
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
engine-pexels
Advanced tools
Enhanced MCP server for Pexels API integration with automatic image/video downloading capabilities
An enhanced Model Context Protocol (MCP) server that provides comprehensive access to the Pexels API with automatic downloading capabilities. This server allows AI models to search for, retrieve, and automatically download photos and videos from Pexels to a configured workspace directory.
This project is forked and enhanced from the original pexels-mcp-server by @CaullenOmdahl. The original provided the foundation for Pexels API integration, and this version adds workspace configuration and automatic file downloading capabilities.
pnpm install
pnpm build
PEXELS_API_KEY=your_api_key pnpm dev
The server requires two environment variables:
PEXELS_API_KEY: Your Pexels API key (required)WORKSPACE_PATH: Root directory where files will be downloaded (required for download functionality)Add this to your MCP settings file:
{
"mcpServers": {
"engine-pexels": {
"command": "npx",
"args": ["engine-pexels"],
"env": {
"PEXELS_API_KEY": "your_pexels_api_key",
"WORKSPACE_PATH": "/path/to/your/workspace"
}
}
}
}
Alternative local development configuration:
{
"mcpServers": {
"engine-pexels": {
"command": "node",
"args": ["/path/to/engine-pexels/dist/main.js"],
"env": {
"PEXELS_API_KEY": "your_pexels_api_key",
"WORKSPACE_PATH": "/path/to/your/workspace"
}
}
}
}
Search for photos:
searchPhotos("mountain landscape")
Download a specific photo:
downloadPhoto({
id: 12345,
size: "large",
relative_save_path: "images/landscapes/mountain.jpg"
})
// File will be saved to: /path/to/your/workspace/images/landscapes/mountain_large.jpg
Set API key at runtime (if needed):
setApiKey("your_pexels_api_key")
This enhanced version adds several key features over the original pexels-mcp-server:
This MCP server can be deployed to Smithery. Follow these steps:
The server provides the following tools:
setApiKey: Set your Pexels API key for authentication.searchPhotos: Search for photos by query (use descriptive keywords for relevant results, e.g., 'Thai hotel reception', 'red sports car driving', not just 'hotel' or 'car'; combine with parameters like orientation, size, color, and locale for refined results), with optional filters for orientation, size, color, locale (e.g., 'en-US', 'es-ES'), page, and results per page. Returns metadata including photo IDs and URLs, plus current API rate limit status.downloadPhoto: Downloads a specific photo by its ID and desired size to the specified relative path within the workspace. Parameters: id (photo ID), size (optional, defaults to 'original'), and relative_save_path (relative path from workspace). Available sizes: 'original', 'large2x', 'large', 'medium', 'small', 'portrait', 'landscape', 'tiny'. The photo is automatically downloaded and saved to the combined workspace + relative path location.getCuratedPhotos: Retrieve a curated set of photos from Pexels, optionally paginated.getPhoto: Retrieve detailed information about a specific photo by its ID.searchVideos: Search for videos by query (use descriptive keywords for relevant results, e.g., 'drone footage beach sunset', 'time lapse city traffic', not just 'beach' or 'city'; combine with parameters like orientation and size for refined results), with optional filters for orientation, size, locale (e.g., 'en-US', 'es-ES'), page, and results per page. Returns metadata including video IDs and URLs, plus current API rate limit status.getPopularVideos: Retrieve a list of popular videos from Pexels, with optional filters for dimensions, duration, page, and results per page.getVideo: Retrieve detailed information about a specific video by its ID.downloadVideo: Downloads a specific video by its ID and preferred quality to the specified relative path within the workspace. Parameters: id (video ID), quality (optional, 'hd' or 'sd', defaults to 'hd'), and relative_save_path (relative path from workspace). The video is automatically downloaded and saved to the combined workspace + relative path location.getFeaturedCollections: Retrieve a list of featured collections from Pexels, optionally paginated.getMyCollectionsgetCollectionMedia: Retrieve media items (photos or videos) from a specific collection by collection ID, with optional filters for type, sort order, page, and results per page.The server provides the following URI-addressable resources:
pexels-photo://{id}: Access a specific photo by IDpexels-video://{id}: Access a specific video by IDpexels-collection://{id}: Access a specific collection by IDThe server attempts to provide informative error messages for common issues like invalid API keys, rate limits, or missing resources. Successful responses also include the current Pexels API rate limit status (remaining requests, reset time) in the output.
When using the Pexels API, you must follow their attribution requirements:
ISC
FAQs
Enhanced MCP server for Pexels API integration with automatic image/video downloading capabilities
We found that engine-pexels demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.