
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
layoutbridge-spm
Advanced tools
LayoutBridge for Adobe InDesign® – MCP server for Adobe® InDesign® (npm package layoutbridge-spm). Adobe and InDesign are either registered trademarks or trademarks of Adobe in the United States and/or other countries.
Deutsche Fassung: README.de.md
LayoutBridge for Adobe InDesign® – MCP server for Adobe® InDesign®
(npm package layoutbridge-spm) by MCP Interfaces. It provides typesetting
in Adobe InDesign as tools that any MCP-capable AI can call: documents and
pages, layout grid and guides, frames, images and links, text, styles,
tables, swatches, typography checks, preflight and export.
Product page: https://mcp-interfaces.com/layoutbridge/ (German: https://mcp-schnittstellen.de/layoutbridge/). Step-by-step installation guide: https://mcp-interfaces.com/layoutbridge/installation.html (German: https://mcp-schnittstellen.de/layoutbridge/installation.html).
Adobe and InDesign are either registered trademarks or trademarks of Adobe in the United States and/or other countries.
powershell.exe, included in Windows)--setup, --deactivate) and for other MCP
clients. With the installation package (.mcpb) no separate Node.js
installation is needed – Claude Desktop comes with Node.js (switch “Use
built-in Node.js for MCP” under “Advanced settings”, on by default).There are two ways. Way A is the shorter one; Way B is the same entry that other MCP clients receive. The installation guide linked above shows every step with Mac and Windows details.
Way A – installation package (bundle file .mcpb)
layoutbridge-spm-<version>.mcpb from the product
page.Way B – npm package (Node.js version 20 or newer)
Setup command – run in Terminal (Mac) or PowerShell (Windows):
npx layoutbridge-spm --setup
The command adds the server to the Claude Desktop configuration file and
stores the licence key in the default location (see “Licence key”). It
only runs when you call it. Before every change it shows the full path of
the file and the new entry verbatim and asks for confirmation (y for
yes, n for no). Before writing it creates a backup
claude_desktop_config.json.bak-YYYY-MM-DD_HHMM in the same folder; only
the entry layoutbridge-spm under mcpServers is changed, all other
entries stay unchanged. If the file is not valid JSON, it stops and names
line and column. The licence key is asked for without being shown and is
written only to license.key. No administrator rights, no network
connection. On Windows it uses the configuration folder of the Claude
Desktop package (see “By hand”) if there is one, otherwise
%APPDATA%\Claude, and says which one it chose; if it finds several
Claude Desktop packages and cannot tell which one is in use, it stops
without changing anything.
--dry-run shows the same and writes nothing.--license-key-file <path> reads the key from a file instead of asking
for it.By hand: open the configuration file of Claude Desktop in a text
editor. On Windows, the simplest way is Settings › Desktop app › Developer ›
“Edit Config”: it opens the folder Claude Desktop actually reads. For the
usual installation as an app package this is
%LOCALAPPDATA%\Packages\Claude_<id>\LocalCache\Roaming\Claude\claude_desktop_config.json
(<id> is a combination of letters and digits); only an installation
without a package uses %APPDATA%\Claude\claude_desktop_config.json. On
the Mac the file is ~/Library/Application Support/Claude/claude_desktop_config.json
(“Edit Config” works there as well). If the file is empty or does not exist
yet, its complete content is this:
{
"mcpServers": {
"layoutbridge-spm": {
"command": "npx",
"args": ["-y", "layoutbridge-spm"]
}
}
}
If the file already lists other servers under "mcpServers", insert only
the block "layoutbridge-spm": { … } there – with a comma between the
entries – and leave everything else unchanged. Then store the licence key
(see “Licence key”). On the first start, npx downloads the package
layoutbridge-spm from the npm registry; after that it starts from the
local cache.
Then: quit Claude Desktop completely – on Mac with ⌘ + Q, on Windows
via “Quit” in the application menu; closing the window is not enough –
and start it again. Start Adobe® InDesign® and ask in Claude Desktop:
“Which InDesign® version is running?” Claude calls the tool
get_app_version and reports the version. The tools appear under the
extension name “LayoutBridge for Adobe InDesign®” on Way A, and with the
prefix layoutbridge-spm: on Way B.
Other MCP clients (Claude Code, Cursor, GitHub Copilot and others) register the same server according to their own documentation. The command is always
npx -y layoutbridge-spm
and requires Node.js version 20 or newer. The licence key is found in the same places as described under “Licence key”.
The key is in the purchase receipt e-mail and is valid for exactly one workstation; several workstations need several keys.
Where LayoutBridge looks for the key, in this order:
LAYOUTBRIDGE_SPM_LICENSE_KEY – the
installation package sets it from the field “Licence key”; on Way B it
can go into the server entry as "env": { "LAYOUTBRIDGE_SPM_LICENSE_KEY": "YOUR-LICENCE-KEY" },LAYOUTBRIDGE_SPM_LICENSE_FILE,license.key at the default location – the key only, no other
text:
~/Library/Application Support/layoutbridge-spm/license.key%USERPROFILE%\.layoutbridge-spm\license.keyCreate the folder layoutbridge-spm or .layoutbridge-spm if it does not
exist. A key added or changed later takes effect without a restart.
Check: on the first tool call LayoutBridge verifies the key online; after that at most once every 24 hours. If the service cannot be reached, LayoutBridge keeps working for 14 days from the last valid check and appends a warning to every response; after that, or if no valid check has ever taken place, the tools are locked until the key can be verified again.
