# io.github.sudomock/mcp (npm · @sudomock/mcp)

Product mockup API. Render PSD and 2D mockups, generate videos, manage async jobs and webhooks.

- Trust score: 78/100 (medium)
- Change this week: +52
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@sudomock/mcp`: 78/100 (this document), [markdown](https://verifymcp.io/servers/sudomock-mcp/sudomock-mcp.md), [page](https://verifymcp.io/servers/sudomock-mcp/sudomock-mcp)

## Channel facts

- Registry: `npm`
- Package: `@sudomock/mcp`
- Version: `2.4.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects @hono/node-server 1.19.17, reached via @modelcontextprotocol/sdk > @hono/node-server. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to sudomock/mcp-server).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 7 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 72/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3876 tokens (~149/item across 26 items; 26 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add sudomock-mcp -- npx -y @sudomock/mcp
```

### Codex

```bash
codex mcp add sudomock-mcp -- npx -y @sudomock/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sudomock-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@sudomock/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add sudomock-mcp --command npx --arg -y --arg @sudomock/mcp
```

### Hermes

```yaml
mcp_servers:
  sudomock-mcp:
    command: "npx"
    args: ["-y", "@sudomock/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "sudomock-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@sudomock/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 78, +4)

- [security regression] CVE-2026-69207 affects this package: medium
- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 74, +21)

- [security regression] Known CVEs: unverified → fail
- [security regression] Provenance: pass → unverified
- [security regression] Install scripts: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [security] The attested source repository moved: sudomock/mcp-server
- [functional regression] License: pass → unverified
- [functional regression] Maintenance: pass → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-08-01 (score 53, −9)

- [security regression] Known CVEs: fail → unverified
- [functional regression] Dependency health: partial → unverified

### 2026-07-31 (score 62, +36)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 26)

First indexed and scored.

## MCP tools (26)

### `list_mockups` (~143 tokens)

List your uploaded mockup templates with UUIDs, names, and thumbnails. Use returned UUIDs with render_mockup or get_mockup_details.

Input parameters:

- `created_after` (string): Only mockups created after this ISO 8601 timestamp
- `created_before` (string): Only mockups created before this ISO 8601 timestamp
- `limit` (number): Results per page (1-100, default 20)
- `name` (string): Filter by name (case-insensitive substring match)
- `offset` (number): Pagination offset (default 0)
- `sort_by` (string): Sort field
- `sort_order` (string): Sort direction

### `get_mockup_details` (~54 tokens)

Get full details of a mockup: smart object UUIDs, layer names, dimensions, positions, blend modes, and thumbnail URLs.

Input parameters:

- `mockup_uuid` (string, required): The UUID of the mockup to inspect

### `update_mockup` (~46 tokens)

Rename a mockup template.

Input parameters:

- `mockup_uuid` (string, required): The UUID of the mockup to rename
- `name` (string, required): New display name for the mockup

### `delete_mockup` (~38 tokens)

Permanently delete a mockup template. Cannot be undone.

Input parameters:

- `mockup_uuid` (string, required): The UUID of the mockup to delete

### `render_mockup` (~550 tokens)

Render a PSD mockup with artwork, editable text, or both. Supports one or multiple smart objects and preserves the template's authored appearance. Returns the rendered image URL. Costs 1 credit. Use list_mockups and get_mockup_details to find target UUIDs.

Input parameters:

- `artwork_url` (string): Public artwork URL for smart_object_uuid. Provide both singular fields, or use smart_objects.
- `blur` (number): Gaussian blur strength (0 to 100)
- `brightness` (number): Brightness adjustment
- `color_blend_mode` (string): Blend mode for color overlay (e.g. 'multiply', 'screen', 'overlay')
- `color_hex` (string): Optional color overlay hex code (e.g. '#FF5733')
- `contrast` (number): Contrast adjustment
- `dpi` (integer): Print resolution metadata (72-2400). Does not change pixel size -- use image_size. jpg/png recommended for widest print-tool compatibility.
- `export_label` (string): Optional label for file naming
- `fit` (string): How singular artwork_url fills its smart object area
- `flip_horizontal` (boolean): Mirror artwork left-right
- `flip_vertical` (boolean): Mirror artwork top-bottom
- `image_format` (string): Output format
- `image_size` (number): Output width in pixels (default 2048)
- `is_async` (boolean): Queue the render instead of waiting for it. When true the API returns 202 with a job_id immediately (no result_url yet) -- poll with get_job, or call wait_for_job to block until it finishes. Use for…
- `mockup_uuid` (string, required): UUID of the mockup template (from list_mockups)
- `opacity` (number): Layer opacity percentage
- `quality` (number): Compression quality for webp/jpg (default 90)
- `remove_background` (boolean): Remove the artwork's background before placing it. Adds 25 credits per artwork.
- `rotate` (number): Rotate artwork in degrees
- `saturation` (number): Saturation adjustment
- `smart_object_uuid` (string): UUID of one smart object layer. Provide with artwork_url, or use smart_objects for one or more entries.
- `smart_objects` (array): One or more smart object overrides, each with asset or color. Do not combine with smart_object_uuid/artwork_url.
- `text_layers` (array): Editable text overrides from get_mockup_details. Each entry needs exactly one of text or segments. May be used alone or with smart objects.
- `vibrance` (number): Vibrance adjustment (-100 to 100)

