Skip to content

snapWONDERS Vaultify

by snapwonders.com · remote · no sign-in to list tools · v1.0.0 · published by com.snapwonders

Hosted snapWONDERS MCP: hide files in images, reveal hidden content, analyse media, convert formats

Changes · 9
CompareRegistry entry

19 tools: 9 change things and 10 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http snapwonders https://snapwonders.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

19 tools

Changes things 9Claude Code: ask
  • snapwonders_analyse_job_startSubmits analysis options and queues a forensic analysis job.No findings

    Why it is in this group

    • The name "snapwonders_analyse_job_start" says "analyse": a word for reading.
    • The description's first verb is "submit": a word for a change.
    Description, as the server wrote it
    Submits analysis options and queues a forensic analysis job. Returns upload_uid and job_uid. The call is idempotent. Requires X-Api-Key header.
  • snapwonders_analyse_session_createCreates an upload session for forensic media analysis.No findings

    Why it is in this group

    • The name "snapwonders_analyse_session_create" says "analyse": a word for reading.
    • The description's first verb is "create": a word for a change.
    Description, as the server wrote it
    Creates an upload session for forensic media analysis. Returns the upload_uid and upload instructions. Upload each file with a single POST /api/upload carrying the file as the request body; its response reports ready_for_job_start, so no separate verification call is needed before snapwonders_analyse_job_start. Direct upload accepts files up to max_upload_bytes (returned in this response, currently 95 MB); anything larger must use the resumable TUS endpoint at /api/tus. Requires X-Api-Key header.
  • snapwonders_convert_job_resultsReturns per-item conversion results with asset_id for each output file.No findings

    Why it is in this group

    • The name "snapwonders_convert_job_results" says "convert": a word for a change.
    Description, as the server wrote it
    Returns per-item conversion results with asset_id for each output file. Use the asset_id with GET /api/convert/download/{assetId} and the same X-Api-Key to download each file. Requires X-Api-Key header.
  • snapwonders_convert_job_startSubmits conversion options and queues a media conversion job.No findings

    Why it is in this group

    • The name "snapwonders_convert_job_start" says "convert": a word for a change.
    Description, as the server wrote it
    Submits conversion options and queues a media conversion job. Images and videos in the session are converted to the specified format. The call is idempotent. Requires X-Api-Key header.
  • snapwonders_convert_job_statusReturns the current status and per-item progress of a conversion job.No findings

    Why it is in this group

    • The name "snapwonders_convert_job_status" says "convert": a word for a change.
    Description, as the server wrote it
    Returns the current status and per-item progress of a conversion job. Poll until status is "completed", "partial", or "failed". Requires X-Api-Key header.
  • snapwonders_convert_session_createCreates an upload session for media conversion (images and videos).No findings

    Why it is in this group

    • The name "snapwonders_convert_session_create" says "convert": a word for a change.
    Description, as the server wrote it
    Creates an upload session for media conversion (images and videos). Returns the upload_uid and upload instructions. Upload each file with a single POST /api/upload carrying the file as the request body; its response reports ready_for_job_start, then call snapwonders_convert_job_start. Direct upload accepts files up to max_upload_bytes (returned in this response, currently 95 MB); anything larger must use the resumable TUS endpoint at /api/tus. Requires X-Api-Key header.
  • snapwonders_convert_session_filesLists all files uploaded to a convert session.No findings

    Why it is in this group

    • The name "snapwonders_convert_session_files" says "convert": a word for a change.
    Description, as the server wrote it
    Lists all files uploaded to a convert session. Verify all files show status "completed" before calling snapwonders_convert_job_start. Requires X-Api-Key header.
  • vaultify_job_startSubmits options and queues a hide or reveal job for a session whose files have all been uploaded.No findings

