
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@offlinecreator/mcp
Advanced tools
OfflineCreator Studio MCP server for Cursor, Claude, Hermes, and other MCP clients
MCP server + thin CLI for OfflineCreator Studio.
Gives Cursor, Claude Desktop, Claude Code, Hermes, Windsurf, and other MCP clients tools to list models, check credits, generate images/video, and wait for results — using your Studio API key.
/settings).oc_live_… or oc_test_…).| Variable | Required | Description |
|---|---|---|
OFFLINECREATOR_API_KEY | Yes | Personal API key from Settings |
OFFLINECREATOR_API_BASE | No | API origin. Default https://offlinecreatorstudio.com. Localhost allowed; other hosts need OFFLINECREATOR_ALLOW_INSECURE_API_BASE=true. |
OFFLINECREATOR_UPLOAD_ROOT | No | Directory that upload_input file paths must stay inside (default: process cwd). |
OFFLINECREATOR_ALLOW_INSECURE_API_BASE | No | Set true only for private/non-prod API hosts. |
upload_input cannot read arbitrary disk paths: paths must stay under the upload root, use image extensions, pass size limits, and match image magic bytes./api/v1/* on a trusted API origin (HTTPS except localhost).Add to MCP settings (stdio):
{
"mcpServers": {
"offlinecreator": {
"command": "npx",
"args": ["-y", "@offlinecreator/mcp"],
"env": {
"OFFLINECREATOR_API_KEY": "oc_live_…"
}
}
}
}
Local monorepo (before npm publish):
{
"mcpServers": {
"offlinecreator": {
"command": "node",
"args": ["C:/Users/YOU/Desktop/mcp_tool/packages/mcp/dist/index.js"],
"env": {
"OFFLINECREATOR_API_KEY": "oc_live_…",
"OFFLINECREATOR_API_BASE": "http://localhost:3000"
}
}
}
}
Same JSON under Claude → Settings → Developer → MCP servers.
claude mcp add offlinecreator --env OFFLINECREATOR_API_KEY=oc_live_… -- npx -y @offlinecreator/mcp
Use the same stdio command / args / env shape as Cursor. Prefer Streamable HTTP remote MCP once Phase 2 is live (https://mcp.offlinecreatorstudio.com/mcp).
| Tool | Purpose |
|---|---|
list_models | Launch catalog + credit costs |
get_credits | Current balance |
list_topups | Credit packs and USD prices |
create_topup_checkout | Stripe Checkout URL for a top-up (human pays in browser) |
generate | Start generation (wait: true to poll) |
upload_input | Attach image for image-to-video, then submit |
get_generation | Status / output URL |
wait_generation | Poll until done |
cancel_generation | Cancel reserved job + refund |
list_generations | Recent jobs |
Top-ups never charge through the agent. create_topup_checkout returns a Stripe URL; credits land after payment via webhook.
npx @offlinecreator/mcp models
npx @offlinecreator/mcp balance
npx @offlinecreator/mcp topups
npx @offlinecreator/mcp topup --id topup-1000
npx @offlinecreator/mcp generate --model flux-schnell --prompt "A clean product still" --wait
npm install
npm run mcp:build
OFFLINECREATOR_API_KEY=oc_test_… OFFLINECREATOR_API_BASE=http://localhost:3000 npm run mcp:start
Studio generations run on disclosed cloud providers (not on-device). LocalForge remains the offline product.
FAQs
OfflineCreator Studio MCP server for Cursor, Claude, Hermes, and other MCP clients
The npm package @offlinecreator/mcp receives a total of 257 weekly downloads. As such, @offlinecreator/mcp popularity was classified as not popular.
We found that @offlinecreator/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.