Designforyou Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Designforyou Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate logos, social posts, app-store screenshots, comic panels, and visual-novel assets from natural-language prompts — directly inside Claude Code, Grok, Codex, Cursor, OpenCode, ChatGPT, or any MCP client.
DesignForYou is an MCP-native design generator backed by 119 templates. Browse and recommend tools are free; generation is metered per user (50 free credits on sign-up).
DesignForYou demo — prompt to generated design
Describe what you want → the agent picks a template and generates a finished design. Logos, Instagram posts, app-store screenshots, and more.
| Website | https://designforyou.swapp1990.org |
| Connect (human) | https://designforyou.swapp1990.org/connect |
| Agent guide (plain text) | https://designforyou.swapp1990.org/.well-known/mcp/connect.md |
| MCP URL | https://designforyou.swapp1990.org/mcp/v2/ (trailing slash required) |
| Privacy | https://designforyou.swapp1990.org/privacy |
| Path | What you do | Who stores secrets |
|---|---|---|
| OAuth (primary) | Complete browser sign-in when the client prompts | The MCP client |
| Long-lived token (fallback) | Sign in on the website → Generate on /connect → DESIGNFORYOU_MCP_TOKEN | You (env / header) |
OAuth is the normal path. PAT minting is only for Codex, headless agents, or when OAuth stays “disabled / not connected.” Full recipes: CONNECT.md or the live well-known guide above.
claude mcp add --transport http designforyou https://designforyou.swapp1990.org/mcp/v2/
claude mcp login designforyouApprove the browser sign-in when prompted.
grok mcp add --transport http designforyou https://designforyou.swapp1990.org/mcp/v2/Then /mcps → designforyou → i (authorize) → browser → r.
Add a remote MCP entry for the URL above, then:
opencode mcp auth designforyou
opencode mcp listDESIGNFORYOU_MCP_TOKENcodex mcp add designforyou --url https://designforyou.swapp1990.org/mcp/v2/ --bearer-token-env-var DESIGNFORYOU_MCP_TOKENOr .cursor/mcp.json:
{
"mcpServers": {
"designforyou": {
"url": "https://designforyou.swapp1990.org/mcp/v2/",
"transport": "http"
}
}
}npx -y designforyou-mcpOr native HTTP in claude_desktop_config.json with the /mcp/v2/ URL. Complete OAuth when prompted.
The default command above always uses the hosted DesignForYou MCP server. To run the focused local image and reference-animation tools instead, explicitly opt in with an installed, signed-in Grok Build CLI:
$env:DESIGNFORYOU_PROVIDER = "grok-subscription"
npx -y designforyou-mcpThis sidecar invokes grok --single through the CLI's existing signed-in session; it never accepts or forwards an xAI API key, and it denies all MCP tools inside the spawned CLI so generation cannot route through a hosted billing server. Billing note: the Grok Build CLI's native media tools (image_gen, image_to_video) call the xAI API (api.x.ai) with the signed-in session token, so each generation meters the account's xAI console usage — media generation is not covered by the grok.com chat subscription. The sidecar exposes grok_generate_image and animate_reference_grok_video, and verifies the requested local output file before returning it. The hosted tools and their providers remain the default when the variable is unset. (The grok-subscription opt-in value is kept for compatibility with existing client configs.)
#### Use the sidecar from local Codex threads
Register the checked-out sidecar as a local stdio MCP server:
codex mcp add designforyou-grok-local `
--env DESIGNFORYOU_PROVIDER=grok-subscription `
-- node D:\MyProjects\Claude\designforyou-mcp\bin.js
codex mcp listRestart Codex or open a new local thread after adding the server. The thread can then generate a starting frame with grok_generate_image and pass that file to animate_reference_grok_video for an acting performance:
{
"image_path": "D:\\assets\\actor-scene.jpg",
"prompt": "She notices someone entering, freezes, then forces a nervous smile. Step backward slowly while maintaining eye contact. Use a subtle handheld push-in.",
"line": "I wasn't expecting you.",
"duration": 6,
"aspect_ratio": "16:9",
"output_path": "D:\\assets\\performance.mp4"
}The reference may be supplied as image_path, image_url, or image_data_url. This is a local-development path: the Codex host must be able to run the installed, signed-in grok executable. Codex cloud threads cannot use the machine's Grok login or local files. Use only trusted prompts because the sidecar runs Grok headlessly with automatic tool approval.
For video results, public_url is returned when Grok supplies a usable URL/key or when optional S3 correlation is configured. The sidecar brackets generation with S3 listings and accepts only one newly-created object whose key is absent from the baseline and whose byte size exactly matches the verified local MP4; it also checks HTTP accessibility. S3 settings can be supplied with DESIGNFORYOU_GROK_S3_BUCKET, DESIGNFORYOU_GROK_S3_REGION, DESIGNFORYOU_GROK_S3_ENDPOINT, and DESIGNFORYOU_GROK_S3_KEY_PREFIX, or discovered from the narrowly-scoped [tools.zdr_video_output_s3] and its .read_write credentials section in the local Grok config. Missing configuration, listing failures, ambiguous matches, and inaccessible objects leave the verified local success intact and include a diagnostic. Automatic correlation requires the AWS CLI on PATH and the local Grok S3 configuration. The configured identity also needs s3:ListBucket restricted to the configured key prefix; upload-only s3:PutObject credentials cannot perform safe correlation. Credentials are passed only to the AWS child process and are never printed or packaged. If listing is unavailable, generation still returns the verified local file with an explicit diagnostic.
| Tool | Cost | What it does |
|---|---|---|
browse_templates | free | Browse the 119-template catalog (filter by category) |
recommend_template | free | Recommend the best templates for a described use case |
get_text_fields | free | List a template's editable text fields |
get_credits | free | Check your credit balance |
generate | paid | Generate a finished design from a template + description |
generate_variations | paid | Generate style variations of a template |
edit_text | paid | Edit text on an existing design |
vn_generate_sprite_sheet | paid | Generate a visual-novel character sprite sheet |
DesignForYou exposes a remote MCP server (Streamable HTTP). On the first paid tool call (or when you run mcp login / mcp auth), your client discovers the OAuth flow (RFC 9728 protected-resource metadata → Supabase with Dynamic Client Registration), opens a browser for sign-in + consent, and stores tokens. Generation is metered against your credit balance; top up on the website.
This repository is the public home for install docs and the MCP server.json. The product itself is a hosted service — there is no self-host package.
org.swapp1990.designforyou/designforyou~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.