Maintainer of this skill?
by glifxyz
Glif's hosted MCP server, plugin and skills for creating images, video and audio. Works with Claude, ChatGPT, Codex, Cursor and more.
# Add to your Claude Code skills
git clone https://github.com/glifxyz/glif-mcp-serverGuides for using ai agents skills like glif-mcp-server.
Last scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks \"alg\" (untrusted header.alg fallback)",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-05-30T16:16:41.731Z",
"npmAuditRan": true,
"pipAuditRan": true
}See how glif-mcp-server compares with popular alternatives.
glif-mcp-server is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by glifxyz. Glif's hosted MCP server, plugin and skills for creating images, video and audio. Works with Claude, ChatGPT, Codex, Cursor and more. It has 219 GitHub stars.
glif-mcp-server returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/glifxyz/glif-mcp-server" and add it to your Claude Code skills directory (see the Installation section above).
glif-mcp-server is primarily written in JavaScript. It is open-source under glifxyz on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh glif-mcp-server against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Glif is a creative agent. Describe what you want to make, and it picks the models and does the work across images, video and audio. It also transcribes, renders HTML, searches the web, runs code and chains multi-step media jobs.
https://glif.app/api/mcp (Streamable HTTP, JSON-RPC 2.0)glif_v1_... API key from glif.app/settings/api-tokens as a bearer token.This repo holds three things:
skills/.server.json). The server itself runs on glif.app and is not open source.[!NOTE] Looking for the old locally run stdio server (npm
@glifxyz/glif-mcp-server)? It's deprecated. The code is parked on thelegacy-local-serverbranch.
The plugin adds the Glif server plus the skills below. Your client opens a browser sign-in the first time it connects.
claude plugin marketplace add glifxyz/glif-mcp-server
claude plugin install glif@glif
In a session, /plugin marketplace add glifxyz/glif-mcp-server then /plugin install glif@glif does the same. Run /mcp to sign in.
Customize → Plugins → Add marketplace, then enter glifxyz/glif-mcp-server. To add only the server, go to Settings → Connectors → Add custom connector and paste https://glif.app/api/mcp.
codex plugin marketplace add glifxyz/glif-mcp-server
codex plugin add glif@glif
codex mcp login glif
gemini extensions install https://github.com/glifxyz/glif-mcp-server
Any agent that reads Agent Skills can install them with skills.sh:
npx skills add glifxyz/glif-mcp-server
The skills need the Glif server connected too.
Or add to .cursor/mcp.json:
{ "mcpServers": { "glif": { "url": "https://glif.app/api/mcp" } } }
code --add-mcp '{"name":"glif","type":"http","url":"https://glif.app/api/mcp"}'
Turn on developer mode, then Settings → Apps & Connectors → Add new connector. Paste https://glif.app/api/mcp and pick OAuth.
claude mcp add --scope user --transport http glif https://glif.app/api/mcp
{ "mcpServers": { "glif": { "url": "https://glif.app/api/mcp", "transport": "http" } } }
More clients (Replit, Hermes, OpenClaw, LM Studio and others) have copy-paste snippets at https://glif.app/mcp.
| Skill | Use it to |
|---|---|
get-started |
Check the connected account and credits, and learn how projects work. Never generates. |
web-visuals |
Make hero images, textures, illustrations, OG images and background video for a site you're building, and wire them in. |
app-icons-and-logos |
Design a logo or app icon, then export the favicon set, PWA, iOS and Android sizes. |
app-promo-materials |
Turn real app screens into App Store screenshots and launch posts, or plan and make an ad campaign or product photo set. |
app-demo-videos |
Record the app with Playwright, then frame it in a video template with captions, voiceover and music. |
audio-and-video |
Make music, voiceover, sound effects and video clips from a brief or a reference file, or edit existing media. |
make-images |
Make new images from a brief, such as concept art or a series in different styles, and save them to a folder. |
edit-images |
Remove backgrounds, erase objects, expand, upscale, retouch or restyle an existing image, saved next to the original. |
game-assets |
Make character sheets, sprite sheets, seamless and PBR textures, 3D models and icons for a game. |
continue-project |
Reopen saved work and add variations or follow-ups to it. |
Skills spend credits only when you ask for media. If a visual was the agent's own idea, it asks first.
compose_project does the work. Describe what you want in plain language, including a whole series of variations. It returns a jobId and a projectUrl right away. Pass the jobId to get_job_status as job_id to follow the run and get the media links. The other tools read projects, reopen media, upload reference files and check your account. Call tools/list for the full set, or see https://glif.app/mcp.
Generation spends credits from the signed-in Glif account. Reading and browsing are free. See https://glif.app/pricing.
CI checks every manifest on each PR. To check locally:
claude plugin validate --strict .
for skill in skills/*/; do uvx --from skills-ref agentskills validate "$skill"; done
The plugin version lives in .claude-plugin/plugin.json, plugin.json and gemini-extension.json. Bump all three together; CI fails if they differ. Publish server.json to the MCP Registry by bumping its version and tagging v<version> (see publish.yml).
MIT. See LICENSE.