@vitra/image-creator-mcp

MCP server for the Vitra Image Creator agent surface. Drops into Claude Code, Cursor, Cline, or any other MCP-compatible runtime.

Spec: docs/superpowers/specs/2026-05-12-animoca-skill-pack-v4-canonical.md.

Install

# Most common — managed by the agent runtime.
npx -y @vitra/image-creator-mcp

# Or pin a version.
npx -y @vitra/[email protected]

Then add to your MCP client config (Claude Code example, ~/.config/claude/mcp.json):

{
  "mcpServers": {
    "vitra-image-creator": {
      "command": "npx",
      "args": ["-y", "@vitra/image-creator-mcp"],
      "env": {
        "VITRA_HMAC_SECRET": "vitra_sk_live_..."
      }
    }
  }
}

Credential

VITRA_HMAC_SECRET (env var) OR ~/.vitra/credentials.json (file mode 0600).

The MCP server uses the existing /api/embed/session HMAC flow — your vitra_sk_live_* secret is the HMAC shared secret, not a bearer token. Session JWTs are minted automatically and refreshed by the underlying SDK.

MR-1 status

Stub. The MCP server here is a placeholder with the package layout that subsequent MR-1 commits flesh out:

• src/server.ts — MCP server entrypoint (stdio transport).
• src/tools/ — one file per tool, depends on @vitra/image-creator-node/agent.
• src/bootstrap.ts — three-mode auto-update shim (notify/auto/off).
• bin/mcp-server.js — published shebang script that runs dist/server.js.

MR-1 ships the 6 brand-kit-lifecycle tools plus bootstrap. The other 20+ tools land per the v1 plan.

Auto-update

Default mode: notify for production credentials (CISO-friendly — prints a stderr notice when behind, never self-modifies). Tenants can opt in to auto (downloads and re-execs) via ~/.vitra/config.json. See spec §4.6.

License

(TBD — set during MR-12 GA cutover. Likely Apache-2.0 to match the rest of the @vitra/* SDK family.)