Met Museum MCP integration to discover the art collection at The Metropolitan Museum of Art in New York
SaferSkills independently audited Metmuseum Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that provides access to the Metropolitan Museum of Art Collection through natural language interactions. This server allows AI models to search The Met's art collection and retrieve artwork details (including images) via tool results.
<a href="https://glama.ai/mcp/servers/@mikechao/metmuseum-mcp"><img width="380" height="200" src="https://glama.ai/mcp/servers/@mikechao/metmuseum-mcp/badge" alt="Met Museum MCP Server" /></a>
A hosted deployment is available on Fronteir AI.
This server provides AI models the following tools to interact with the art collection of The Met:
Lists all the valid departments at The Met
Department ID: 1, Display Name: American Decorative Arts
Department ID: 3, Display Name: Ancient Near Eastern Art
...Search for various objects in The Met based on the inputs.
q (string): The search term e.g. sunflowershasImages (boolean, optional, default: false): Only search for objects with imagestitle (boolean, optional, default: false): Returns objects that match the query, specifically searching against the title field for objects.departmentId (number, optional): Returns objects that are a part of a specific department.page (number, optional, default: 1): 1-based page number for results.pageSize (number, optional, default: 24): Number of Object IDs per page (max 100). Total objects found: 54
Page: 1/3
Object IDs: 436532, 789578, 436840, 438722,...Get a specific object from The Met containing all open access data about that object, including its image (if the image is available under Open Access).
If there is an image and returnImage is true, it is returned as an image content block in the tool result (base64-encoded JPEG).
Use this tool when the user asks for deeper details on a specific artwork and you already have an objectId.
objectId (number): The id of the object to retrievereturnImage (boolean, optional, default: true): Whether to include the object's image (if available) in the tool result Title: Self-Portrait with a Straw Hat (obverse: The Potato Peeler)
Artist: Vincent van Gogh
Artist Bio: Dutch, Zundert 1853–1890 Auvers-sur-Oise
Department: European Paintings
Credit Line: Bequest of Miss Adelaide Milton de Groot (1876-1967), 1967
Medium: Oil on canvas
Dimensions: 16 x 12 1/2 in. (40.6 x 31.8 cm)
Primary Image URL: https://images.metmuseum.org/CRDImages/ep/original/DT1502_cropped2.jpg
Tags: Men, Self-portraitsIf returnImage is true
**base64 encoding of jpeg image**Launches an interactive MCP App (ui://met/explorer.html) that can search, filter, and inspect objects from within MCP clients that support Apps.
Recommended flow:
open-met-explorer to launch and browse live search results (pass q to start searching immediately).get-museum-object only for items the user wants to explore in depth.q (string): Initial search term.hasImages (boolean, default: true): Prefer objects with images.title (boolean, default: false): Search titles only.departmentId (number): Pre-select a department filter. Opens the Met Explorer app in the client UI.<p align="center"> <a href="https://www.youtube.com/watch?v=kFxVjg-TYhM"> <img src="https://img.youtube.com/vi/kFxVjg-TYhM/maxresdefault.jpg" alt="Watch the demo" width="80%"> </a> <br> <a href="https://www.youtube.com/watch?v=kFxVjg-TYhM"><em>▶️ Click to watch the demo video</em></a> </p>
There are now MCP Apps in this MCP Server. There is a UI component for the Open Met Explorer App tool and the Get Museum Object tool.
Run the server directly with npx — no install required:
npx -y metmuseum-mcpThis starts the server using stdio transport, which is what most MCP desktop clients expect.
For client-specific setup, see:
The following environment variable applies to all transports:
| Variable | Default | Description |
|---|---|---|
MET_API_TIMEOUT_MS | 10000 | Timeout in milliseconds for outbound requests to the Met Collection API. |
MET_API_DEBUG | false | Enables debug logging to stderr for schema validation failures (accepted truthy values: 1, true, yes, on). |
This server supports two transports:
--http to expose an MCP endpoint at /mcp.Run with npx (recommended for end users):
npx -y metmuseum-mcp --httpOr run from a local clone:
pnpm run build
node dist/index.js --httpThe server listens on:
http://localhost:3001/mcpYou can control HTTP server behavior with environment variables:
| Variable | Default | Description |
|---|---|---|
PORT | 3001 | HTTP port used by the Streamable HTTP server. |
HOST | 127.0.0.1 | Network interface the HTTP server binds to. |
ALLOWED_HOSTS | localhost,127.0.0.1 | Comma-separated host allowlist for host header validation (example: localhost,127.0.0.1,my-domain.com). |
Example:
HOST=127.0.0.1 PORT=8080 ALLOWED_HOSTS=localhost,127.0.0.1 npx -y metmuseum-mcp --httpThe following steps allow you to use Met Museum MCP with the web UI of ChatGPT
Settings → Apps → Advanced settings → Developer mode
Additional instructions here
npx -y metmuseum-mcp --httpBy default the server will be listening on http://127.0.0.1:3001/mcp
Sign up and configure ngrok, the free plan works.
ngrok http http://127.0.0.1:3001 --host-header=rewriteTake note of the forwarding URL.
...
Forwarding https://john-joe-asdf.ngrok-free.dev -> http://localhost:3001
...Click Apps
Click Create Apps
Fill out the form using the URL from step 3 as the MCP Server URL, but add /mcp.
https://john-joe-asdf.ngrok-free.dev/mcpFor Authentication, select 'No Auth'
Tick the checkbox for 'I understand and want to continue'
Then click Create.
In the prompt input field you can use @name-of-server-from-step3 or In the ChatGPT UI, click the '+' button, scroll to '...more', select the newly created Met app, and enter your query.
mcpb file from the Releasesor Go to File -> Settings -> Extensions and drag the .mcpb file to the window to install it
Add this to your claude_desktop_config.json:
{
"mcpServers": {
"met-museum": {
"command": "npx",
"args": [
"-y",
"metmuseum-mcp"
]
}
}
}Add the following in your librechat.yaml
mcpServers:
metmuseum:
command: npx
args:
- -y
- metmuseum-mcpHere are some questions you can ask the AI model when this server is connected:
Can you help me explore the works of Vincent Van Gogh?
Can you help me explore the Met?
Can you show me a few paintings from the Asian Art department?
Can you find the painting titled "Corridor in the Asylum"?
Can you find any art that has "cat" in the title or features "cats"?This project uses pnpm for local development and CI.
corepack enable
pnpm install
pnpm run build
pnpm run checkFor non-interactive shells/CI runners, use CI=true pnpm install --frozen-lockfile.
Contributions are welcome! Please feel free to submit a Pull Request.
This MCP server is licensed under the MIT License. This means you are free to use, modify, and distribute the software, subject to the terms and conditions of the MIT License. For more details, please see the LICENSE file in the project repository.
This library is not officially associated with The Metropolitan Museum of Art in New York. It is a third-party implementation of the The Metropolitan Museum of Art Collection API with a MCP Server.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.