Is Ludo AI Game Assets MCP server safe?

Findings (1)

• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool animateSprite: …Animate a static sprite into a spritesheet driven by a motion text prompt (image-to-spritesheet): supply an initial_image (URL or base64) plus a motion_prompt like "walking" or "attack slash", and optionally a final_image to interpolate between a start and end frame. Describe the motion exactly and unambiguously, but do not over-describe it: an action the model already knows is one phrase, not a sequence of steps, and the character, art style, background and camera come from the image, not the prompt. For animations driven by up to three keyframes (including a middle frame), use animateSpriteKeyframes instead. The job result is a single sprite result: `spritesheet_url` (the sheet image), `video_url` (an mp4 of the animation - pass it as `video` to transferMotion or as `spritesheet_video_url` to createSpriteAudio; editSpritesheet takes `spritesheet_url`), `num_frames`/`num_cols`/`num_rows` (the grid layout), and, when requested, `gif_url`, `individual_frame_urls` and `spritesheet_with_background_url`. The hydra model also returns `audio_url`, a sound effect for the animation - there is no need to call createSpriteAudio afterwards; forge and forge-pixel produce no audio. The chosen model must support sprite animation and the duration must be valid for it; incompatible model/duration combinations return HTTP 400. Credits are held when the job is accepted; the final charge is max(rate × produced seconds, the model's minimum charge), never more than for the duration you requested, and the difference (or everything, if the job fails or is cancelled) is refunded. Choosing a tool: animateSprite (this one) when you can describe the motion in text; transferMotion when you want an exact motion copied from a reference video or one of the named presets from listAnimationPresets (e.g. a standard walk or attack cycle); generatePose first when the source image is not yet in the pose the animation should start from. Omit `model` to run on hydra (the default) - see the `model` field for the per-model rates and the 4-credit minimum charge on forge/forge-pixel. Pass an optional request_id to tag the result so you can locate it later via listGenerations (type spritesheet). Async generation job: returns `{id, status}` - poll `getApiJob` (job and credit contract: see the server instructions). Credits: credits/s × seconds, per model: Hydra 3/s (shortest duration 3s, so 9 credits minimum), Forge 1.5/s (min charge 4 credits), Forge Pixel 1.5/s (min charge 4 credits), Blitz 1.9/s (min charge 4 credits) [LEGACY], Eagle 2.6/s (min charge 4 credits) [LEGACY], Eagle with Audio 3.1/s (min charge 4 credits) [LEGACY]; [LEGACY] models are scheduled for removal - do not use them for new work; see this endpoint's full pricing table in the API docs.…