Media Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Media Mcp (Agent Skill) and scored it 83/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 4 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 4 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for AI-powered media generation using Google Gemini. Generate images, videos, music, and speech directly from your AI agent.
uvx media-mcppip install media-mcpSet your Gemini API key as an environment variable:
export GEMINI_API_KEY="your-gemini-api-key"| Variable | Required | Description |
|---|---|---|
GEMINI_API_KEY | Yes | Google Gemini API key for authentication |
MEDIA_OUTPUT_DIR | No | Directory path for saving generated media files (see below) |
When MEDIA_OUTPUT_DIR is set, every generated file is saved to that directory and the tool returns only the file path — no binary data is included in the response. This is the recommended setup because MCP messages are stored in the conversation history, and large base64 payloads pollute context and waste tokens.
When MEDIA_OUTPUT_DIR is not set, the server has no filesystem target, so it returns the raw base64-encoded data directly in the response. This works for quick experiments but is not recommended for production use.
Add to your claude_desktop_config.json:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"media-mcp": {
"command": "uvx",
"args": ["media-mcp"],
"env": {
"GEMINI_API_KEY": "your-gemini-api-key",
"MEDIA_OUTPUT_DIR": "/path/to/media/output"
}
}
}
}claude mcp add media-mcp --transport stdio -- uvx media-mcpOr add manually to .mcp.json:
{
"mcpServers": {
"media-mcp": {
"type": "stdio",
"command": "uvx",
"args": ["media-mcp"],
"env": {
"GEMINI_API_KEY": "${GEMINI_API_KEY}",
"MEDIA_OUTPUT_DIR": "/path/to/media/output"
}
}
}
}generate_imageGenerate or edit images using Gemini's Nano Banana models.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
prompt | string | Yes | — | Text description of the image to generate |
model | enum | No | nano-banana-2 | nano-banana-2, nano-banana-pro, nano-banana |
aspect_ratio | enum | No | 1:1 | 1:1, 9:16, 16:9, 3:2, 4:3, and more |
image_size | enum | No | 1K | 512px, 1K, 2K, 4K |
reference_images | list[str] | No | — | Base64-encoded reference images |
thinking_level | enum | No | minimal | minimal, high |
use_google_search | bool | No | false | Enable Google Search grounding |
Example prompt: "A watercolor painting of a cozy cabin in the mountains during autumn"
generate_videoGenerate videos with native audio using Veo models.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
prompt | string | Yes | — | Text description including dialogue, sound effects, camera directions |
model | enum | No | veo-3.1 | veo-3.1, veo-3 |
aspect_ratio | enum | No | 16:9 | 16:9 (landscape), 9:16 (portrait) |
resolution | enum | No | — | 720p, 1080p, 4K |
first_frame_image | str | No | — | Base64-encoded image for first frame |
last_frame_image | str | No | — | Base64-encoded image for last frame |
reference_images | list[str] | No | — | Up to 3 base64-encoded reference images |
Example prompt: "A slow dolly shot through a neon-lit alley at night, rain falling, 'Where are you going?' whispered softly, footsteps echoing"
generate_musicGenerate instrumental music using Lyria RealTime with weighted prompts.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
prompts | list[dict] | Yes | — | Weighted prompts, e.g. [{"text": "minimal techno", "weight": 1.0}] |
bpm | int | No | — | Tempo in beats per minute |
temperature | float | No | 1.0 | Randomness/creativity control |
scale | str | No | — | Musical scale constraint (e.g. C_MAJOR_A_MINOR) |
duration_seconds | int | No | 30 | Duration of the output clip |
Example prompts: [{"text": "Piano", "weight": 2.0}, {"text": "Meditation", "weight": 0.5}]
generate_speechConvert text to speech with voice and style control.
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
text | string | Yes | — | Text to speak. For multi-speaker, format as dialogue with speaker names. |
model | enum | No | flash-tts | flash-tts, pro-tts |
voice_name | str | No | — | Voice name: Kore, Puck, Charon, Fenrir, Aoede, Leda, Orus, Zephyr |
multi_speaker | bool | No | false | Enable multi-speaker mode |
speakers | list[dict] | No | — | Speaker-to-voice mapping, e.g. [{"name": "Alice", "voice_name": "Kore"}] |
style_instructions | str | No | — | Style guidance, e.g. "Read in a calm, slow pace" |
Example: Text: "Welcome to the show!" with voice_name: "Kore" and style_instructions: "Say cheerfully"
Set the environment variable before starting the server:
export GEMINI_API_KEY="your-key-here"When using Claude Desktop or Claude Code, pass the key via the env block in your MCP configuration (see MCP Client Setup).
Your API key may be invalid or expired. Verify it at Google AI Studio.
Wait a moment and retry. Check your API quota at Google AI Studio.
Modify your prompt to avoid restricted content. The Gemini API applies safety filters to all generated media.
media-mcp requires Python 3.10 or later. Check your version:
python --versionMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.