### `remove_background` (~86 tokens)

Remove the background from any image and return a transparent-PNG cutout with clean, production-ready edges. The returned URL is valid for 7 days and can be used as artwork_url during that window. Costs 25 credits per image; credits are refunded automatically if processing fails.

Input parameters:

- `image_url` (string, required): Public URL of the image (PNG/JPG/WebP) to process

### `create_2d_mockup` (~197 tokens)

Create a reusable 2D mockup from a public image URL. Returns the mockup ID and public render targets synchronously. Costs 25 credits. If the image is unsuitable, the 25 credits are refunded automatically. Set is_async=true to queue instead and receive a job_id to poll with get_job or wait_for_job. Use the dashboard for visual fine-tuning.

Input parameters:

- `idempotency_key` (string): Optional retry-stable key for this create request
- `is_async` (boolean): Queue creation instead of waiting. When true the API returns 202 with a job_id immediately -- poll with get_job, or call wait_for_job to block until it finishes and returns the mockup. Default false…
- `name` (string): Optional display name for the 2D mockup
- `source_url` (string, required): Public HTTPS URL of the product image

### `render_2d_mockup` (~510 tokens)

Render artwork onto a saved 2D mockup template. Returns print_files (each with an export_path) and a render_uuid. Costs 5 credits. Use get_2d_mockup, then pass exactly one print_area_uuid or surface_uuid. Use the dashboard for visual fine-tuning.

Input parameters:

- `artwork_url` (string, required): Public URL of the artwork image (PNG/JPG/WebP) to place on the mockup
- `brightness` (number): Brightness adjustment (-150 to 150)
- `contrast` (number): Contrast adjustment (-100 to 100)
- `coverage` (number): Percentage of the print area to cover (10-100, default 70)
- `fit` (string): How artwork fits the print area - 'contain' (fit inside, default), 'fill' (stretch), 'cover' (fill and crop)
- `image_format` (string): Output format - 'webp' (smaller, recommended), 'png' (lossless), 'jpg'
- `image_size` (number): Output width in pixels (100-10000, default 2048)
- `is_async` (boolean): Queue the render instead of waiting. When true the API returns 202 with a job_id immediately -- poll with get_job, or call wait_for_job to block until it finishes and hands back result_url. Default f…
- `mockup_uuid` (string, required): UUID of the 2D mockup template (from list_2d_mockups, returned as mockup_id).
- `opacity` (number): Artwork opacity percentage (0-100)
- `position` (string): Placement within the print area (default 'center')
- `print_area_uuid` (string): UUID of a saved print area from get_2d_mockup. Omit when surface_uuid is used.
- `quality` (number): Compression quality for webp/jpg (1-100, default 90)
- `remove_background` (boolean): Remove the artwork's background before placing it. Adds 25 credits per artwork.
- `rotation` (number): Rotate artwork in degrees (-360 to 360)
- `saturation` (number): Saturation adjustment (-100 to 100)
- `surface_uuid` (string): UUID of a full-coverage product surface from get_2d_mockup. Omit when print_area_uuid is used.

### `list_2d_mockups` (~130 tokens)

List your saved SudoAI 2D mockup templates (no PSD). Returns each mockup's mockup_id, name, status, thumbnail, dimensions, and print_areas. Use the mockup_id with get_2d_mockup (to read print_area UUIDs) or render_2d_mockup. Costs 0 credits.

Input parameters:

- `customizable_only` (boolean): Return only mockups ready for shopper customization
- `limit` (number): Results per page (1-100, default 20)
- `offset` (number): Pagination offset (default 0)

### `get_2d_mockup` (~99 tokens)

Get one SudoAI 2D mockup's full details, including saved print_areas[] and full-coverage surfaces[]. Use a print_area_id as print_area_uuid, or a surfaces[].surface_uuid as surface_uuid, for render_2d_mockup. Costs 0 credits.

