by glifxyz
Deprecated — use the hosted Glif MCP server at https://glif.app/mcp
# Add to your Claude Code skills
git clone https://github.com/glifxyz/glif-mcp-serverGuides for using mcp servers skills like glif-mcp-server.
Last scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks \"alg\" (untrusted header.alg fallback)",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-05-30T16:16:41.731Z",
"npmAuditRan": true,
"pipAuditRan": true
}See how glif-mcp-server compares with popular alternatives.
glif-mcp-server is an open-source mcp servers skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by glifxyz. Deprecated — use the hosted Glif MCP server at https://glif.app/mcp. It has 209 GitHub stars.
glif-mcp-server returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/glifxyz/glif-mcp-server" and add it to your Claude Code skills directory (see the Installation section above).
Yes. SkillsLLM lists many other MCP Servers skills you can browse and compare side by side. Open the MCP Servers category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh glif-mcp-server against similar tools.
No comments yet. Be the first to share your thoughts!
Top skills in this category by stars
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Glif is a media-generation agent: generate images, video, and audio, transcribe, render HTML, search the web, run code, and chain multi-step media operations — from any MCP client.
https://glif.app/api/mcp (Streamable HTTP, JSON-RPC 2.0)This repo holds the registry metadata for the hosted server (see server.json); the server itself is part of the glif.app platform and is not open source.
[!NOTE] Looking for the old locally-run stdio server (npm
@glifxyz/glif-mcp-server)? It's deprecated — the code is parked on thelegacy-local-serverbranch.
compose_project does the work — describe what you want in plain language, including a whole series of variations, and Glif picks the models and chains the steps. It returns a job_id immediately; poll get_job_status for the media, which comes back as resource_link blocks pointing at CDN URLs. The rest are read and upload helpers. Call tools/list for the authoritative set, or see https://glif.app/mcp.
Generation spends credits from the signed-in Glif account; read-only tools are free. See https://glif.app/pricing.
Settings → Connectors → Add custom connector, paste:
https://glif.app/api/mcp
claude mcp add --scope user --transport http glif "https://glif.app/api/mcp"
Or add to .cursor/mcp.json:
{ "mcpServers": { "glif": { "url": "https://glif.app/api/mcp" } } }
code --add-mcp '{"name":"glif","type":"http","url":"https://glif.app/api/mcp"}'
Enable developer mode, then Settings → Apps & Connectors → Add new connector, paste https://glif.app/api/mcp, pick OAuth.
codex mcp add glif --url "https://glif.app/api/mcp"
codex mcp login glif
{ "mcpServers": { "glif": { "url": "https://glif.app/api/mcp", "transport": "http" } } }
Your client opens a browser OAuth sign-in on first connect — approve it to link your Glif account. More clients (Replit, Hermes, OpenClaw, LM Studio, …) with copy-paste snippets: https://glif.app/mcp
MIT - see LICENSE