SpriteForge Editor
REMOTE · WWW.SPRITEFORGE.TECH
Free pixel and tileset editor, no account: hand-edit sprites, animations and Wang tilesets in chat
Available components
Last scanned (18 hours ago)
Scores higher than 79% of remote servers
Reachable. Last reached 4 Nov 2026.
Category Design and Media
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability74
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1908 tokens (~212/item across 9 items; 6 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management43
- Stability observed for 13 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 93% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
- Tool “open_tileset_editor” rewrote its description, which is the text the model reads security
- “open_tileset_editor” reworded the description of “base” cosmetic
- “open_tileset_editor” reworded the description of “layout” cosmetic
- “open_tileset_editor” reworded the description of “png_base64” cosmetic
- “open_tileset_editor” reworded the description of “tiles” cosmetic
- 27 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 23 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
- 22 Oct 26 73
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://www.spriteforge.tech/mcp/editor
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=www.spriteforge.tech | CN=YR2,O=Let's Encrypt,C=US | 10 Sept 2026 | 9 Dec 2026 | RSA 2048 | SHA256-RSA | 64a080d9cd74b90c67b9145076cb1449e44 |
| SANs: www.spriteforge.tech | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of www.spriteforge.tech. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| tech. | present | 2185 | 13 | Verified |
| spriteforge.tech. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| content-security-policy | default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https://cdn.jsdelivr.net https://*.clerk.accounts.dev https://*.spriteforge.tech https://challenges.cloudflare.com https://plausible.io; worker-src 'self' blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' https://*.clerk.accounts.dev https://*.spriteforge.tech https://plausible.io https://clerk-telemetry.com; frame-src 'self' https://*.clerk.accounts.dev https://*.spriteforge.tech https://challenges.cloudflare.com https://www.youtube-nocookie.com https://itch.io; child-src 'self' blob: https://*.clerk.accounts.dev https://*.spriteforge.tech |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=(), browsing-topics=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://www.spriteforge.tech/mcp/editor | Verified | 200 | |
| http (plaintext) | http://www.spriteforge.tech/mcp/editor | HTTPS enforced | 308 | https://www.spriteforge.tech/mcp/editor |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_sprite Get a sprite from a SpriteForge edit session ~115
Returns the current state of a SpriteForge edit session: a preview image, its size and palette, how many edits were saved, and a PNG URL with the exact pixels at 1x (add &frame=N for another frame). With include_pixels it also returns the palette-index grid. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| include_pixels | boolean | – | Also return the palette and index grid (default false). |
| session_id | string | yes | An edit session's id (the s= value of an edit link), or the edit link itself. |
No output schema declared.
No examples provided.
load_art Load an edit session into the editor card ~35
Loads an edit session's sprite into the SpriteForge editor card. Only the card calls it.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | – |
No output schema declared.
No examples provided.
open_editor Open a sprite in the SpriteForge editor ~270
Opens pixel art in SpriteForge's compact pixel editor - pencil, eraser, fill, colour picker, palette, undo and animation frames - as an interactive card where the app shows them, and returns an edit link (the same editor in a browser) and a session_id. No account needed. One source at most: png_base64 (an existing PNG), art (palette + index grid), or neither for a blank width x height canvas. Max 128x128 pixels and 256 colours. The user's edits save to the edit session automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| art | object | – | Pixel art in SpriteForge's format: palette = hex colours, grid = rows of palette indexes (-1 = transparent). Optional frames for an animation, each { grid } on the same palette. |
| height | integer | – | Blank canvas height in pixels (default 32). |
| name | string | – | Sprite name, used as the download filename (letters, digits, _ and -). |
| palette | array | – | Starting palette for a blank canvas, as hex colours. |
| png_base64 | string | – | A PNG file, base64-encoded (a data: URL prefix is fine). Pixels under 50% alpha become transparent. |
| width | integer | – | Blank canvas width in pixels (default 32). |
No output schema declared.
No examples provided.
open_full_editor Open the full SpriteForge editor ~313
Opens a sprite in SpriteForge's full pixel editor - layers, selection and move, line/rectangle/ellipse, mirror painting, brush sizes, animation frames with onion skin and playback, palette tools - as an interactive card where the app shows them, and returns an edit link that opens the same editor in a browser. One source at most: session_id (an edit session that's already open, or an edit link), png_base64 (an existing PNG), art (palette + index grid), or none for a blank width x height canvas. Max 128x128 pixels and 256 colours. The user's edits save to the edit session.
| Name | Type | Req | Description |
|---|---|---|---|
| art | object | – | Pixel art in SpriteForge's format: palette = hex colours, grid = rows of palette indexes (-1 = transparent). Optional frames for an animation, each { grid } on the same palette. |
| height | integer | – | Blank canvas height in pixels (default 32). |
| name | string | – | Sprite name, used as the download filename (letters, digits, _ and -). |
| palette | array | – | Starting palette for a blank canvas, as hex colours. |
| png_base64 | string | – | A PNG file, base64-encoded (a data: URL prefix is fine). Pixels under 50% alpha become transparent. |
| session_id | string | – | An edit session that's already open, or an edit link containing ?s=<id>. |
| width | integer | – | Blank canvas width in pixels (default 32). |
No output schema declared.
