Imageat MCP Server

@imageat/mcp

Model Context Protocol (MCP) server for ImageAT. Gives any MCP client (Claude Desktop, Cursor, etc.) tools to generate images, generate video, and run ImageAT's image-edit features — billed against your ImageAT account credits.

Tools

If the feature catalog can't be reached at startup, a single generic imageat_edit_image tool (taking a feature id parameter) is registered instead, so the server still works.

Setup

1. Create an API key on your ImageAT Projects page (starts with iat_live_).
2. Add the server to your MCP client config:

{
  "mcpServers": {
    "imageat": {
      "command": "npx",
      "args": ["-y", "@imageat/mcp"],
      "env": {
        "IMAGEAT_API_KEY": "iat_live_xxxxxxxxxxxx"
      }
    }
  }
}

1. Restart the client. The imageat_* tools will be available.

Environment variables

Remote server (claude.ai, ChatGPT, other web clients)

The npx setup above is stdio — it works in desktop apps that launch a local process (Claude Desktop, Cursor, Claude Code). Browser clients like claude.ai and chatgpt.com instead connect to a remote MCP endpoint over Streamable HTTP.

The same tools are served over HTTP by dist/http.js. Each MCP session carries the user's own API key via the Authorization: Bearer iat_live_... header (multi-user), so this is what you point a hosted connector at.

# Run the remote server locally against a local ImageAT instance:
IMAGEAT_BASE_URL=http://localhost:3000 PORT=8787 npm run start:http
# MCP endpoint: http://localhost:8787/mcp   ·   health: /health

Deploy it (e.g. on Dokploy as mcp.imageat.com) with the included Dockerfile, then add it as a custom connector:

• claude.ai — Settings → Connectors → Add custom connector → URL https://mcp.imageat.com/mcp.
• ChatGPT — Connectors / Developer mode → add server URL https://mcp.imageat.com/mcp.

Browser clients run the OAuth flow: after adding the connector they open a consent page served by this server where you paste your iat_live_ key, and the client receives a short-lived access token bound to it. Non-browser clients (mcp-remote, MCP Inspector, curl) can still send a raw iat_live_ key directly as Authorization: Bearer iat_live_....

The OAuth layer (src/oauth.ts) is a minimal, stateless authorization server: it exposes the RFC 8414/9728 discovery docs, RFC 7591 dynamic client registration, and PKCE /authorize + /token. Access/refresh tokens are the API key encrypted (AES-256-GCM) under MCP_OAUTH_SECRET, so there is no session store.

Local development

npm install
npm run build

# Inspect the stdio server with the official MCP Inspector against a local ImageAT instance:
IMAGEAT_API_KEY=iat_live_... IMAGEAT_BASE_URL=http://localhost:3000 \
  npx @modelcontextprotocol/inspector node dist/index.js

Auth roadmap

Today the server authenticates with a static iat_live_ API key (the remote server reads it per-session from the Authorization header). Auth is isolated behind an AuthProvider interface (src/auth.ts), so a future "Sign in with ImageAT" OAuth provider can be dropped in without changing the tools, the HTTP client, or the backend /v1 routes.