runapi-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited runapi-mcp (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<h1 align="center">RunAPI MCP Server</h1>
<p align="center"> <strong>AI image generation, video generation, music creation, text-to-speech, prompt search, and model discovery — 130+ models from Flux, Kling, Seedance, Veo, Suno, ElevenLabs, Claude, GPT, Gemini, and 18 model families in one MCP server.</strong> </p>
<p align="center"> <sub>Works with Claude Code, Codex, Cursor, Windsurf, VS Code, Roo Code, and any MCP-compatible host.</sub> </p>
<p align="center"> <a href="https://www.npmjs.com/package/@runapi.ai/mcp"><img src="https://img.shields.io/npm/v/%40runapi.ai/mcp?style=flat-square&color=blue" alt="npm version"></a> <a href="LICENSE"><img src="https://img.shields.io/badge/License-Apache_2.0-blue?style=flat-square" alt="Apache-2.0 license"></a> <img src="https://img.shields.io/badge/Type-MCP_Server-blue?style=flat-square" alt="MCP Server"> <img src="https://img.shields.io/badge/Models-130+-green?style=flat-square" alt="130+ models"> </p>
<p align="center"> <a href="#quick-start">Quick Start</a> | <a href="#tools">Tools</a> | <a href="#examples">Examples</a> | <a href="#catalog-coverage">Catalog</a> | <a href="#platform-setup">Platforms</a> </p>
RunAPI MCP Server connects MCP-compatible coding tools to RunAPI. It lets an assistant browse the RunAPI catalog, inspect model inputs, check current pricing snapshots, create media tasks, poll task status, and check account balance.
The discovery tools work without an API key because they use the embedded build-time catalog. Authenticated operations require RUNAPI_API_KEY.
This package is a pure client. It does not run a local generation backend and does not require changes to your RunAPI account beyond creating an API key for authenticated tools.
For Claude Code, Cursor, Windsurf, and VS Code, install RunAPI with Claude Code's MCP command:
claude mcp add runapi -s user -- npx -y @runapi.ai/mcpThe scope flag controls where the MCP server is stored:
-s user: global, available in all projects for your user.-s project: team-shared, written to .mcp.json in the current repo so it can be committed.Use project scope when you want the whole team to share the same server config:
claude mcp add runapi -s project -- npx -y @runapi.ai/mcpCompatibility fallback for non-Claude Code platforms or manual JSON config:
{
"mcpServers": {
"runapi": {
"command": "npx",
"args": ["-y", "@runapi.ai/mcp"],
"env": {
"RUNAPI_API_KEY": "${RUNAPI_API_KEY}"
}
}
}
}If your host needs a generated config file, use the legacy init command as a fallback:
npx @runapi.ai/mcp init claude
npx @runapi.ai/mcp init cursor
npx @runapi.ai/mcp init vscode
npx @runapi.ai/mcp init windsurf
npx @runapi.ai/mcp init rooFree catalog tools work even when RUNAPI_API_KEY is not configured. For task creation and balance checks, create an API key in the RunAPI dashboard and expose it as RUNAPI_API_KEY.
| Tool | Auth | Purpose |
|---|---|---|
list_models | No | List RunAPI models from the embedded catalog. Supports modality, service, and action filters. |
get_model_info | No | Return service, action, modality, input constraints, and pricing snapshot for a model slug. Use service + action when a model appears in multiple endpoints. |
list_actions | No | Group endpoint action names by modality. |
check_pricing | No | Return pricing snapshot data for a service + action + model combination. |
search_prompts | No | Search reusable prompt examples by modality, category, tags, q, model, featured, and pagination. |
create_task | Yes | Create a media task and optionally poll until completion. |
get_task | Yes | Fetch status and latest payload for an existing media task. |
check_balance | Yes | Return account balance and spending metrics. |
The catalog, pricing, and prompt search tools are designed for funnel-top discovery inside coding tools. The task and balance tools are designed for authenticated workflows.
