MCP server that generates images with the Codex CLI, so Claude Design and other MCP clients can use a ChatGPT subscription instead of paying per image for the OpenAI API
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport streamable-http · http counts 5 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
cancel_image_job
-
create_image
-
edit_image
-
get_artifact
-
get_image_job
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit f5a990c · analyzer v33 · 4d ago
danger signals1
- credential in logs credential in log tinyorbitvn-codex-imagegen-mcp-f5a990c/packages/contracts/tests/logger.test.ts :93
log.info("thử", { client_secret: "không-được-lộ" });
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 33
filesystem 7
- fs tinyorbitvn-codex-imagegen-mcp-f5a990c/packages/artifact-storage/src/s3.ts :10
import { readFile } from "node:fs/promises"; - fs tinyorbitvn-codex-imagegen-mcp-f5a990c/services/codex-image-worker/src/consumer.ts :7
import { mkdir, writeFile, rm, access, readdir, stat, copyFile } from "node:fs/promises"; - fs tinyorbitvn-codex-imagegen-mcp-f5a990c/services/codex-image-worker/src/imagesize.ts :12
import { open } from "node:fs/promises"; - fs tinyorbitvn-codex-imagegen-mcp-f5a990c/services/codex-image-worker/src/index.ts :7
import { access, constants, mkdir } from "node:fs/promises"; - fs tinyorbitvn-codex-imagegen-mcp-f5a990c/services/codex-image-worker/src/runner.ts :22
import { access, constants } from "node:fs/promises"; - fs (weak) tinyorbitvn-codex-imagegen-mcp-f5a990c/services/codex-image-worker/tests/consumer.test.ts :9
import { mkdtemp, rm, writeFile, readdir, readFile, mkdir, utimes } from "node:fs/promises"; - fs (weak) tinyorbitvn-codex-imagegen-mcp-f5a990c/services/codex-image-worker/tests/imagesize.test.ts :9
import { mkdtemp, rm, writeFile } from "node:fs/promises";
shell / exec 1
- shell tinyorbitvn-codex-imagegen-mcp-f5a990c/services/codex-image-worker/src/runner.ts :21
import { spawn } from "node:child_process";
database 1
- db tinyorbitvn-codex-imagegen-mcp-f5a990c/packages/job-queue/src/redis.ts :18
import { Redis } from "ioredis";
tool registrations 5
- create_image tinyorbitvn-codex-imagegen-mcp-f5a990c/services/imagegen-mcp/src/index.ts :178
- get_image_job tinyorbitvn-codex-imagegen-mcp-f5a990c/services/imagegen-mcp/src/index.ts :208
- edit_image tinyorbitvn-codex-imagegen-mcp-f5a990c/services/imagegen-mcp/src/index.ts :226
- get_artifact tinyorbitvn-codex-imagegen-mcp-f5a990c/services/imagegen-mcp/src/index.ts :247
- cancel_image_job tinyorbitvn-codex-imagegen-mcp-f5a990c/services/imagegen-mcp/src/index.ts :263
declared dependencies 3
- @types/node@^22.10.0
- typescript@^5.9.0
- @types/express@^4.17.21