
Security News
Insecure Agents Podcast: How to Keep AI Agents From Bypassing Security Controls
Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.
@imageat/mcp
Advanced tools
Model Context Protocol server for ImageAT — generate images, generate video, and run image-edit tools from any MCP client.
Model Context Protocol (MCP) server for ImageAT. Gives any MCP client (Claude Desktop, Cursor, etc.) tools to generate images, generate video, and run ImageAT's image-edit features — billed against your ImageAT account credits.
| Tool | What it does |
|---|---|
imageat_generate_image | Text-to-image / image-to-image. Returns CDN image URL(s). |
imageat_generate_video | Text-to-video / image-to-video. Returns a CDN mp4 URL. |
imageat_check_credits | Current credit balance. |
imageat_edit_<feature> | One tool per edit feature, fetched live at startup — e.g. imageat_edit_remove-background, imageat_edit_object-eraser, imageat_edit_relight, imageat_edit_virtual-try-on, imageat_edit_city-teleport, imageat_edit_ai-edit-pro. New features appear automatically. |
If the feature catalog can't be reached at startup, a single generic imageat_edit_image tool
(taking a feature id parameter) is registered instead, so the server still works.
iat_live_).{
"mcpServers": {
"imageat": {
"command": "npx",
"args": ["-y", "@imageat/mcp"],
"env": {
"IMAGEAT_API_KEY": "iat_live_xxxxxxxxxxxx"
}
}
}
}
imageat_* tools will be available.| Var | Required | Default | Notes |
|---|---|---|---|
IMAGEAT_API_KEY | yes | — | Your iat_live_ key. |
IMAGEAT_BASE_URL | no | https://imageat.com | The web app that serves the /api/v1/* generation endpoints. Point at http://localhost:3000 for local dev. |
The npx setup above is stdio — it works in desktop apps that launch a local process
(Claude Desktop, Cursor, Claude Code). Browser clients like claude.ai and chatgpt.com
instead connect to a remote MCP endpoint over Streamable HTTP.
The same tools are served over HTTP by dist/http.js. Each MCP session carries the user's
own API key via the Authorization: Bearer iat_live_... header (multi-user), so this is what
you point a hosted connector at.
# Run the remote server locally against a local ImageAT instance:
IMAGEAT_BASE_URL=http://localhost:3000 PORT=8787 npm run start:http
# MCP endpoint: http://localhost:8787/mcp · health: /health
Deploy it (e.g. on Dokploy as mcp.imageat.com) with the included Dockerfile, then add it as
a custom connector:
https://mcp.imageat.com/mcp.https://mcp.imageat.com/mcp.Both send the API key as a Bearer token on the connection; paste your iat_live_ key when the
client asks for the connector's authorization.
| Var | Where | Default | Notes |
|---|---|---|---|
PORT | remote only | 8787 | HTTP listen port. |
IMAGEAT_BASE_URL | both | https://imageat.com | Upstream web app serving /api/v1/*. |
npm install
npm run build
# Inspect the stdio server with the official MCP Inspector against a local ImageAT instance:
IMAGEAT_API_KEY=iat_live_... IMAGEAT_BASE_URL=http://localhost:3000 \
npx @modelcontextprotocol/inspector node dist/index.js
Today the server authenticates with a static iat_live_ API key (the remote server reads it
per-session from the Authorization header). Auth is isolated behind an AuthProvider interface
(src/auth.ts), so a future "Sign in with ImageAT" OAuth provider can be dropped in without
changing the tools, the HTTP client, or the backend /v1 routes.
FAQs
Model Context Protocol server for ImageAT — generate images, generate video, and run image-edit tools from any MCP client.
The npm package @imageat/mcp receives a total of 28 weekly downloads. As such, @imageat/mcp popularity was classified as not popular.
We found that @imageat/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.

Security News
GPT-6 Astra tried to plant malicious code in simulated open source projects using fake GitHub accounts and deceptive PRs during an assigned CTF challenge.

Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.