Ask your assistant natural-language questions. The assistant should use the tools to discover current model slugs and pricing instead of relying on memorized names.
What RunAPI image models are available?Expected behavior:
list_models with modality: "image".check_pricing.Find image prompt examples for a logo.Expected behavior:
search_prompts with modality: "image" and q: "logo".get_model_info before creating a task.Show me the required parameters for this model slug: <model-slug>Expected behavior:
get_model_info.get_model_info again with service and action.list_models if the slug is not found.Generate a square product image with RunAPI. Pick a suitable image model.Expected behavior:
list_models to choose a compatible image model.get_model_info with the selected service/action/model to validate parameters and any conditional input rules.create_task.Create the task but do not wait for completion.Expected behavior:
create_task with wait: false.get_task.Check my RunAPI balance.Expected behavior:
check_balance.RUNAPI_API_KEY.The embedded catalog is generated from RunAPI's contract snapshot. It includes media models, utility endpoints, and LLM model slugs for discovery.
| Modality | What To Use |
|---|---|
| Image | list_models with modality: "image" |
| Video | list_models with modality: "video" |
| Audio and music | list_models with modality: "audio" |
| LLM | list_models with modality: "llm" |
| Utility | list_models with modality: "utility" |
Catalog contents can change between releases. Use list_models for current service/action/model slugs and get_model_info for each model's current constraints. For LLM inference, connect through the RunAPI API or SDK directly.
RunAPI pricing is exposed through the check_pricing tool and the public pricing page. Do not rely on examples in README files for exact prices.
Useful flows:
list_models to find a candidate model.check_pricing with service, action, and model.Free catalog tools do not create tasks and do not consume account balance.
Run:
claude mcp add runapi -s user -- npx -y @runapi.ai/mcpUse -s user for a global install available in all projects. Use -s project when you want Claude Code to write .mcp.json in the repo for team-shared config.
Restart or reload your MCP host after changing MCP configuration.
Use init only when a host needs a platform-specific JSON file or cannot use the Claude Code MCP command.
Claude Code fallback:
npx @runapi.ai/mcp init claudeThis writes .mcp.json in the current directory.
Cursor fallback:
npx @runapi.ai/mcp init cursorThis writes .cursor/mcp.json. Open Cursor settings to verify the MCP server is enabled.
VS Code fallback:
npx @runapi.ai/mcp init vscodeThis writes .vscode/mcp.json. VS Code uses a top-level servers key and type: "stdio" in generated config.
Windsurf fallback:
npx @runapi.ai/mcp init windsurfThis writes the generated config for the Windsurf target used by the init command.
Run:
npx @runapi.ai/mcp init rooThis writes .roo/mcp.json.
Use the example files in examples/ as starting points. Each platform has slightly different wrapper keys and file paths, but all run the same command:
npx -y @runapi.ai/mcpThe server reads configuration in this order:
RUNAPI_API_KEY environment variable~/.config/runapi/config.jsonExample config file:
{
"apiKey": "your_runapi_key"
}You can also set a custom base URL for local testing:
{
"apiKey": "your_runapi_key",
"baseUrl": "https://runapi.ai"
}Do not commit real API keys.
This package ships build-time data files:
data/contract.json: catalog, actions, model slugs, and input constraintsdata/pricing.json: pricing snapshot used by check_pricingRefresh data from the RunAPI source tree before a release:
npm run sync:dataBuild-time data means a pricing or catalog update requires a new package release.
npm install
npm run typecheck
npm test
npm pack --dry-runRun the server locally:
npm run devManual initialize smoke test:
printf '%s\n' '{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"0.1.0"}},"id":1}' | npx tsx src/index.tsThe npm package includes:
dist/ filesdata/ filesIt does not include node_modules, .env, local config files, or API keys.
RunAPI also has a separate command-line client for terminal workflows. Use this MCP server when you want RunAPI available inside an MCP host. Use the CLI when you want direct shell commands, scripts, or CI integration.
Licensed under the Apache License, Version 2.0.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.