Glyphs Info Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Glyphs Info Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 4 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 5 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
English | 繁體中文
## ⚠️ Maintenance Mode — New Users Please Use the Plugin
>
This MCP server is in maintenance mode as of 2026-05. The same Glyphs documentation and API queries are available as a faster, lighter Claude Code plugin: glyphs-reference.>
Why migrate? The plugin uses Claude's Skills system with progressive disclosure — token usage drops by ~98%, and queries feel instant compared to the MCP's eager-loaded approach. See Why Skills over MCP?
>
Existing users: This MCP will keep working. Bug fixes only, no new features. PyPI live for at least 12 months from this notice.
>
Migration steps →
A unified MCP server integrating Glyphs handbook queries and API reference lookups for Glyphs font design software.
#### Method 1: Using uvx (Recommended)
Step 1: Install uv
curl -LsSf https://astral.sh/uv/install.sh | shStep 2: Configure Claude Desktop
Edit ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"glyphs-info": {
"command": "uvx",
"args": ["glyphs-info-mcp"]
}
}
}Restart Claude Desktop and you're ready to go!
#### Method 2: Install from Source (Developers)
Prerequisites: uv installed (see Method 1 Step 1)
# Clone with submodules
git clone --recursive https://github.com/yintzuyuan/glyphs-info-mcp.git
cd glyphs-info-mcp
# Install dependencies
uv syncConfigure Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"glyphs-info-mcp": {
"command": "uv",
"args": [
"--directory",
"/Users/username/glyphs-info-mcp",
"run",
"glyphs-info-mcp"
]
}
}
}[!IMPORTANT] Replace /Users/username/glyphs-info-mcp with your actual absolute path.uv run glyphs-info-mcpYou should see:
✅ Glyphs info MCP Server initialized with 8 unified toolsMCP resources provide direct access to plugin development templates through Claude Desktop.
8 Python templates for converting scripts to plugins:
glyphs://plugin-template/filter_without_dialog - Filter without UIglyphs://plugin-template/filter_dialog_with_vanilla - Filter with Vanilla UIglyphs://plugin-template/filter_dialog_with_xib - Filter with XIB UIglyphs://plugin-template/reporter_without_dialog - Reporter pluginglyphs://plugin-template/palette_with_vanilla - Palette with Vanillaglyphs://plugin-template/general_without_dialog - General pluginglyphs://plugin-template/fileformat - File format pluginglyphs://plugin-template/selecttool - SelectTool plugin7 Xcode templates for native Objective-C plugin development:
glyphs://xcode-template/reporter - Reporter plugins (.glyphsReporter)glyphs://xcode-template/filter - Filter plugins (.glyphsFilter)glyphs://xcode-template/palette - Palette plugins (.glyphsPalette)glyphs://xcode-template/tool - Tool plugins (.glyphsTool)glyphs://xcode-template/file_format - File format pluginsglyphs://xcode-template/plugin - General pluginsglyphs://xcode-template/plugin_base - Base templateAccess Methods:
sdk(action='list_python_templates') and sdk(action='get_python_template', template_id='...')sdk(action='list_xcode_templates') and sdk(action='get_xcode_template', template_id='...')Placeholder Formats:
____PluginClassName____, ____PluginName____, ____PluginMenuName_______PACKAGENAMEASIDENTIFIER___, ___FILENAME___, ___PACKAGENAME___, ___FULLUSERNAME___6 complete Python plugin examples with source code:
glyphs://python-sample/callback_for_context_menu - Context menu callback exampleglyphs://python-sample/document_exported - Document export hookglyphs://python-sample/multipletools - Multiple tools in one pluginglyphs://python-sample/plugin_preferences - Plugin preferences handlingglyphs://python-sample/plugin_with_window - Plugin with custom windowglyphs://python-sample/smiley_panel_plugin - Panel plugin example4 complete Xcode/Objective-C plugin examples:
glyphs://xcode-sample/custom_parameter_ui - Custom parameter UIglyphs://xcode-sample/inspector_demo - Inspector panel demoglyphs://xcode-sample/photo_font - PhotoFont pluginglyphs://xcode-sample/plugin_with_window - Plugin with windowAccess Methods for Samples:
sdk(action='list_python_samples') and sdk(action='get_python_sample', sample_name='...')sdk(action='list_samples') and sdk(action='get_sample', sample_name='...')| Module | Out-of-box | Network | Glyphs Required |
|---|---|---|---|
| Handbook | ✅ | First cache build | - |
| API (Python) | ✅ | - | - |
| API (Obj-C Headers) | - | - | ✅ |
| SDK Documentation | ✅ | - | - |
| mekkablue Scripts | ✅ | - | - |
| Light Table API | ✅ | - | - |
| Vocabulary | - | - | ✅ |
| Plugins (Local) | - | - | ✅ |
| Plugins (Official) | - | ✅ | - |
| News/Tutorials | - | ✅ | - |
[!TIP] Out-of-box: Uses bundled GlyphsSDK submodule data, no extra setup needed. Network: Handbook only needs network for initial cache, then works offline. Glyphs Required: Reads from local Glyphs app (Headers from GlyphsCore.framework).
