TrueLook: AI dating photos

app.truelook/truelooktruelook.appstreamable-httpv2.0.0Scanned 1 hour ago

Make hyperrealistic AI dating photos of yourself from a chat: free photo review, 62 styles.

12 tools: 7 change things and 5 only read.

Reads private data · 1
Reads text others write · 4
Can send data out · 0
7 findings, 7 high

Anlyon alternative

7 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

12 tools

Changes things 7Creates or changes something that can be changed back.Claude Code: ask

about_truelookWhat TrueLook is and how making photos from this chat works, step by step.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
What TrueLook is and how making photos from this chat works, step by step. Call this first if you are unsure how to help someone get dating photos.
Annotations the server declares
- title: About TrueLook
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
buy_packA secure Stripe checkout link for a pack (fix: $29, 30 photos; pro: $49, 140 photos) or, after a pack, a top-up (extra20: $12; extra60: $25).Reads text others write1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- High
  The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
  Matched text
  inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
  What this check looks for
Description, as the server wrote it
A secure Stripe checkout link for a pack (fix: $29, 30 photos; pro: $49, 140 photos) or, after a pack, a top-up (extra20: $12; extra60: $25). Only call this after the user chose to buy. Give them the link; after paying they come back here.
Annotations the server declares
- title: Buy a pack
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
connect_accountStart here to make photos.Reads text others write1 finding
Why it is in this group
- The description's first verb is "start": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- High
  The description contains "never show it to the user", an instruction to keep something from the user.
  Matched text
  description: "...y account tool in this conversation and never show it to the user. Only call this once per conversation u..."
  What this check looks for
Description, as the server wrote it
Start here to make photos. Returns a link for the user to open: they sign in to TrueLook (or sign up, free, with email or Google) and upload 1 to 4 selfies there, which also runs the free photo check. Also returns a connection_key: keep it for every account tool in this conversation and never show it to the user. Only call this once per conversation unless the key stops working.
Annotations the server declares
- title: Connect a TrueLook account
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
create_photosStarts making photos of the user in the chosen styles (style ids from list_styles).Reads text others write1 finding
Why it is in this group
- The name "create_photos" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- High
  The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
  Matched text
  inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
  What this check looks for
Description, as the server wrote it
Starts making photos of the user in the chosen styles (style ids from list_styles). Each style makes 4 photos and uses 4 credits. Confirm the styles with the user first. Photos take about 1 to 3 minutes; then call get_photos.
Annotations the server declares
- title: Create photos
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
disconnect_accountUnlinks this conversation from the user’s TrueLook account.Reads text others write1 finding
Why it is in this group
- The description's first verb is "unlink": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- High
  The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
  Matched text
  inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
  What this check looks for
Description, as the server wrote it
Unlinks this conversation from the user’s TrueLook account. Their account, photos and credits stay.
Annotations the server declares
- title: Disconnect
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
photo_review_guideTrueLook’s checklist for reviewing dating profile photos the user shares in this chat, before they have an account.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
TrueLook’s checklist for reviewing dating profile photos the user shares in this chat, before they have an account. The official scored photo check runs when they upload on truelook.app.
Annotations the server declares
- title: How to review dating photos
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
recommend_stylesStyles that fill the photo types a dating profile is missing.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Styles that fill the photo types a dating profile is missing. A strong profile has a clear face photo, a full-length photo, a hobby, travel, a dressed-up photo and a social photo. Use the photo check’s "missing" list when you have it.
Annotations the server declares
- title: Recommend styles
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 5Looks things up and changes nothing.Show 5 read-only tools