    Why it is in this group

    • The name "vaultify_job_start" says "start": a word for a change.
    Description, as the server wrote it
    Submits options and queues a hide or reveal job for a session whose files have all been uploaded. Hide jobs support the full set of encoding options; reveal jobs only use upload_uid, password, and expiry. The call is idempotent. Requires X-Api-Key header.
  • vaultify_session_createCreates an upload session for hide (conceal a file inside a cover image/video) or reveal (extract hidden content from a stego image/video) processing.No findings

    Why it is in this group

    • The name "vaultify_session_create" says "create": a word for a change.
    Description, as the server wrote it
    Creates an upload session for hide (conceal a file inside a cover image/video) or reveal (extract hidden content from a stego image/video) processing. Returns the upload_uid and upload instructions. Upload each file with a single POST /api/upload carrying the file as the request body (hide needs X-Upload-Step 1 for the secret and 2 for the cover); its response reports ready_for_job_start, so no separate verification call is needed. Direct upload accepts files up to max_upload_bytes (returned in this response, currently 95 MB); anything larger must use the resumable TUS endpoint at /api/tus. Requires X-Api-Key header.
Only reads 10Claude Code: allow
  • snapwonders_analyse_job_resultsReturns per-item forensic analysis results including overall_grade (A–F; the Authenticity grade — edited, generated or re-encoded), exposure_grade (A–F; what the file gives away — …Reads private dataNo findings

    Why it is in this group

    • The name "snapwonders_analyse_job_results" says "analyse": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "return" and "file": it reads files.
    Description, as the server wrote it
    Returns per-item forensic analysis results including overall_grade (A–F; the Authenticity grade — edited, generated or re-encoded), exposure_grade (A–F; what the file gives away — privacy and hidden data), face_count, text_region_count, and watermark_flagged. Returns job_uid which can be passed to snapwonders_analyse_result for the clean summary. Requires X-Api-Key header.
  • snapwonders_analyse_job_statusReturns the current status and per-item progress of an analysis job.No findings

    Why it is in this group

    • The name "snapwonders_analyse_job_status" says "analyse": a word for reading.
    Description, as the server wrote it
    Returns the current status and per-item progress of an analysis job. Poll until status is "completed", "partial", or "failed". Requires X-Api-Key header.
  • snapwonders_analyse_resultReturns clean forensic result JSON by job_uid — file names, grades (A–F), detection counts, and analysis asset IDs (face overlays, ELA maps, etc.).Reads private dataNo findings

    Why it is in this group

    • The name "snapwonders_analyse_result" says "analyse": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "return" and "file": it reads files.
    Description, as the server wrote it
    Returns clean forensic result JSON by job_uid — file names, grades (A–F), detection counts, and analysis asset IDs (face overlays, ELA maps, etc.). The job_uid is returned by snapwonders_analyse_job_start and snapwonders_analyse_job_results. Requires X-Api-Key header.
  • snapwonders_analyse_session_filesLists all files uploaded to an analyse session.Reads private dataNo findings

    Why it is in this group

    • The name "snapwonders_analyse_session_files" says "analyse": a word for reading.

    What it can reach

    • private-dataThe name "snapwonders_analyse_session_files" says "analyse" and "file": it reads files.
    • private-dataThe description's first sentence says "list" and "file": it reads files.
    Description, as the server wrote it
    Lists all files uploaded to an analyse session. Verify all files show status "completed" before calling snapwonders_analyse_job_start. Requires X-Api-Key header.
  • snapwonders_get_startedIntroduction to snapWONDERS forensic analysis and media conversion: what each service does, pre-computed sample analyse and convert results showing the exact response schemas, and …No findings

    Why it is in this group

    • The name "snapwonders_get_started" says "get": a word for reading.
    Description, as the server wrote it
    Introduction to snapWONDERS forensic analysis and media conversion: what each service does, pre-computed sample analyse and convert results showing the exact response schemas, and guidance on creating a free account and API key. No API key required — call this first to understand the snapWONDERS analyse and convert workflows.
  • statusReturns the current health status of the Vaultify service.No findings