The server provides 8 unified tools with action-based routing, reducing context token cost by ~85%:
<details> <summary>Expand full tool list</summary>
#### handbook
| Action | Description |
|---|---|
search | Search handbook content |
get | Get chapter content by filename |
toc | Get table of contents |
children | Get chapter children |
parameter | Get custom parameter details |
list_parameters | List all custom parameters |
cache | Cache management (info/update) |
#### vocabulary
| Action | Description |
|---|---|
translate | Translate UI term |
search | Search UI terms |
mapping | Get multi-locale translations |
categories | List vocabulary categories |
#### api
| Action | Description |
|---|---|
search_python | Search Python API |
get_class | Get Python class info |
get_member | Get class member info |
search_objc | Search Obj-C headers |
get_header | Get Obj-C header content |
list_protocols | List plugin protocols |
get_protocol | Get protocol methods |
convert_objc | Convert Obj-C to Python name |
convert_python | Convert Python to Obj-C name |
identify_method | Identify method type |
get_template | Get method implementation template |
search_vanilla | Search Vanilla UI components |
get_vanilla | Get Vanilla UI component |
list_vanilla | List all Vanilla UI components |
hierarchy | Get class hierarchy |
relationships | Get class relationships |
navigate | Navigate class structure |
#### plugins
| Action | Description |
|---|---|
search_local | Search local plugins |
search_official | Search official registry |
get_info | Get plugin details |
scan | Scan repositories directory |
categories | List plugin categories |
#### scripts
| Action | Description |
|---|---|
search | Search scripts |
get | Get script details |
categories | List script categories |
list | List scripts in category |
#### sdk
| Action | Description |
|---|---|
search | Search SDK content |
get | Get SDK file content |
list_xcode_templates | List Xcode templates |
get_xcode_template | Get Xcode template |
list_python_templates | List Python templates |
get_python_template | Get Python template |
list_samples | List Xcode samples |
get_sample | Get Xcode sample |
list_python_samples | List Python samples |
get_python_sample | Get Python sample |
#### news
| Action | Description |
|---|---|
search_forum | Search forum discussions |
search_tutorials | Search tutorials |
fetch_tutorial | Fetch tutorial content |
fetch_forum | Fetch forum post |
search_posts | Search news posts |
fetch_content | Fetch news content |
#### lighttable
| Action | Description |
|---|---|
search | Search Light Table API |
get_enum | Get enum details |
list_enums | List all enums |
list_all | List all API items |
</details>
# Handbook queries
handbook(action="search", query="kerning")
handbook(action="get", filename="anchors.md")
# API queries
api(action="search_python", query="GSFont")
api(action="get_class", class_name="GSGlyph")
# UI terminology
vocabulary(action="translate", term="Cancel", target="zh-Hant")# Install development dependencies
uv sync --extra dev
# Install test dependencies
uv sync --extra testuv run black src/ tests/ # Formatting
uv run ruff check src/ --fix # Linting
uv run mypy src/ # Type checkinguv run pytest # All tests
uv run pytest tests/test_specific.py # Specific tests
uv run pytest --cov=src/glyphs_info_mcp # CoverageThis project was largely built using Vibe Coding iterative development, focusing on rapid feature implementation and practicality.
After testing, this project works best with Claude models. We recommend using it in the Claude Desktop environment for the best experience.
<details> <summary>Cannot find uv command</summary>
Restart your terminal, or run source ~/.zshrc
</details>
<details> <summary>Claude Desktop cannot load the MCP server</summary>
~)</details>
<details> <summary>Server fails to start</summary>
uv sync --reinstall
python --version # Requires 3.10+</details>
All paths are auto-detected. Only set these if using non-standard locations:
# export GLYPHS_APP_PATH=/Applications/Glyphs 3.app
# export GLYPHS_APP_HEADERS_PATH=/Applications/Glyphs\ 3.app/Contents/Frameworks/GlyphsCore.framework/Versions/A/Headers
# export GLYPHS_REPOSITORIES_PATH=~/Library/Application\ Support/Glyphs\ 3/RepositoriesOr use the env field in Claude Desktop configuration:
{
"mcpServers": {
"glyphs-info": {
"command": "uvx",
"args": ["glyphs-info-mcp"],
"env": {
"GLYPHS_APP_PATH": "/Applications/Glyphs 3.app"
}
}
}
}By default, all modules are enabled. To control specific modules, use environment variables:
Available modules: vocabulary, handbook, api, glyphs_plugins, glyphs_news, glyphs_sdk, light_table_api, mekkablue_scripts
Whitelist mode (enable only specified modules):
{
"mcpServers": {
"glyphs-info": {
"command": "uvx",
"args": ["glyphs-info-mcp"],
"env": {
"GLYPHS_ENABLED_MODULES": "handbook,api"
}
}
}
}Blacklist mode (disable specified modules):
{
"mcpServers": {
"glyphs-info": {
"command": "uvx",
"args": ["glyphs-info-mcp"],
"env": {
"GLYPHS_DISABLED_MODULES": "glyphs_news,glyphs_plugins"
}
}
}
}If both whitelist and blacklist are set, whitelist takes precedence.
MIT License - see LICENSE file.
Glyphs info MCP - Making Glyphs knowledge queries simple and powerful
Last updated: 2026-01-05
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.