
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
storeshots-api-mcp
Advanced tools
MCP server for StoreShots: turn raw app screenshots into App Store & Google Play marketing screenshots via the hosted StoreShots API (no Chrome needed).
Turn raw app screenshots into polished App Store & Google Play marketing screenshots from Cursor, Claude, or any MCP client. The server is a thin stdio client for the hosted StoreShots API. It doesn't need Chrome or a local renderer.
glow, midnight, sunset, mint, trailingiphone, iphone-duo, android, ipadios-6.9 (1320×2868), ios-6.5 (1242×2688), android-phone (1080×1920), ipad-13 (2064×2752)Sign up with your email at https://storeshots.qaimos.co.uk/account.html. The key is shown once, so copy it somewhere safe. Every account gets 3 free sets per month, which carry a small "Made with StoreShots" watermark. Paid credits remove the watermark, and each generate call uses 1 credit per set.
Cursor: ~/.cursor/mcp.json (or .cursor/mcp.json in a project):
{
"mcpServers": {
"storeshots": {
"command": "npx",
"args": ["-y", "storeshots-api-mcp"],
"env": { "STORESHOTS_API_KEY": "ss_your_key_here" }
}
}
}
Claude Desktop: claude_desktop_config.json (Settings → Developer → Edit Config). It takes the same JSON block as Cursor.
Claude Code:
claude mcp add storeshots --env STORESHOTS_API_KEY=ss_your_key_here -- npx -y storeshots-api-mcp
VS Code / others: run the command npx -y storeshots-api-mcp over stdio with STORESHOTS_API_KEY set.
| Variable | Required | Default |
|---|---|---|
STORESHOTS_API_KEY | yes | none |
STORESHOTS_API_URL | no | https://storeshots.qaimos.co.uk/api.php (point it at your own self-hosted api.php if you run one) |
STORESHOTS_OUTPUT_DIR | no | ~/StoreShots (default download folder) |
STORESHOTS_TIMEOUT_MS | no | 300000 |
| Tool | What it does |
|---|---|
list_styles | Lists the styles with their colours and layouts |
list_devices | Lists device frames and store output sizes |
generate_screenshots | Takes screenshots (1–5 paths/URLs), plus optional style, device, targets[], headlines[], captions[], appName, theme (colours), download_to and download_format (zip | png | both). Returns a jobId |
get_output | job_id, output_dir, format: downloads the ZIP and/or PNGs (outputs are kept for 24h) |
get_balance | Shows credits, free sets left this month, and credit packs |
buy_credits | pack: returns a Stripe Checkout link to open in the browser. Credits are added after payment; the tool itself charges nothing |
Example prompt:
Make App Store screenshots from ./shots/home.png and ./shots/stats.png in the midnight style with headlines "Build habits that stick" and "See your progress", and save them to ./store-assets.
Your screenshots are uploaded over HTTPS to the StoreShots API, rendered, and deleted from the server after 24 hours. The API key is sent as an X-API-Key header.
MIT
FAQs
MCP server for StoreShots: turn raw app screenshots into App Store & Google Play marketing screenshots via the hosted StoreShots API (no Chrome needed).
The npm package storeshots-api-mcp receives a total of 0 weekly downloads. As such, storeshots-api-mcp popularity was classified as not popular.
We found that storeshots-api-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.