Higgsfield Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Higgsfield Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Higgsfield AI — generate images and videos with 16+ models through Claude, Cursor, or any MCP-compatible client.
| Model | ID | Key Features |
|---|---|---|
| Nano Banana 2 | nano-banana-2 | Fast, reference images (up to 16), 1k/2k/4k |
| Nano Banana 1 | nano-banana-1 | Reference images, multi-ref |
| Soul v2 | soul-v2 | Stylized, 720p/1080p/2k |
| OpenAI Hazel | openai-hazel | GPT-Image-1.5, low/medium/high/4k |
| Model | ID | Key Features |
|---|---|---|
| Kling 3.0 | kling3 | Best quality, start/end frames, sound, 720p/1080p, std/pro |
| Kling 3.0 Omni FLF | kling-o3-flf | First/last frame control |
| Kling 2.6 | kling2-6 | Balanced quality/cost |
| Kling 2.5 Turbo | kling2-5-turbo | Unlimited plan credits |
| Kling 2.1 | kling | Budget option |
| Grok Video | grok | xAI video model |
| Wan 2.6 | wan2-6 | Open-source model |
| Wan 2.5 | wan2-5-video | 16:9 or 9:16 only |
| Seedance 1.5 | seedance1-5 | ByteDance latest |
| Seedance Pro | seedance | ByteDance pro |
| Veo 3 | veo3 | Google DeepMind |
| Sora 2 | sora2-video | OpenAI, 4/8/12s durations |
| Image2Video | image2video | Requires input image |
| Tool | Description |
|---|---|
higgsfield_generate_image | Generate images (returns job_id) |
higgsfield_generate_video | Generate videos (returns job_id) |
higgsfield_wait_for_job | Poll job(s) until complete, return result URLs |
higgsfield_get_job | Check single job status (no polling) |
higgsfield_list_jobs | List recent jobs with status and URLs |
higgsfield_cancel_job | Cancel a running job |
higgsfield_check_cost | Dry-run cost estimate for image generation |
higgsfield_get_credits | Account balance and plan info |
higgsfield_list_models | List all models with supported parameters |
higgsfield_video_pricing | Static pricing reference |
higgsfield_browser_status | Check Helm daemon connection |
higgsfield_refresh_token | Manually set JWT token |
higgsfield_refresh_credentials | Update Clerk session cookies for auto-refresh |
CURL_IMPERSONATE_BIN env var if the binary isn't in PATH. Falls back to native fetch if not installed.# Clone
git clone https://github.com/jfikrat/higgsfield-mcp.git
cd higgsfield-mcp
# Install dependencies
bun install
# Run the server
bun run src/index.tsAdd to your MCP config (~/.claude/claude_desktop_config.json or MCP settings):
{
"mcpServers": {
"higgsfield": {
"command": "bun",
"args": ["run", "/path/to/higgsfield-mcp/src/index.ts"]
}
}
}The server authenticates via Clerk session tokens from your Higgsfield browser session. There are three methods (tried in order):
higgsfield_refresh_tokenFirst-time setup:
systemctl --user start helm-daemon)higgsfield_browser_status to verify the connectionIf auto-refresh stops working (tokens expire ~every 7 days):
clerk.higgsfield.ai domainhiggsfield_refresh_credentials with the cookie stringSettings are stored at ~/.config/higgsfield-mcp/settings.json (permissions: 600).
src/
├── index.ts # MCP server entry point
├── models.ts # Model metadata, validation, param builders
├── api.ts # HTTP client (GET/POST/DELETE)
├── auth.ts # Token management (Clerk refresh + browser fallback)
├── browser-post.ts # Helm daemon bridge for browser-based POST
├── curl-fetch.ts # curl-impersonate wrapper with native fallback
├── config.ts # Secure settings storage (~/.config/higgsfield-mcp/)
├── tracker.ts # Generation gallery tracker
└── tools/
├── account.ts # Account, credits, model listing tools
├── image.ts # Image generation tools
└── video.ts # Video generation + job polling toolsHiggsfield uses DataDome bot protection that blocks non-browser POST requests. This server handles it with a two-layer approach:
curl-impersonate (or native fetch as fallback) with browser-like TLS fingerprintsfetch() inside your actual Chrome tab on higgsfield.ai — DataDome sees a real browserMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.