Input parameters:

- `mockup_id` (string, required): UUID of the 2D mockup (mockup_id from list_2d_mockups)

### `update_2d_print_areas` (~100 tokens)

Replace a 2D mockup's print areas with up to 8 four-point quads and return the updated geometry. An empty list is accepted only for verified full product surfaces. Costs 0 credits.

Input parameters:

- `mockup_id` (string, required): UUID of the 2D mockup to update
- `print_areas` (array, required): Replacement print areas (0-8 four-point quads, each with an optional name)

### `delete_2d_mockup` (~70 tokens)

Permanently delete a SudoAI 2D mockup template and all of its data. Cannot be undone. Costs 0 credits.

Input parameters:

- `mockup_id` (string, required): UUID of the 2D mockup to delete (mockup_id from list_2d_mockups)

### `upload_psd` (~156 tokens)

Upload a Photoshop PSD/PSB file as a new mockup template. The PSD must have at least one Smart Object layer. Processing takes 5-30 seconds.

Input parameters:

- `is_async` (boolean): Queue the upload instead of blocking. When true the API returns 202 with a job_id immediately -- poll with get_job (or wait_for_job) to learn when processing finishes and get the new mockup_uuid. Alw…
- `psd_file_url` (string, required): Public URL to a .psd or .psb file (up to Adobe's official PSD file size limit)
- `psd_name` (string): Display name for the template (auto-generated from filename if omitted)

### `get_job` (~83 tokens)

Get the current status of any async render, video, upload, or 2D job by its job_id. Returns status (queued|running|succeeded|failed), completed-result details and credits charged, or an error if failed. To block until done, use wait_for_job instead.

Input parameters:

- `job_id` (string, required): The job_id returned by any async submission

### `list_jobs` (~144 tokens)

List your async jobs, including PSD renders, videos, uploads, and 2D creation/renders, newest first. Use this when you do not already hold a job_id. Pass the returned next_cursor to fetch the next page.

Input parameters:

- `cursor` (string): Opaque keyset cursor from a prior page's next_cursor
- `kind` (string): Filter by job kind. Omit for all kinds.
- `limit` (integer): Max jobs per page (1-50, default 20)
- `mockup_uuid` (string): Filter by source mockup UUID (e.g. one mockup's videos). Raw-image videos are never returned by this filter.

### `wait_for_job` (~113 tokens)

Poll any async render, video, upload, or 2D job until it succeeds or fails, then return the final result and credits charged. Blocks while polling.

Input parameters:

- `job_id` (string, required): The job_id to wait on (from an async submission or render_video)
- `poll_interval_seconds` (number): Seconds between status checks (1-30, default 3)
- `timeout_seconds` (number): Give up after this many seconds if the job has not finished (5-900, default 300)

### `render_video` (~576 tokens)

Create a short AI video from either a mockup with artwork or a public image URL. Supply exactly one input mode. Always async: returns a job_id immediately for get_job or wait_for_job. Credit cost depends on clip length, audio, and the automatically selected quality. Unsupported durations are rejected.

Input parameters:

- `artwork_base64` (string): RENDER MODE: raw base64-encoded artwork bytes (no data: prefix). Provide this OR artwork_url.
- `artwork_content_type` (string): MIME type for artwork_base64 (defaults to image/png if omitted).
- `artwork_url` (string): RENDER MODE: public URL of the artwork image (PNG/JPG/WebP) to place on the mockup before animating. Provide this OR artwork_base64. Omit in raw-image mode.
- `asset_height` (integer): RENDER MODE: custom artwork height in pixels (overrides fit sizing).
- `asset_left` (integer): RENDER MODE: artwork left offset in pixels within the smart object area.
- `asset_top` (integer): RENDER MODE: artwork top offset in pixels within the smart object area.
- `asset_width` (integer): RENDER MODE: custom artwork width in pixels (overrides fit sizing).
- `audio` (boolean): Generate audio. Default off; enabling it may cost more credits.
- `duration_seconds` (integer): Clip length in seconds. Unsupported values are rejected. Longer clips cost more credits.
- `fit` (string): RENDER MODE: how artwork fills the smart object area in the still frame
- `image_format` (string): Output format of the still input frame
- `image_size` (number): Width in pixels of the still input frame (default 2048)
- `image_url` (string): RAW-IMAGE MODE: a public https png/jpg URL to animate without a mockup. Supply this OR (mockup_uuid + smart_object_uuid + artwork), never both.
- `mockup_uuid` (string): RENDER MODE: UUID of the mockup to animate (from list_mockups or upload_psd). Required in render mode. In raw-image mode it is an optional association (groups the clip under that mockup's 'Past clips…
- `motion` (string): 'ambient' = subtle looping hero motion that keeps the print readable; 'showcase' = one deliberate camera/product move.
- `quality` (number): Compression quality for the still input frame (webp/jpg, default 90)
- `smart_object_uuid` (string): RENDER MODE: UUID of the smart object layer to place artwork on (from get_mockup_details). Required in render mode; omit in raw-image mode.
- `webhook_url` (string): Optional completion webhook URL. Best-effort push; polling get_job remains the source of truth.

