by glifxyz
Deprecated — use the hosted Glif MCP server at https://glif.app/mcp
# Add to your Claude Code skills
git clone https://github.com/glifxyz/glif-mcp-serverGuides for using mcp servers skills like glif-mcp-server.
Last scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks \"alg\" (untrusted header.alg fallback)",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-05-30T16:16:41.731Z",
"npmAuditRan": true,
"pipAuditRan": true
}glif-mcp-server is an open-source mcp servers skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by glifxyz. Deprecated — use the hosted Glif MCP server at https://glif.app/mcp. It has 197 GitHub stars.
glif-mcp-server returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/glifxyz/glif-mcp-server" and add it to your Claude Code skills directory (see the Installation section above).
Yes. SkillsLLM lists many other MCP Servers skills you can browse and compare side by side. Open the MCP Servers category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh glif-mcp-server against similar tools.
No comments yet. Be the first to share your thoughts!
Top skills in this category by stars
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
Glif is a media-generation agent: generate images, video, and audio, transcribe, render HTML, search the web, run code, and chain multi-step media operations — from any MCP client.
https://glif.app/api/mcp (Streamable HTTP, JSON-RPC 2.0)This repo holds the registry metadata for the hosted server (see server.json); the server itself is part of the glif.app platform and is not open source.
[!NOTE] Looking for the old locally-run stdio server (npm
@glifxyz/glif-mcp-server)? It's deprecated — the code is parked on thelegacy-local-serverbranch.
compose_project does the work — describe what you want in plain language, including a whole series of variations, and Glif picks the models and chains the steps. It returns a job_id immediately; poll get_job_status for the media, which comes back as resource_link blocks pointing at CDN URLs. The rest are read and upload helpers. Call tools/list for the authoritative set, or see https://glif.app/mcp.
Generation spends credits from the signed-in Glif account; read-only tools are free. See https://glif.app/pricing.
Settings → Connectors → Add custom connector, paste:
https://glif.app/api/mcp
claude mcp add --scope user --transport http glif "https://glif.app/api/mcp"
Or add to .cursor/mcp.json:
{ "mcpServers": { "glif": { "url": "https://glif.app/api/mcp" } } }
code --add-mcp '{"name":"glif","type":"http","url":"https://glif.app/api/mcp"}'
Enable developer mode, then Settings → Apps & Connectors → Add new connector, paste https://glif.app/api/mcp, pick OAuth.
codex mcp add glif --url "https://glif.app/api/mcp"
codex mcp login glif
{ "mcpServers": { "glif": { "url": "https://glif.app/api/mcp", "transport": "http" } } }
Your client opens a browser OAuth sign-in on first connect — approve it to link your Glif account. More clients (Replit, Hermes, OpenClaw, LM Studio, …) with copy-paste snippets: https://glif.app/mcp
MIT - see LICENSE