
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@jparkerdiamond/chatppt
Advanced tools
Model Context Protocol (MCP) server for programmatic PowerPoint creation and editing
ChatPPT is a Model Context Protocol (MCP) server for programmatic, AI-assisted PowerPoint creation and editing. Built on Node.js 20+ and @office-kit/pptx, ChatPPT exposes a safe, structured, resource-oriented CRUD API over stdio for connected LLMs in Visual Studio Code and other MCP-compatible clients.
presentations/<deckId>.pptx..chatppt/registry.json.@office-kit/pptx-preview..vscode/mcp.json)To use ChatPPT in your VS Code workspace, add or update .vscode/mcp.json in the root of your workspace:
{
"servers": {
"chatppt": {
"type": "stdio",
"command": "node",
"args": ["${workspaceFolder}/dist/index.js"]
}
}
}
npx ExecutionWhen running via npx or published binary, ChatPPT can be configured to target a specific workspace using the --workspace flag or environment variables:
{
"servers": {
"chatppt": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@jparkerdiamond/chatppt", "--workspace", "${workspaceFolder}"]
}
}
}
ChatPPT operates on a deterministic workspace root resolved in the following priority order:
--workspace <path> or -w <path>CHATPPT_WORKSPACE_ROOT or WORKSPACE_ROOTprocess.cwd() (current working directory)<workspace>/presentations/<deckId>.pptx<workspace>/.chatppt/registry.json^[a-zA-Z0-9_-]+$. Absolute paths or relative paths attempting directory traversal (..) outside the workspace root are caught and rejected with ValidationError..pptx presentations are detected and rejected.deck_*)deck_create: Create a new blank presentation deck.deck_list: List all managed decks in the workspace.deck_read: Read metadata and slide/collection list for a deck.deck_update: Update deck metadata (title) with optional optimistic revision check (expectedRevision).deck_delete: Permanently delete a deck and its .pptx file.deck_validate: Run diagnostic invariant checks across PPTX content and registry metadata.slide_*)slide_create: Add one or multiple slides in batch (supports title and notes).slide_list: List slides in presentation order with 0-based position indexes.slide_read: Read slide metadata and its element listing.slide_render: Render a slide to a PNG image preview for visual feedback. Accepts an optional width in pixels, defaulting to 1280, and returns an MCP image content item.slide_update: Update slide title and speaker notes in batch.slide_delete: Permanently delete slides and clean up collection references.slide_move: Move a slide or reorder slides by providing a slideOrder array.slide_duplicate: Duplicate a slide with new stable IDs for the slide and all elements.slide_collection_*)slide_collection_create: Create a named ordered group of existing slides.slide_collection_list: List collections in a presentation.slide_collection_read: Read collection details and slide membership.slide_collection_update: Rename a collection or replace slide membership.slide_collection_delete: Delete a collection without deleting the slides.element_*)element_create: Create text boxes, preset shapes, lines, tables, charts, or images in batch (supports optional clientId correlation).element_list: List all elements on a slide in z-index order.element_read: Read element metadata and styling properties.element_update: Update position, size, text, fill, font, size, bold, italic, text color, stroke, and alignment in batch.element_delete: Delete elements from a slide in batch.element_reorder: Adjust element z-index (bringToFront, sendToBack, bringForward, sendBackward).Call slide_render with the deck and slide UUIDs. The response includes a base64-encoded image/png content item that MCP clients can display directly:
{
"deckId": "<deck UUID>",
"slideId": "<slide UUID>",
"width": 1280
}
The renderer is a deterministic approximation of PowerPoint output and runs in Node.js without a headless browser.
npm install
npm run build
npm test
npm run dev
FAQs
Model Context Protocol (MCP) server for programmatic PowerPoint creation and editing
We found that @jparkerdiamond/chatppt demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.