's full details, including saved print_areas[] and full-coverage surfaces[]. Use a print_area_id as print_area_uuid, or a surfaces[].surface_uuid as surface_uuid, for render_2d_mockup. Costs 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| mockup_id | string | yes | UUID of the 2D mockup (mockup_id from list_2d_mockups) |
No output schema declared.
No examples provided.
get_account ~30
Get your account info: subscription plan, credit balance, usage stats, billing period, and API key details.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_job ~83
Get the current status of any async render, video, upload, or 2D job by its job_id. Returns status (queued|running|succeeded|failed), completed-result details and credits charged, or an error if failed. To block until done, use wait_for_job instead.
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | The job_id returned by any async submission |
No output schema declared.
No examples provided.
get_mockup_details ~54
Get full details of a mockup: smart object UUIDs, layer names, dimensions, positions, blend modes, and thumbnail URLs.
| Name | Type | Req | Description |
|---|---|---|---|
| mockup_uuid | string | yes | The UUID of the mockup to inspect |
No output schema declared.
No examples provided.
list_2d_mockups ~130
List your saved SudoAI 2D mockup templates (no PSD). Returns each mockup's mockup_id, name, status, thumbnail, dimensions, and print_areas. Use the mockup_id with get_2d_mockup (to read print_area UUIDs) or render_2d_mockup. Costs 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| customizable_only | boolean | — | Return only mockups ready for shopper customization |
| limit | number | — | Results per page (1-100, default 20) |
| offset | number | — | Pagination offset (default 0) |
No output schema declared.
No examples provided.
list_jobs ~144
List your async jobs, including PSD renders, videos, uploads, and 2D creation/renders, newest first. Use this when you do not already hold a job_id. Pass the returned next_cursor to fetch the next page.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | — | Opaque keyset cursor from a prior page's next_cursor |
| kind | string | — | Filter by job kind. Omit for all kinds. |
| limit | integer | — | Max jobs per page (1-50, default 20) |
| mockup_uuid | string | — | Filter by source mockup UUID (e.g. one mockup's videos). Raw-image videos are never returned by this filter. |
No output schema declared.
No examples provided.
list_mockups ~143
List your uploaded mockup templates with UUIDs, names, and thumbnails. Use returned UUIDs with render_mockup or get_mockup_details.
| Name | Type | Req | Description |
|---|---|---|---|
| created_after | string | — | Only mockups created after this ISO 8601 timestamp |
| created_before | string | — | Only mockups created before this ISO 8601 timestamp |
| limit | number | — | Results per page (1-100, default 20) |
| name | string | — | Filter by name (case-insensitive substring match) |
| offset | number | — | Pagination offset (default 0) |
| sort_by | string | — | Sort field |
| sort_order | string | — | Sort direction |
No output schema declared.
No examples provided.
list_webhook_deliveries ~114
List delivery attempts for a webhook endpoint (status, event_type, response code, timestamps). Use this to debug failed deliveries before replaying them.
| Name | Type | Req | Description |
|---|---|---|---|
| endpoint_id | string | yes | The id of the webhook endpoint (from list_webhook_endpoints) |
| event_type | string | — | Filter by event type |
| limit | integer | — | Max deliveries to return (1-200, default 50) |
| status | string | — | Filter by delivery status (e.g. 'failed', 'succeeded') |
No output schema declared.
No examples provided.
list_webhook_endpoints ~40
List your registered webhook endpoints (id, url, subscribed event_types, enabled state). Secrets are NOT returned here -- only at creation and rotation.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
remove_background ~86
Remove the background from any image and return a transparent-PNG cutout with clean, production-ready edges. The returned URL is valid for 7 days and can be used as artwork_url during that window. Costs 25 credits per image; credits are refunded automatically if processing fails.
| Name | Type | Req | Description |
|---|---|---|---|
| image_url | string | yes | Public URL of the image (PNG/JPG/WebP) to process |
No output schema declared.
No examples provided.
render_2d_mockup ~510
Render artwork onto a saved 2D mockup template. Returns print_files (each with an export_path) and a render_uuid. Costs 5 credits. Use get_2d_mockup, then pass exactly one print_area_uuid or surface_uuid. Use the dashboard for visual fine-tuning.
