Back to Browse

Shotpipe MCP Server

Developer ToolsModerate7.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Screenshot any URL and see it, or mint a social card — hosted, SSRF-safe, cached. No Chrome to run.

About

Screenshot any URL and see it, or mint a social card — hosted, SSRF-safe, cached. No Chrome to run.

Security Report

7.2
Moderate7.2Low Risk

A well-designed MCP server for Shotpipe with solid architecture and proper security practices. Authentication is properly configured via environment variables, the signing mechanism correctly keeps secrets local, and permissions are appropriate for the stated purpose. Minor code quality observations noted but do not affect security posture. Supply chain analysis found 1 known vulnerability in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

5 files analyzed · 6 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

What You'll Need

Set these up before or after installing:

Shotpipe API key id (starts with k_). Free at https://shotpipe.io/signup.Optional

Environment variable: SHOTPIPE_KEY

Shotpipe HMAC signing secret. Requests are signed locally; the secret never leaves the process.Required

Environment variable: SHOTPIPE_SECRET

Override the API base URL for a self-hosted Shotpipe instance. Defaults to https://shotpipe.io.Optional

Environment variable: SHOTPIPE_BASE_URL

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-podop29-shotpipe-mcp": {
      "env": {
        "SHOTPIPE_KEY": "your-shotpipe-key-here",
        "SHOTPIPE_SECRET": "your-shotpipe-secret-here",
        "SHOTPIPE_BASE_URL": "your-shotpipe-base-url-here"
      },
      "args": [
        "-y",
        "shotpipe-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

shotpipe-mcp

Hosted, SSRF-safe, cached screenshots and Open Graph images for AI agents — no headless Chrome to run.

An MCP server that lets an agent screenshot any URL and see the result, or mint a social-card image, by calling Shotpipe. It's the thing a local browser tool can't be:

  • No Chrome in your agent's sandbox. Rendering happens on Shotpipe's infrastructure. Nothing to install, no memory to babysit, no OOM at 2am.
  • Safe on untrusted URLs. Agents point at URLs their users typed. Shotpipe resolves DNS itself, pins the IP, re-checks every redirect, and refuses private / loopback / cloud-metadata hosts — so a hostile link can't turn your renderer into an SSRF hole.
  • Cached. The first capture renders; every identical one after is served from the edge in milliseconds and costs nothing.

Ad and cookie-consent banners are stripped by default.

Install

// Claude Desktop (claude_desktop_config.json), Claude Code (.mcp.json),
// Cursor, Cline, or any MCP client:
{
  "mcpServers": {
    "shotpipe": {
      "command": "npx",
      "args": ["-y", "shotpipe-mcp"],
      "env": {
        "SHOTPIPE_KEY": "k_your_key",
        "SHOTPIPE_SECRET": "your_signing_secret"
      }
    }
  }
}

Get a free key at shotpipe.io/signup (no card) or run npx shotpipe-init. Self-hosting Shotpipe? Set SHOTPIPE_BASE_URL.

Tools

screenshot

Screenshot a URL and return the image (so the model can see it) plus a permanent, shareable signed URL.

url (required) · format png|jpeg|pdf · width · height · dpr · full_page · selector · dark · omit_background · block_ads · block_banners · wait_for · delay · quality · fresh

og_image

Build a signed social-card URL from a hosted template. Returns the URL only by default and renders nothing — the image renders lazily on the first crawler hit, so agent/build time stays fast. Drop it into <meta property="og:image">. Pass render: true to also get a preview image.

title (required) · template · author · tag · accent · logo · width · height · dpr · render

How it works

The signing secret never leaves the process — every request is HMAC-signed locally, exactly like Shotpipe's other clients. The server just builds a signed URL and (for screenshot) fetches the bytes.

MIT · shotpipe.io

Reviews

No reviews yet

Be the first to review this server!