### `get_account` (~30 tokens)

Get your account info: subscription plan, credit balance, usage stats, billing period, and API key details.

### `create_webhook_endpoint` (~166 tokens)

Register a webhook endpoint that SudoMock calls when async jobs finish. The signing secret is returned IN FULL exactly once here -- store it to verify the HMAC carried in the X-SudoMock-Signature header (with X-SudoMock-Timestamp) on incoming deliveries. URL must be https and publicly routable.

Input parameters:

- `description` (string): Optional human-readable label for this endpoint
- `event_types` (array): Event types to subscribe to. Supports render, upload, video, 2D mockup, 2D render, and webhook.test events. Pass an empty array (the default) to subscribe to ALL events.
- `url` (string, required): https endpoint URL to receive POST deliveries (publicly routable; private/loopback hosts are rejected)

### `list_webhook_endpoints` (~40 tokens)

List your registered webhook endpoints (id, url, subscribed event_types, enabled state). Secrets are NOT returned here -- only at creation and rotation.

### `update_webhook_endpoint` (~165 tokens)

Update a webhook endpoint in place: change its url, description, subscribed event_types, or enable/disable it (enabled:false pauses deliveries without losing the signing secret). All fields optional -- only the ones you pass are changed. The secret is NOT rotated or returned here.

Input parameters:

- `description` (string): New human-readable label
- `enabled` (boolean): Set false to pause deliveries (secret preserved), true to resume
- `endpoint_id` (string, required): The id of the webhook endpoint to update (from list_webhook_endpoints)
- `event_types` (array): Replacement list of subscribed event types. Pass an empty array to subscribe to ALL events.
- `url` (string): New https endpoint URL (publicly routable; private/loopback hosts are rejected)

### `delete_webhook_endpoint` (~52 tokens)

Permanently delete a webhook endpoint. SudoMock stops delivering to it. Cannot be undone.

Input parameters:

- `endpoint_id` (string, required): The id of the webhook endpoint to delete (from list_webhook_endpoints)

### `rotate_webhook_secret` (~65 tokens)

Rotate the signing secret for a webhook endpoint. A new secret is returned IN FULL exactly once -- update your verifier with it. The old secret stops being valid.

Input parameters:

- `endpoint_id` (string, required): The id of the webhook endpoint to rotate (from list_webhook_endpoints)

### `test_webhook_endpoint` (~65 tokens)

Send a signed webhook.test event to verify endpoint reachability and signature handling. Returns a test job_id; check the result with list_webhook_deliveries.

Input parameters:

- `endpoint_id` (string, required): The id of the webhook endpoint to test (from list_webhook_endpoints)

### `list_webhook_deliveries` (~114 tokens)

List delivery attempts for a webhook endpoint (status, event_type, response code, timestamps). Use this to debug failed deliveries before replaying them.

Input parameters:

- `endpoint_id` (string, required): The id of the webhook endpoint (from list_webhook_endpoints)
- `event_type` (string): Filter by event type
- `limit` (integer): Max deliveries to return (1-200, default 50)
- `status` (string): Filter by delivery status (e.g. 'failed', 'succeeded')

### `replay_webhook_delivery` (~84 tokens)

Replay a single webhook delivery while preserving its event identity, e.g. after fixing your endpoint. Get delivery_id from list_webhook_deliveries.

Input parameters:

- `delivery_id` (string, required): The id of the delivery to replay (from list_webhook_deliveries)
- `endpoint_id` (string, required): The id of the webhook endpoint (from list_webhook_endpoints)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/sudomock-mcp/sudomock-mcp#diagnostics

## Score history

- 2026-08-04: 78
- 2026-08-03: 74
- 2026-08-02: 74
- 2026-08-01: 53
- 2026-07-31: 62
- 2026-07-30: 26
- 2026-07-28: 26
- 2026-07-27: 26

## Links

- npm package: https://www.npmjs.com/package/@sudomock/mcp
- Socket report: https://socket.dev/npm/package/@sudomock/mcp
- Repository: https://github.com/sudomock/mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/sudomock-mcp/sudomock-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/sudomock-mcp/sudomock-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/sudomock-mcp/sudomock-mcp