| Name | Type | Req | Description |
|---|---|---|---|
| artwork_url | string | yes | Public URL of the artwork image (PNG/JPG/WebP) to place on the mockup |
| brightness | number | — | Brightness adjustment (-150 to 150) |
| contrast | number | — | Contrast adjustment (-100 to 100) |
| coverage | number | — | Percentage of the print area to cover (10-100, default 70) |
| fit | string | — | How artwork fits the print area - 'contain' (fit inside, default), 'fill' (stretch), 'cover' (fill and crop) |
| image_format | string | — | Output format - 'webp' (smaller, recommended), 'png' (lossless), 'jpg' |
| image_size | number | — | Output width in pixels (100-10000, default 2048) |
| is_async | boolean | — | Queue the render instead of waiting. When true the API returns 202 with a job_id immediately -- poll with get_job, or call wait_for_job to block until it finishes and hands back result_url. Default f… |
| mockup_uuid | string | yes | UUID of the 2D mockup template (from list_2d_mockups, returned as mockup_id). |
| opacity | number | — | Artwork opacity percentage (0-100) |
| position | string | — | Placement within the print area (default 'center') |
| print_area_uuid | string | — | UUID of a saved print area from get_2d_mockup. Omit when surface_uuid is used. |
| quality | number | — | Compression quality for webp/jpg (1-100, default 90) |
| remove_background | boolean | — | Remove the artwork's background before placing it. Adds 25 credits per artwork. |
| rotation | number | — | Rotate artwork in degrees (-360 to 360) |
| saturation | number | — | Saturation adjustment (-100 to 100) |
| surface_uuid | string | — | UUID of a full-coverage product surface from get_2d_mockup. Omit when print_area_uuid is used. |
No output schema declared.
No examples provided.
render_mockup ~550
Render a PSD mockup with artwork, editable text, or both. Supports one or multiple smart objects and preserves the template's authored appearance. Returns the rendered image URL. Costs 1 credit. Use list_mockups and get_mockup_details to find target UUIDs.
| Name | Type | Req | Description |
|---|---|---|---|
| artwork_url | string | — | Public artwork URL for smart_object_uuid. Provide both singular fields, or use smart_objects. |
| blur | number | — | Gaussian blur strength (0 to 100) |
| brightness | number | — | Brightness adjustment |
| color_blend_mode | string | — | Blend mode for color overlay (e.g. 'multiply', 'screen', 'overlay') |
| color_hex | string | — | Optional color overlay hex code (e.g. '#FF5733') |
| contrast | number | — | Contrast adjustment |
| dpi | integer | — | Print resolution metadata (72-2400). Does not change pixel size -- use image_size. jpg/png recommended for widest print-tool compatibility. |
| export_label | string | — | Optional label for file naming |
| fit | string | — | How singular artwork_url fills its smart object area |
| flip_horizontal | boolean | — | Mirror artwork left-right |
| flip_vertical | boolean | — | Mirror artwork top-bottom |
| image_format | string | — | Output format |
| image_size | number | — | Output width in pixels (default 2048) |
| is_async | boolean | — | Queue the render instead of waiting for it. When true the API returns 202 with a job_id immediately (no result_url yet) -- poll with get_job, or call wait_for_job to block until it finishes. Use for… |
| mockup_uuid | string | yes | UUID of the mockup template (from list_mockups) |
| opacity | number | — | Layer opacity percentage |
| quality | number | — | Compression quality for webp/jpg (default 90) |
| remove_background | boolean | — | Remove the artwork's background before placing it. Adds 25 credits per artwork. |
| rotate | number | — | Rotate artwork in degrees |
| saturation | number | — | Saturation adjustment |
| smart_object_uuid | string | — | UUID of one smart object layer. Provide with artwork_url, or use smart_objects for one or more entries. |
| smart_objects | array | — | One or more smart object overrides, each with asset or color. Do not combine with smart_object_uuid/artwork_url. |
| text_layers | array | — | Editable text overrides from get_mockup_details. Each entry needs exactly one of text or segments. May be used alone or with smart objects. |
| vibrance | number | — | Vibrance adjustment (-100 to 100) |
No output schema declared.
No examples provided.
render_video ~576
Create a short AI video from either a mockup with artwork or a public image URL. Supply exactly one input mode. Always async: returns a job_id immediately for get_job or wait_for_job. Credit cost depends on clip length, audio, and the automatically selected quality. Unsupported durations are rejected.
