
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
compositor-mcp
Advanced tools
MCP server for Compositor (.comp) projects: lets Claude and other agents read and edit layered Mac image documents
An MCP server that lets Claude and other AI agents read and edit Compositor projects, the open-source Photoshop alternative for Mac.
It works on the documented .comp package format (a manifest.json plus one PNG per layer), so it
needs no changes to Compositor itself. Edit a project with an agent, then open it in Compositor.
Or the other way round: save in Compositor and let the agent inspect, retouch or render it.
| Tool | Purpose |
|---|---|
inspect_project | Canvas size, resolution and every layer with folder depth, opacity, blend mode, transform, mask and clipping info |
list_layers | Compact top-to-bottom view like the Layers panel |
render_preview | Flattened PNG preview returned as an image so the model can see the composition |
export_flattened | Full-resolution PNG or JPEG export |
export_layer | Copy a layer's source pixels or mask to a file |
create_project | New document, optionally with a solid background layer |
add_image_layer | Import PNG, JPEG, HEIC, TIFF, WebP… as a layer, with fit/fill/stretch placement, opacity, blend mode and folder |
add_folder | Create a layer folder |
set_layer | Rename, show/hide, opacity, blend mode, position, size, rotation, flips, sampling, mask on/off |
move_layer | Reorder layers or move them between folders |
remove_layer | Delete a layer or a whole folder |
replace_layer_image | Swap a layer's pixels (round-trip through another tool or a generated image) |
set_layer_mask | Attach a grayscale mask, invert it, or clear it |
resize_canvas | Change the document size with an anchor, without resampling |
open_in_compositor | Open the project in the Compositor app |
The server also exposes a compositor://format resource describing the file format.
marcushorndt/compositor-mcp takes a different route: it drives
Compositor's own document model and renderer headlessly (Swift), so previews match the app exactly. This package is a
plain Node server that works on the documented file format, needs no build of the app, and runs wherever Node runs.
Pick whichever fits your setup; both open the same .comp files.
Requires Node.js 20 or later. Compositor itself is only needed to look at the result.
claude mcp add compositor -- npx -y compositor-mcp
Add to claude_desktop_config.json:
{
"mcpServers": {
"compositor": {
"command": "npx",
"args": ["-y", "compositor-mcp"]
}
}
}
git clone https://github.com/Josusanz/compositor-mcp
cd compositor-mcp
npm install
npm run build
claude mcp add compositor -- node /path/to/compositor-mcp/dist/src/index.js
Create a 1920×1080 project at
~/Desktop/poster.compwith a white background, addphoto.jpgscaled to fill, putlogo.pngin the bottom right corner at 80 % opacity with Multiply, then show me a preview and open it in Compositor.
The agent calls create_project, add_image_layer twice, set_layer, render_preview and
open_in_compositor. Compositor opens the document with the layers ready to keep editing.
ProjectStore.swift before writing, written
with sorted keys and replaced atomically.open_in_compositor).npm install
npm test # builds and runs the node:test suite
npm run dev # runs the server from TypeScript with tsx
MIT. Compositor is © Robbie Tilton, also MIT.
FAQs
MCP server for Compositor (.comp) projects: lets Claude and other agents read and edit layered Mac image documents
We found that compositor-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.