
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@imagekit/api-mcp
Advanced tools
You can run the MCP Server directly via npx:
export IMAGEKIT_PRIVATE_KEY="My Private Key"
export OPTIONAL_IMAGEKIT_IGNORES_THIS="My Password"
export IMAGEKIT_WEBHOOK_SECRET="My Webhook Secret"
npx -y @imagekit/api-mcp@latest
There is a partial list of existing clients at modelcontextprotocol.io. If you already have a client, consult their documentation to install the MCP server.
For clients with a configuration JSON, it might look something like this:
{
"mcpServers": {
"imagekit_nodejs_api": {
"command": "npx",
"args": ["-y", "@imagekit/api-mcp"],
"env": {
"IMAGEKIT_PRIVATE_KEY": "My Private Key",
"OPTIONAL_IMAGEKIT_IGNORES_THIS": "My Password",
"IMAGEKIT_WEBHOOK_SECRET": "My Webhook Secret"
}
}
}
}
If you use Cursor, you can install the MCP server by using the button below. You will need to set your environment variables
in Cursor's mcp.json, which can be found in Cursor Settings > Tools & MCP > New MCP Server.
If you use MCP, you can install the MCP server by clicking the link below. You will need to set your environment variables
in VS Code's mcp.json, which can be found via Command Palette > MCP: Open User Configuration.
If you use Claude Code, you can install the MCP server by running the command below in your terminal. You will need to set your
environment variables in Claude Code's .claude.json, which can be found in your home directory.
claude mcp add imagekit_api_mcp_api --env IMAGEKIT_PRIVATE_KEY="My Private Key" OPTIONAL_IMAGEKIT_IGNORES_THIS="My Password" IMAGEKIT_WEBHOOK_SECRET="My Webhook Secret" -- npx -y @imagekit/api-mcp
This MCP server is built on the "Code Mode" tool scheme. In this MCP Server, your agent will write code against the TypeScript SDK, which will then be executed in an isolated sandbox. To accomplish this, the server will expose two tools to your agent:
The first tool is a docs search tool, which can be used to generically query for documentation about your API/SDK.
The second tool is a code tool, where the agent can write code against the TypeScript SDK. The code will be executed in a sandbox environment without web or filesystem access. Then, anything the code returns or prints will be returned to the agent as the result of the tool call.
Using this scheme, agents are capable of performing very complex tasks deterministically and repeatably.
Launching the client with --transport=http launches the server as a remote server using Streamable HTTP transport. The --port setting can choose the port it will run on, and the --socket setting allows it to run on a Unix socket.
Authorization can be provided via the Authorization header using the Basic scheme.
Additionally, authorization can be provided via the following headers:
| Header | Equivalent client option | Security scheme |
|---|---|---|
x-imagekit-private-key | privateKey | basicAuth |
x-optional-imagekit-ignores-this | password | basicAuth |
A configuration JSON for this server might look like this, assuming the server is hosted at http://localhost:3000:
{
"mcpServers": {
"imagekit_nodejs_api": {
"url": "http://localhost:3000",
"headers": {
"Authorization": "Basic <auth value>"
}
}
}
}
FAQs
The official MCP Server for the Image Kit API
We found that @imagekit/api-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.