No examples provided.
open_tileset_editor Open the SpriteForge tileset editor ~775
Opens a tileset in SpriteForge's tileset editor as an interactive card where the app shows them, and returns an edit link that opens the same editor in a browser. For a Wang autotile set (16 tiles; tile i is drawn where the map cells at its corners are painted, NW=1 NE=2 SW=4 SE=8, so tile 15 is the solid base; sets SpriteForge derives add 4 variants of tile 15 as tiles 16-19, mixed into painted floors) the user paints a small map to see the tiles chain, draws on the map or on single tiles, and edits the base texture, which re-derives the edge tiles (tiles drawn by hand stay); a platformer set (49 tiles) is edited tile by tile. With session_id it opens a tileset that's already in an edit session, and kind (wang = flat floor terrain, wall, iso) switches that Wang set's preview, keeping its tiles and the user's edits. Otherwise it makes a new set from kind (wang, wall, iso or platformer; default wang) plus palette + tiles (16 or 20 grids for Wang, 49 for platformer, in mask order), palette + base (a seamless square texture; the Wang tiles are derived from it as SpriteForge does), png_base64 (a tileset sheet or a texture), or size alone for a blank set. With png_base64 and no layout, a 16x1 or 20x1 image is a strip, a 4x5 one a sheet, and a square one is a 4x4 sheet when its tiles look like a Wang set in mask order (tile 0 empty, or nearly every tile's corners matching tile 15 where its mask has that corner and tile 0 where it doesn't), else a texture. The result says which view it opened and how it read the PNG. The user's edits save to the edit session.
| Name | Type | Req | Description |
|---|---|---|---|
| base | array | – | A square seamless texture to derive a Wang set from (its 16 tiles and 4 variants of tile 15). |
| kind | string | – | wang (flat floor terrain), wall (Wang walls), iso (isometric Wang) or platformer. For a new set, default wang. With session_id, wang, wall or iso switches that Wang set's preview, keeping its tiles;… |
| layout | string | – | How to read png_base64: sheet (4x4 or 4x5 Wang sheet, or a platformer set's 7x7), strip (16x1 or 20x1) or texture (a square base texture the Wang tiles are derived from). Default: guessed from the im… |
| name | string | – | The set's name. |
| palette | array | – | Hex colours for tiles or base. |
| png_base64 | string | – | A tileset PNG (a Wang set's 4x4 or 4x5 sheet or 16x1 or 20x1 strip, a platformer set's 7x7 sheet) or a square texture, base64. |
| session_id | string | – | An existing tileset edit session, or an edit link containing ?s=<id>. Give kind with it to change a Wang set's preview; the other fields are for a new set. |
| size | integer | – | Tile size for a blank set (default 32). |
| tiles | array | – | The set's tiles in mask order (16 for Wang kinds, or 20 with tile 15's 4 variants after them; 49 for platformer), palette indexes, -1 transparent. |
No output schema declared.
No examples provided.
save_art Save the editor card's sprite ~82
Saves the user's edits from the SpriteForge editor card to its edit session. Only the card calls it.
| Name | Type | Req | Description |
|---|---|---|---|
| art | object | yes | Pixel art in SpriteForge's format: palette = hex colours, grid = rows of palette indexes (-1 = transparent). Optional frames for an animation, each { grid } on the same palette. |
| session_id | string | yes | – |
No output schema declared.
No examples provided.
How do I install the SpriteForge Editor MCP server?
SpriteForge Editor is a hosted endpoint at https://www.spriteforge.tech/mcp/editor, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · www.spriteforge.tech
claude mcp add --transport http tech-spriteforge-editor 'https://www.spriteforge.tech/mcp/editor'
What is the SpriteForge Editor MCP server?
SpriteForge Editor is an MCP server listed in the public MCP registry as tech.spriteforge/editor. Free pixel and tileset editor, no account: hand-edit sprites, animations and Wang tilesets in chat. This page covers its hosted endpoint (https://www.spriteforge.tech/mcp/editor).
Is the SpriteForge Editor MCP server safe to use?
SpriteForge Editor scores 79 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SpriteForge Editor MCP server expose?
SpriteForge Editor exposes 6 tools: open_editor, get_sprite, open_full_editor, open_tileset_editor, load_art, save_art. Their descriptions and schemas cost roughly 1,590 tokens of context every time the server is loaded.
Does the SpriteForge Editor MCP server require authentication?
No. We connected to SpriteForge Editor without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the SpriteForge Editor MCP server still maintained?
SpriteForge Editor is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.