power-pruna — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited power-pruna (MCP Server) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Pruna AI — ultra-fast image generation, editing, upscaling, and video generation directly from your AI assistant.
Pruna AI is an inference API specialized in image and video generation. It offers sub-2-second image generation starting at $0.005/image, with models for text-to-image, image editing, upscaling, and video generation. This MCP server wraps their API so any MCP-compatible client (Claude Desktop, Kiro, Cursor) can generate visual content natively.
Conforms to MCP Specification 2025-11-25.
generate_image, edit_image, upscale_image, generate_video, list_models, upload_filepruna://models catalog for model discovery without tool callsImageContent blocks for clients that support inline display# With uvx (zero install)
uvx pruna-mcp-server
# Or with pip
pip install pruna-mcp-server
pruna-mcpSet your API key — get one at pruna.ai (go to the developer portal or contact Pruna to request access):
# macOS Keychain (recommended)
security add-generic-password -a $USER -s PRUNA_API_KEY -w "your-api-key"
# Linux (GNOME Keyring)
secret-tool store --label="Pruna API Key" service pruna-mcp-server key api_key <<< "your-api-key"
# Windows (PowerShell)
[System.Environment]::SetEnvironmentVariable("PRUNA_API_KEY", "your-api-key", "User")
# Or environment variable (all platforms)
export PRUNA_API_KEY="your-api-key"Add to your agent config (e.g. ~/.kiro/agents/default.json):
In mcpServers:
"pruna": {
"command": "sh",
"args": ["-c", "PRUNA_API_KEY=$(security find-generic-password -a $USER -s PRUNA_API_KEY -w) uv run --directory /path/to/pruna-mcp-server pruna-mcp"],
"autoApprove": ["generate_image", "edit_image", "upscale_image", "generate_video", "list_models", "upload_file"]
}In tools, add: "@pruna/*"
In allowedTools, add: "generate_image", "edit_image", "upscale_image", "generate_video", "list_models", "upload_file"
Note: Kiro agents use atoolswhitelist with@server-name/*syntax and anallowedToolslist. Both must include the Pruna tools for them to be available.
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS):
{
"mcpServers": {
"pruna": {
"command": "sh",
"args": ["-c", "PRUNA_API_KEY=$(security find-generic-password -a $USER -s PRUNA_API_KEY -w) /path/to/uv run --directory /path/to/pruna-mcp-server pruna-mcp"]
}
}
}Important: Use the full path touv(e.g./Users/you/.local/bin/uv) — Claude Desktop launches processes with a minimal PATH that doesn't include~/.local/bin.
Note: Claude Desktop does not render ImageContent inline in the chat. The image is generated and saved locally — Claude will reference the file path in its response.Add to .cursor/mcp.json:
{
"mcpServers": {
"pruna": {
"command": "uvx",
"args": ["pruna-mcp-server"],
"env": { "PRUNA_API_KEY": "your-api-key" }
}
}
}| Tool | Description | Pricing |
|---|---|---|
generate_image | Text-to-image with 10 models | From $0.0001/image |
edit_image | Edit 1-5 images with text instructions | From $0.010/image |
upscale_image | AI upscaling to 1-8 megapixels | From $0.005/image |
generate_video | Text/image/audio to video | From $0.005/s |
list_models | Browse all available models with pricing | Free |
upload_file | Upload files for editing/video workflows | Free |
Image tools return both a JSON metadata block and a native MCP ImageContent block (base64, for images < 5MB).
Built-in workflow templates for common use cases:
| Prompt | Use Case | Example |
|---|---|---|
product-photo | E-commerce product shots | "white leather sneakers on clean background" |
virtual-staging | Real estate room staging | Stage empty rooms with furniture |
social-media-visual | Platform-optimized visuals | Auto aspect ratio per platform |
game-concept-art | Game assets & environments | Characters, weapons, landscapes |
ad-creative | Digital ads with text overlay | Headlines rendered in the image |
video-ad | Short video ads | Talking heads, product demos |
image-enhance | Upscale + enhance workflow | AI-generated image refinement |
| Environment Variable | Required | Default | Description |
|---|---|---|---|
PRUNA_API_KEY | ✅ | — | Your Pruna AI API key |
PRUNA_OUTPUT_DIR | — | ./pruna-output | Directory for downloaded files |
PRUNA_POLL_INTERVAL | — | 2 | Seconds between async polls |
PRUNA_TIMEOUT | — | 120 | HTTP timeout in seconds |
PRUNA_MAX_RETRIES | — | 3 | Max retries on transient errors |
| Client | Transport | Status | Notes |
|---|---|---|---|
| Kiro CLI | STDIO | ✅ Tested | Requires tools + allowedTools config |
| Claude Desktop | STDIO | ✅ Tested | Use full path to uv; no inline image display |
| Cursor | STDIO | 🔲 Planned | — |
| Claude Code | STDIO | 🔲 Planned | — |
git clone https://github.com/charlesrapp/pruna-mcp-server.git
cd pruna-mcp-server
uv sync --extra dev
# Run tests (100 tests, 94% coverage)
uv run pytest --cov
# Lint & type check
uv run ruff check src/ tests/
uv run mypy src/See CONTRIBUTING.md for guidelines.
MIT — see LICENSE.
<!-- mcp-name: io.github.charlesrapp/pruna -->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.