Skip to content

io.github.pixelvault-dev/pixelvault

by pixelvault-dev · remote · no sign-in to list tools · v0.3.0 · published by GitHub user pixelvault-dev

Agent-first image hosting — upload images and get instant CDN URLs.

Deletes · 1Changes · 5
CompareRegistry entry

8 tools: 1 can delete or cancel things, 5 change things and 2 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http pixelvault https://mcp.pixelvault.dev/mcp --header 'Authorization: <your-authorization>'

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

8 tools

Deletes or cancels 1Claude Code: deny
  • delete_imagePermanently delete one PixelVault image by id.No findings

    Why it is in this group

    • The name "delete_image" says "delete": a word for removing or ending something.
    • The description says "Permanently delete".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Permanently delete one PixelVault image by id. Maps to DELETE /v1/images/:id. Requires a PixelVault API key sent as a Bearer token in the Authorization header.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
Changes things 5Claude Code: ask
  • rescue_imgurScan a web page for hotlinked Imgur images and return a PixelVault rescue URL for each — a proxy that lazily rehosts the image on first request, keeping it working through the UK I…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Scan a web page for hotlinked Imgur images and return a PixelVault rescue URL for each — a proxy that lazily rehosts the image on first request, keeping it working through the UK Imgur block. The anonymous rescue tier is a durable ~30-day edge cache (see `cache_ttl_days` in the result), not permanent storage. Maps to POST /v1/imgur-scan (server-side page fetch; no API key required). Provide `page_url` (a public https:// page). Drop each returned rescue_url into your HTML to rehost on first request.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • sign_urlMint a time-limited signed URL for a private image.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Mint a time-limited signed URL for a private image. Maps to POST /v1/images/:id/sign-url. Provide `id` and optional `expires_in` (seconds, default 3600). The signature binds the image, so the URL can't be replayed against another image; strip it and the CDN returns 403. Deleting the image revokes its URLs. Requires a PixelVault API key sent as a Bearer token in the Authorization header.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • transform_imageBuild an on-the-fly transform URL for a PixelVault image (resize, crop, format/quality, AI background removal, blur/sharpen/rotate/flip, brightness/contrast/saturation, and same-pr…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Build an on-the-fly transform URL for a PixelVault image (resize, crop, format/quality, AI background removal, blur/sharpen/rotate/flip, brightness/contrast/saturation, and same-project watermark tiling). Provide exactly one of `url` (a PixelVault CDN URL) or `id` (an image id, resolved via the API — requires an API key), plus one or more transform params. Returns the ready-to-use CDN URL; the transform is produced and cached on first request. See https://pixelvault.dev/docs#transforms.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • upload_batchUpload many images (1–50) in one call, grouped into a collection — e.g.No findings

    Why it is in this group

    • The name "upload_batch" says "upload": a word for a change.
    Description, as the server wrote it
    Upload many images (1–50) in one call, grouped into a collection — e.g. a CI run or a set of generated variants. Maps to POST /v1/images/batch. Each item is `data` (base64) or `source_url` (server-fetched, SSRF-guarded), with optional `filename`/`metadata`. Set `visibility: "private"` to get a signed URL per image (free plan: up to 100 private images) instead of a public CDN URL. Optional `type`/`name` (idempotent by (type, name)), `expires_in` (image TTL), `sign_expires_in` (signature lifetime), and collection `metadata`. Partial-failure tolerant: each returned item has its own `ok`. Requires a PixelVault API key sent as a Bearer token in the Authorization header. The returned CDN URL supports on-the-fly transforms via query params — e.g. ?w=400&fit=cover (resize/crop), ?fmt=webp (format), ?segment=foreground (AI background removal → transparent PNG), effects like ?blur=30&saturation=0&rotate=90, and ?tile=<image_id.ext> (tile another of your images as a watermark). Or call the transform_image tool to build a valid transform URL for you. See https://pixelvault.dev/docs#transforms.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • upload_imageUpload an image to PixelVault and get an instant CDN URL.No findings

    Why it is in this group

    • The name "upload_image" says "upload": a word for a change.
    Description, as the server wrote it
    Upload an image to PixelVault and get an instant CDN URL. Maps to POST /v1/images. Provide exactly one of `source_url` (a public http(s) URL the server fetches) or `data` (base64-encoded bytes); optional `folder`, `filename`, and `expires_in` (seconds, for an auto-expiring image). Max 5 MB; JPG/PNG/GIF/WebP/AVIF/SVG. Requires a PixelVault API key sent as a Bearer token in the Authorization header. The returned CDN URL supports on-the-fly transforms via query params — e.g. ?w=400&fit=cover (resize/crop), ?fmt=webp (format), ?segment=foreground (AI background removal → transparent PNG), effects like ?blur=30&saturation=0&rotate=90, and ?tile=<image_id.ext> (tile another of your images as a watermark). Or call the transform_image tool to build a valid transform URL for you. See https://pixelvault.dev/docs#transforms.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
Only reads 2Claude Code: allow
  • get_imageGet metadata (CDN URL, size, MIME type, dimensions) for one PixelVault image by id.No findings

    Why it is in this group

    • The name "get_image" says "get": a word for reading.
    Description, as the server wrote it
    Get metadata (CDN URL, size, MIME type, dimensions) for one PixelVault image by id. Maps to GET /v1/images/:id. Requires a PixelVault API key sent as a Bearer token in the Authorization header. The returned CDN URL supports on-the-fly transforms via query params — e.g. ?w=400&fit=cover (resize/crop), ?fmt=webp (format), ?segment=foreground (AI background removal → transparent PNG), effects like ?blur=30&saturation=0&rotate=90, and ?tile=<image_id.ext> (tile another of your images as a watermark). Or call the transform_image tool to build a valid transform URL for you. See https://pixelvault.dev/docs#transforms.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • list_imagesList images in your PixelVault project, most recent first.No findings

    Why it is in this group

    • The name "list_images" says "list": a word for reading.
    Description, as the server wrote it
    List images in your PixelVault project, most recent first. Maps to GET /v1/images with pagination. Requires a PixelVault API key sent as a Bearer token in the Authorization header. The returned CDN URL supports on-the-fly transforms via query params — e.g. ?w=400&fit=cover (resize/crop), ?fmt=webp (format), ?segment=foreground (AI background removal → transparent PNG), effects like ?blur=30&saturation=0&rotate=90, and ?tile=<image_id.ext> (tile another of your images as a watermark). Or call the transform_image tool to build a valid transform URL for you. See https://pixelvault.dev/docs#transforms.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.3.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http pixelvault https://mcp.pixelvault.dev/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__pixelvault__get_image",
      "mcp__pixelvault__list_images"
    ],
    "ask": [
      "mcp__pixelvault__upload_image",
      "mcp__pixelvault__upload_batch",
      "mcp__pixelvault__sign_url",
      "mcp__pixelvault__transform_image",
      "mcp__pixelvault__rescue_imgur"
    ],
    "deny": [
      "mcp__pixelvault__delete_image"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as pixelvault. Review it before you use it.