| Name | Type | Req | Description |
|---|---|---|---|
| artwork_base64 | string | — | RENDER MODE: raw base64-encoded artwork bytes (no data: prefix). Provide this OR artwork_url. |
| artwork_content_type | string | — | MIME type for artwork_base64 (defaults to image/png if omitted). |
| artwork_url | string | — | RENDER MODE: public URL of the artwork image (PNG/JPG/WebP) to place on the mockup before animating. Provide this OR artwork_base64. Omit in raw-image mode. |
| asset_height | integer | — | RENDER MODE: custom artwork height in pixels (overrides fit sizing). |
| asset_left | integer | — | RENDER MODE: artwork left offset in pixels within the smart object area. |
| asset_top | integer | — | RENDER MODE: artwork top offset in pixels within the smart object area. |
| asset_width | integer | — | RENDER MODE: custom artwork width in pixels (overrides fit sizing). |
| audio | boolean | — | Generate audio. Default off; enabling it may cost more credits. |
| duration_seconds | integer | — | Clip length in seconds. Unsupported values are rejected. Longer clips cost more credits. |
| fit | string | — | RENDER MODE: how artwork fills the smart object area in the still frame |
| image_format | string | — | Output format of the still input frame |
| image_size | number | — | Width in pixels of the still input frame (default 2048) |
| image_url | string | — | RAW-IMAGE MODE: a public https png/jpg URL to animate without a mockup. Supply this OR (mockup_uuid + smart_object_uuid + artwork), never both. |
| mockup_uuid | string | — | RENDER MODE: UUID of the mockup to animate (from list_mockups or upload_psd). Required in render mode. In raw-image mode it is an optional association (groups the clip under that mockup's 'Past clips… |
| motion | string | — | 'ambient' = subtle looping hero motion that keeps the print readable; 'showcase' = one deliberate camera/product move. |
| quality | number | — | Compression quality for the still input frame (webp/jpg, default 90) |
| smart_object_uuid | string | — | RENDER MODE: UUID of the smart object layer to place artwork on (from get_mockup_details). Required in render mode; omit in raw-image mode. |
| webhook_url | string | — | Optional completion webhook URL. Best-effort push; polling get_job remains the source of truth. |
No output schema declared.
No examples provided.
replay_webhook_delivery ~84
Replay a single webhook delivery while preserving its event identity, e.g. after fixing your endpoint. Get delivery_id from list_webhook_deliveries.
| Name | Type | Req | Description |
|---|---|---|---|
| delivery_id | string | yes | The id of the delivery to replay (from list_webhook_deliveries) |
| endpoint_id | string | yes | The id of the webhook endpoint (from list_webhook_endpoints) |
No output schema declared.
No examples provided.
rotate_webhook_secret ~65
Rotate the signing secret for a webhook endpoint. A new secret is returned IN FULL exactly once -- update your verifier with it. The old secret stops being valid.
| Name | Type | Req | Description |
|---|---|---|---|
| endpoint_id | string | yes | The id of the webhook endpoint to rotate (from list_webhook_endpoints) |
No output schema declared.
No examples provided.
test_webhook_endpoint ~65
Send a signed webhook.test event to verify endpoint reachability and signature handling. Returns a test job_id; check the result with list_webhook_deliveries.
| Name | Type | Req | Description |
|---|---|---|---|
| endpoint_id | string | yes | The id of the webhook endpoint to test (from list_webhook_endpoints) |
No output schema declared.
No examples provided.
update_2d_print_areas ~100
Replace a 2D mockup's print areas with up to 8 four-point quads and return the updated geometry. An empty list is accepted only for verified full product surfaces. Costs 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| mockup_id | string | yes | UUID of the 2D mockup to update |
| print_areas | array | yes | Replacement print areas (0-8 four-point quads, each with an optional name) |
No output schema declared.
No examples provided.
update_mockup ~46
Rename a mockup template.
| Name | Type | Req | Description |
|---|---|---|---|
| mockup_uuid | string | yes | The UUID of the mockup to rename |
| name | string | yes | New display name for the mockup |
No output schema declared.
No examples provided.
update_webhook_endpoint ~165
Update a webhook endpoint in place: change its url, description, subscribed event_types, or enable/disable it (enabled:false pauses deliveries without losing the signing secret). All fields optional -- only the ones you pass are changed. The secret is NOT rotated or returned here.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | — | New human-readable label |
| enabled | boolean | — | Set false to pause deliveries (secret preserved), true to resume |
| endpoint_id | string | yes | The id of the webhook endpoint to update (from list_webhook_endpoints) |
| event_types | array | — | Replacement list of subscribed event types. Pass an empty array to subscribe to ALL events. |
| url | string | — | New https endpoint URL (publicly routable; private/loopback hosts are rejected) |
No output schema declared.
No examples provided.
upload_psd ~156
Upload a Photoshop PSD/PSB file as a new mockup template. The PSD must have at least one Smart Object layer. Processing takes 5-30 seconds.
| Name | Type | Req | Description |
|---|---|---|---|
| is_async | boolean | — | Queue the upload instead of blocking. When true the API returns 202 with a job_id immediately -- poll with get_job (or wait_for_job) to learn when processing finishes and get the new mockup_uuid. Alw… |
| psd_file_url | string | yes | Public URL to a .psd or .psb file (up to Adobe's official PSD file size limit) |
| psd_name | string | — | Display name for the template (auto-generated from filename if omitted) |
No output schema declared.
No examples provided.
wait_for_job ~113
Poll any async render, video, upload, or 2D job until it succeeds or fails, then return the final result and credits charged. Blocks while polling.
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | The job_id to wait on (from an async submission or render_video) |
| poll_interval_seconds | number | — | Seconds between status checks (1-30, default 3) |
| timeout_seconds | number | — | Give up after this many seconds if the job has not finished (5-900, default 300) |
No output schema declared.
No examples provided.