Without a valid key every tool answers with ok: false and
error.kind: "license". The message says in plain words whether the key is
missing, expired, invalid, for another product or cannot be verified right
now, and names the location where the key was expected; error.details
adds the support address and the licence terms. InDesign® is not
contacted.
What is stored and transmitted: the result of the last check is stored
in license-state.json next to license.key – with a fingerprint of the
key, never the key itself, and without customer data. For the check, the
licence key and an identifier of this workstation go to the payment service
Polar (api.polar.sh, USA). The identifier is a random
name of the form layoutbridge-<8 characters>, created the first time and
stored in instance-name next to license.key; the computer name is not
used. Anyone who wants a readable name in the merchant account sets
LAYOUTBRIDGE_SPM_INSTANCE_NAME. Document contents, file paths and tool
calls are never transmitted.
A licence is active on one workstation. Release it on the old computer before entering the key on the new one – no InDesign®, no Claude Desktop needed, but Node.js version 20 or newer:
npx layoutbridge-spm --deactivate
The command reports in plain text whether the release worked and deletes
the local check result. It reads the key from the same places as the
server (see “Licence key”); with the installation package the key is kept
by Claude Desktop, so put it into license.key first or write to support.
If you have no Node.js because you only use the installation package, or
if the old computer is no longer available, you can release the activation
yourself in the Polar customer portal or write to support; they release
the activation.
Defaults that differ from workplace to workplace can be set in a JSON file
that the server reads at start: path from the environment variable
LAYOUTBRIDGE_SPM_CONFIG, otherwise on the Mac
~/Library/Application Support/layoutbridge-spm/config.json, on Windows
%USERPROFILE%\.layoutbridge-spm\config.json. If the file is missing, the
neutral defaults apply. All keys are optional; a parameter in the call
always takes precedence.
{
"tracking_warn_beyond": 20,
"min_ppi": 300,
"export_pdf": {
"preset": "Name of the PDF preset",
"fallback_preset": "Name of the fallback preset",
"fallback_over_bytes": 4194304
}
}
| Key | Effect |
|---|---|
tracking_warn_beyond | apply_character_format_to_range warns if the absolute tracking value exceeds it. Without an entry, no warning. |
min_ppi | Default for the parameter min_ppi of place_image, scale_image_in_frame and fit_frame (warning below this effective resolution). Without an entry 300. |
export_pdf.preset | Default for preset of export_pdf. Without an entry the localised “High Quality Print”. |
export_pdf.fallback_preset, export_pdf.fallback_over_bytes | Second pass with this preset if the file is larger. Without an entry no second pass. |
Unknown keys and wrong types are reported by the server at start on standard error and ignored.
One line per call, one file per running instance:
~/Library/Logs/layoutbridge-spm/ on the Mac,
%USERPROFILE%\.layoutbridge-spm\logs\ on Windows; other location via the
environment variable LAYOUTBRIDGE_SPM_LOG_DIR. The log stays on your
computer; it is not sent anywhere.
What the line contains (default basic): timestamp, tool name,
duration, success, error kind and error text, warnings and the names of
the parameters passed. Values appear only where they are needed for
troubleshooting and harmless (numbers, identifiers, enumeration values,
file paths). Text that can be document content appears only as a length –
"<Text, 248 Zeichen>". In paths your home folder is replaced by ~. The
licence key is never logged.
Setting the depth – LAYOUTBRIDGE_SPM_LOG_LEVEL:
| Value | Meaning |
|---|---|
off | no logging, no file is created |
basic | default, filtered as described above |
full | all parameters verbatim, paths with user name – only for troubleshooting, at the request of support |
When full is active, the first line of the log and the server's start
message say so. Afterwards switch back to basic.
Retention: at start the server deletes log files older than 30
days. Other period via LAYOUTBRIDGE_SPM_LOG_KEEP_DAYS (number of days;
0 switches deletion off).
Use of LayoutBridge for Adobe InDesign® is governed by the licence terms (EULA). The German version is authoritative.
The server names the address in its start line and in every response of the
error kind license (error.details.license_terms).
Which data the server processes – licence check with the payment service, log on your own computer, nothing else – is set out in the product's privacy policy:
The licence check calls the payment service Polar; its privacy policy: https://polar.sh/legal/privacy.
Questions and error reports to kontakt@mcp-interfaces.com. We answer on working days, aiming for within two working days. Helpful are: tool name, error text verbatim, time, InDesign version and operating system. Never send us your licence key.
A copied error message may contain file names and the folder path below your home folder as well as names from the document (pages, frames, styles) – no user name, no document text, no licence key. Bug fixes are implemented as quickly as possible.
The package contains third-party software (runtime dependencies including
transitive packages). Name, version, licence, copyright line and full
licence text per package are in THIRD-PARTY-NOTICES.md (included in the
npm package and in the installation package).
One release a month with a catalogue of new features; bug fixes are
implemented as quickly as possible, independently of that release cycle. All changes
are listed in CHANGELOG.md (included in the package). Within a
major version, tool names, parameters and return fields remain stable;
additions are additive.
Proprietary, all rights reserved. See LICENSE.
FAQs
LayoutBridge for Adobe InDesign® – MCP server for Adobe® InDesign® (npm package layoutbridge-spm). Adobe and InDesign are either registered trademarks or trademarks of Adobe in the United States and/or other countries.
We found that layoutbridge-spm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.