    Why it is in this group

    • The name "status" says "status": a word for reading.
    Description, as the server wrote it
    Returns the current health status of the Vaultify service. No API key required.
  • vaultify_get_startedIntroduction to snapWONDERS Vaultify steganography: what it does, how AES-256 + Argon2id + LSB embedding works, a pre-computed sample hide result showing the exact response schema,…No findings

    Why it is in this group

    • The name "vaultify_get_started" says "get": a word for reading.
    Description, as the server wrote it
    Introduction to snapWONDERS Vaultify steganography: what it does, how AES-256 + Argon2id + LSB embedding works, a pre-computed sample hide result showing the exact response schema, and guidance on creating a free account and API key to start using the API. No API key required — call this first to understand the Vaultify workflow.
  • vaultify_job_resultsReturns download info for all result files once a hide/reveal job is complete.Reads private dataNo findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "return" and "file": it reads files.
    Description, as the server wrote it
    Returns download info for all result files once a hide/reveal job is complete. result_files is empty while the job is still processing — poll vaultify_job_status first. Requires X-Api-Key header.
  • vaultify_job_statusReturns the current status and progress of a hide/reveal processing job.No findings

    Why it is in this group

    • The name "vaultify_job_status" says "status": a word for reading.
    Description, as the server wrote it
    Returns the current status and progress of a hide/reveal processing job. Poll until status is "completed" or "failed". Requires X-Api-Key header.
  • vaultify_session_filesLists all files currently uploaded for a stego session.Reads private dataNo findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.

    What it can reach

    • private-dataThe name "vaultify_session_files" says "file": it reads files.
    • private-dataThe description's first sentence says "list" and "file": it reads files.
    Description, as the server wrote it
    Lists all files currently uploaded for a stego session. Check that all files show status "completed" before calling vaultify_job_start. Requires X-Api-Key header.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.

Reads private data5
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:41 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
9
Protocol version
2025-03-26
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 9 tools that change things (9 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://snapwonders.com/mcp: tools/list returned 19 tools to an anonymous client, including vaultify_session_create (write), vaultify_job_start (write), snapwonders_analyse_session_create (write), snapwonders_analyse_job_start (write), snapwonders_convert_session_create (write) and 4 more

    What this check looks for

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http snapwonders https://snapwonders.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__snapwonders__status",
      "mcp__snapwonders__vaultify_get_started",
      "mcp__snapwonders__snapwonders_get_started",
      "mcp__snapwonders__vaultify_session_files",
      "mcp__snapwonders__vaultify_job_status",
      "mcp__snapwonders__vaultify_job_results",
      "mcp__snapwonders__snapwonders_analyse_session_files",
      "mcp__snapwonders__snapwonders_analyse_job_status",
      "mcp__snapwonders__snapwonders_analyse_job_results",
      "mcp__snapwonders__snapwonders_analyse_result"
    ],
    "ask": [
      "mcp__snapwonders__vaultify_session_create",
      "mcp__snapwonders__vaultify_job_start",
      "mcp__snapwonders__snapwonders_analyse_session_create",
      "mcp__snapwonders__snapwonders_analyse_job_start",
      "mcp__snapwonders__snapwonders_convert_session_create",
      "mcp__snapwonders__snapwonders_convert_session_files",
      "mcp__snapwonders__snapwonders_convert_job_start",
      "mcp__snapwonders__snapwonders_convert_job_status",
      "mcp__snapwonders__snapwonders_convert_job_results"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as snapwonders. Review it before you use it.

Capability tags behind 5 rules
  • mcp__snapwonders__vaultify_session_files private-data
  • mcp__snapwonders__vaultify_job_results private-data
  • mcp__snapwonders__snapwonders_analyse_session_files private-data
  • mcp__snapwonders__snapwonders_analyse_job_results private-data
  • mcp__snapwonders__snapwonders_analyse_result private-data