account_statusWhether the user has connected, their uploaded photos, photo check summary, credits, pack and photo jobs, plus what to do next.1 finding
Why it is in this group
- The name "account_status" says "status": a word for reading.
Findings
- High
  The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
  Matched text
  inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
  What this check looks for
Description, as the server wrote it
Whether the user has connected, their uploaded photos, photo check summary, credits, pack and photo jobs, plus what to do next.
Annotations the server declares
- title: Account status
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_photo_checkThe free TrueLook photo check of the selfies the user uploaded: overall score, potential, five category scores with findings, notes per photo and the photo types the profile is mis…Reads private data1 finding
Why it is in this group
- The name "get_photo_check" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "note": it reads notes.
Findings
- High
  The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
  Matched text
  inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
  What this check looks for
Description, as the server wrote it
The free TrueLook photo check of the selfies the user uploaded: overall score, potential, five category scores with findings, notes per photo and the photo types the profile is missing. Explain it to the user in plain words, then suggest styles for what is missing.
Annotations the server declares
- title: Photo check result
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_photosThe user’s generated photos (newest first) with view/download links valid for 7 days, and any photos still being made.1 finding
Why it is in this group
- The name "get_photos" says "get": a word for reading.
Findings
- High
  The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
  Matched text
  inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
  What this check looks for
Description, as the server wrote it
The user’s generated photos (newest first) with view/download links valid for 7 days, and any photos still being made. Set show to include up to 4 photos as images in the chat.
Annotations the server declares
- title: Get photos
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_pricingTrueLook packs and top-ups in USD.No findings
Why it is in this group
- The name "get_pricing" says "get": a word for reading.
Description, as the server wrote it
TrueLook packs and top-ups in USD. All one-time payments; nothing renews.
Annotations the server declares
- title: Pricing
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_stylesThe 62 photo styles (scenes) TrueLook can put the user in.No findings
Why it is in this group
- The name "list_styles" says "list": a word for reading.
Description, as the server wrote it
The 62 photo styles (scenes) TrueLook can put the user in. Filter by category, photo type or a word. Set show_previews to see example photos of each style.
Annotations the server declares
- title: List styles
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_photo_check
Reads text others write4: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; buy_pack
connect_account
create_photos
disconnect_account
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

7 high

Highconnect_account
The description contains "never show it to the user", an instruction to keep something from the user.
Matched text
description: "...y account tool in this conversation and never show it to the user. Only call this once per conversation u..."
What this check looks for
Highaccount_status
The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
Matched text
inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
What this check looks for
Highget_photo_check
The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
Matched text
inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
What this check looks for
Highbuy_pack
The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
Matched text
inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
What this check looks for
Highcreate_photos
The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
Matched text
inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
What this check looks for
Highget_photos
The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
Matched text
inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
What this check looks for

Show 1 more finding

Highdisconnect_account
The input schema at properties.connection_key.description contains "Never show it to the user", an instruction to keep something from the user.
Matched text
inputSchema.properties.connection_key.description: "...y connect_account in this conversation. Never show it to the user."
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 2.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http truelook https://truelook.app/mcp

claude mcp add --transport http truelook https://truelook.app/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__truelook__get_pricing",
      "mcp__truelook__list_styles",
      "mcp__truelook__account_status",
      "mcp__truelook__get_photo_check",
      "mcp__truelook__get_photos"
    ],
    "ask": [
      "mcp__truelook__about_truelook",
      "mcp__truelook__recommend_styles",
      "mcp__truelook__photo_review_guide",
      "mcp__truelook__connect_account",
      "mcp__truelook__buy_pack",
      "mcp__truelook__create_photos",
      "mcp__truelook__disconnect_account"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as truelook. Review it before you use it.

Capability tags behind 5 rules

mcp__truelook__connect_account untrusted-input
mcp__truelook__get_photo_check private-data
mcp__truelook__buy_pack untrusted-input
mcp__truelook__create_photos untrusted-input
mcp__truelook__disconnect_account untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/app.truelook/truelook/verify?hash=fe958e584cc087983d4fc01e03b6f7fb9174a127c870403790775eb19bf27724" | jq -e '.changed == false'

Pinned hash fe958e584cc0, from Nov 5, 2026, 09:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/app.truelook/truelook/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/app.truelook/truelook.svg)](https://anlyon.dev/servers/app.truelook/truelook)

Source: MCP Registry. Synced Nov 5, 2026, 09:17 UTC.