
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
@imgly/codesign-mcp
Advanced tools
A real design engine for your AI agent: generate designs and print-ready PDFs, over MCP.
IMG.LY CoDesign — an MCP server that gives your AI agent a real design engine. It runs locally, so an agent can compose vector layouts, set type, place and edit images, and export print-quality PDF alongside PNG, JPEG, WebP and SVG.
It works with any MCP host — Claude Code, Claude Desktop, Codex and others.
PATHHosts spawn the server with npx, so there is no separate install step.
Keep the @latest pin in every recipe below. A bare npx spec caches the
first version it sees and never updates — and since each release carries a
fresh trial license, a stale copy eventually stops working.
claude mcp add codesign -- npx -y @imgly/codesign-mcp@latest stdio
codex mcp add codesign -- npx -y @imgly/codesign-mcp@latest stdio
Settings → Developer → Edit Config, then add to claude_desktop_config.json:
{
"mcpServers": {
"codesign": {
"command": "npx",
"args": ["-y", "@imgly/codesign-mcp@latest", "stdio"]
}
}
}
Every other host spawns the same stdio server — only the config file and the
top-level key differ. Cursor (.cursor/mcp.json) and Windsurf
(~/.codeium/windsurf/mcp_config.json) take the block above as-is; VS Code
(.vscode/mcp.json) uses the key servers instead of mcpServers.
edit applies changes to a scene, preview renders what
it looks like, inspect and changes report structure and diffs, history
and list cover the workspace. Designs live on disk and persist across
sessions.skill tool reads and searches a bundled
catalog — handbook, API reference, guides, plus task skills for brand,
localization, resizing, format conversion and design review. One MCP
prompt, /codesign, loads the whole design context in a single message
(optionally with a brief) so a session needs no reference reads.import opens Photoshop (.psd/.psb), InDesign
(.idml), PowerPoint (.pptx), PDF, plain images and SVG as a new design;
export writes PDF, print-ready PDF/X, PNG, JPEG, WebP, SVG, HTML and the
portable, self-contained .imgly design file.view opens the current design in a browser-based
editor for hands-on tweaks; edits you save there come back as a new revision
the agent can continue from.Each release ships with a 30-day CE.SDK trial license, so the install commands above work as-is — there is nothing to sign up for first, and updating to a newer release renews it.
Production use needs a license of your own. See img.ly/pricing, or talk to us at img.ly/support.
The design tools need no account. Signing in is only required for AI
generation (asset_generate): call the login tool from inside a session and
finish in your browser, or logout to sign out.
The server keeps everything under ~/.codesign/: your designs in
workspace/, your session token in auth.json after you sign in, and a small
amount of engine bookkeeping. Designs are read and written on your machine,
and the view editor is served from a local port — no design is uploaded to
run the design loop. AI generation and asset search contact IMG.LY services by
design, since that is where they run.
The binary serves one transport and three subcommands:
codesign-mcp stdio # MCP over stdin/stdout — what hosts spawn
codesign-mcp system-prompt # the design context as one system prompt
codesign-mcp diagnose # redacted log bundle for IMG.LY support
codesign-mcp --help
diagnose collects local logs into a .zip and makes no network calls.
system-promptAn interactive host can invoke the /codesign prompt and get the whole design
context in one message. A headless run cannot invoke a prompt at all — it gets a
brief and starts working, so it pays the reference reads on every run, re-sends
their results with every turn, and produces broken output when it skips one.
system-prompt writes the same bundle — handbook, design rules, the edit-code
API surface, judge, copy rules, quirks, fonts — as a system prompt, where it
costs nothing to re-read:
codesign-mcp system-prompt -o codesign.md
claude -p "an A4 recruiting poster for a bakery" \
--append-system-prompt-file codesign.md \
--strict-mcp-config --mcp-config mcp.json
Use a file, not --append-system-prompt "$(…)": the bundle is larger than a
single shell argument is allowed to be. --replace emits the variant for
--system-prompt, which replaces the host's own prompt. What stays behind the
skill tool is what a run reads only when it needs it — the upstream CE.SDK
type definitions, the guide, and the task skills.
Questions, bug reports and licensing: img.ly/support.
Three npm dist-tags, from the same source:
| Channel | Install | Engine | Video |
|---|---|---|---|
latest | npx @imgly/codesign-mcp | WASM | off |
next | npx @imgly/codesign-mcp@next | WASM | off |
canary | npx @imgly/codesign-mcp@canary | native (required) | on |
next is the tip of main, published on every push. canary is the same
commit built with the native engine and the video surface on — it exists so the
native engine gets real usage before it becomes everyone's default.
Two things to know before installing canary:
@cesdk/node-native and refuses to start without it, rather than
quietly falling back to WASM. A canary that silently ran WASM would tell you
nothing about the thing it exists to test.canary cannot run there —
including Docker on Apple Silicon. Use next or latest on those hosts.| Variable | Meaning |
|---|---|
IMGLY_CESDK_ENGINE | engine flavor: wasm | native (default: wasm, or native when video is on). |
IMGLY_FEATURE_VIDEO | on | off — video export and video/audio import (default: off). |
IMGLY_TELEMETRY | on | off — usage telemetry (default: on). |
IMGLY_DIAGNOSTICS_FILE | false stops local diagnostics logging (default: true). |
IMGLY_DIAGNOSTICS_TOOL | false hides the diagnostics tool (default: true). |
IMGLY_DIAGNOSTICS_DIR | where diagnostics logs are written (default: the platform state dir). |
IMGLY_GATEWAY_API_KEY | AI gateway key; an alternative to signing in with the login tool. |
IMGLY_GATEWAY_BASE_URL | AI gateway endpoint (default: IMG.LY hosted). |
IMGLY_AUTH_ISSUER | override the built-in sign-in endpoints — set both together, or neither. |
IMGLY_AUTH_CLIENT_ID | see IMGLY_AUTH_ISSUER. |
IMGLY_DEFAULT_ASSETS_BASE_URL | manifest root for the default asset sources (default: IMG.LY CDN). |
IMGLY_DEMO_ASSETS_BASE_URL | manifest root for the demo asset sources (default: IMG.LY CDN). |
IMGLY_GFONTS_CONTENT_URL | Google Fonts content root (default: IMG.LY CDN). |
These are a development surface: a published build deletes every IMGLY_* /
CESDK_* / CODESIGN_* variable at startup except the licence, workspace,
engine-sizing and gateway-credential ones — see src/cli/frozen-env.ts. Setting
one on a released build has no effect and reports no error.
Use of CoDesign is governed by the CoDesign Terms of Service. For commercial licensing, see img.ly/pricing.
FAQs
A real design engine for your AI agent: generate designs and print-ready PDFs, over MCP.
The npm package @imgly/codesign-mcp receives a total of 7,320 weekly downloads. As such, @imgly/codesign-mcp popularity was classified as popular.
We found that @imgly/codesign-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 12 open source maintainers collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.