Imageat MCP server

@imageat/mcp

Model Context Protocol (MCP) server for ImageAT. Gives any MCP client (Claude Desktop, Cursor, etc.) tools to generate images, generate video, and run ImageAT's image-edit features — billed against your ImageAT account credits.

Tools

If the feature catalog can't be reached at startup, a single generic imageateditimage tool (taking a feature id parameter) is registered instead, so the server still works.

Setup

1. Create an API key on your ImageAT Projects page (starts with iatlive).
2. Add the server to your MCP client config:

{
  "mcpServers": {
    "imageat": {
      "command": "npx",
      "args": ["-y", "@imageat/mcp"],
      "env": {
        "IMAGEAT_API_KEY": "iat_live_xxxxxxxxxxxx"
      }
    }
  }
}

1. Restart the client. The imageat_* tools will be available.

Environment variables

Remote server (claude.ai, ChatGPT, other web clients)

The npx setup above is stdio — it works in desktop apps that launch a local process (Claude Desktop, Cursor, Claude Code). Browser clients like claude.ai and chatgpt.com instead connect to a remote MCP endpoint over Streamable HTTP.

The same tools are served over HTTP by dist/http.js. Each MCP session carries the user's own API key via the Authorization: Bearer iatlive... header (multi-user), so this is what you point a hosted connector at.

# Run the remote server locally against a local ImageAT instance:
IMAGEAT_BASE_URL=http://localhost:3000 PORT=8787 npm run start:http
# MCP endpoint: http://localhost:8787/mcp   ·   health: /health

Deploy it (e.g. on Dokploy as mcp.imageat.com) with the included Dockerfile, then add it as a custom connector:

• claude.ai — Settings → Connectors → Add custom connector → URL https://mcp.imageat.com/mcp.
• ChatGPT — Connectors / Developer mode → add server URL https://mcp.imageat.com/mcp.

Browser clients run the OAuth flow: after adding the connector they open a consent page served by this server where you paste your iatlive key, and the client receives a short-lived access token bound to it. Non-browser clients (mcp-remote, MCP Inspector, curl) can still send a raw iatlive key directly as Authorization: Bearer iatlive....

The OAuth layer (src/oauth.ts) is a minimal, stateless authorization server: it exposes the RFC 8414/9728 discovery docs, RFC 7591 dynamic client registration, and PKCE /authorize + /token. Access/refresh tokens are the API key encrypted (AES-256-GCM) under MCPOAUTHSECRET, so there is no session store.

Shortened. The full README is on GitHub.