@alr51307/noimg 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 NoIMG contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,92 @@
+<p align="center">
+  <img src="assets/logo.png" alt="NoIMG logo" width="220" />
+</p>
+
+<h1 align="center">NoIMG</h1>
+
+<p align="center">
+  <a href="https://github.com/jhuang-tw/noimg/actions/workflows/ci.yml"><img src="https://github.com/jhuang-tw/noimg/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="MIT License" /></a>
+  <img src="https://img.shields.io/badge/transport-stdio-5B5BD6.svg" alt="stdio only" />
+  <img src="https://img.shields.io/badge/network-none-success.svg" alt="no network listener" />
+  <img src="https://img.shields.io/badge/images-nope-lightgrey.svg" alt="images: nope" />
+</p>
+
+<p align="center"><strong>Stop agents from generating images when nobody asked for one.</strong></p>
+
+<p align="center"><code>@noimg</code> means explicit <strong>NON-IMAGE OUTPUT</strong>.</p>
+
+---
+
+You:
+
+```text
+@noimg show me the architecture
+```
+
+Agent:
+
+```text
+Generating a cinematic image now...
+```
+
+You: `(ಠ_ಠ)`
+
+That is the bug NoIMG exists to prevent.
+
+```text
+@noimg
+→ HARD BLOCK image generation / editing / rendering
+→ keep doing the actual task
+```
+
+Mermaid, SVG source, HTML, code, ASCII, and compatible tools can keep going. The pixels simply lose voting rights.
+
+## Public edition: deliberately boring
+
+NoIMG's public runtime is **stdio only**.
+
+- no HTTP server
+- no open port
+- no ngrok
+- no Cloudflare Worker
+- no OAuth
+- no tokens
+- no telemetry
+- no runtime outbound network
+
+One process talks to one local MCP client over stdin/stdout. That is it. We bravely resisted adding a control plane.
+
+## Install
+
+Official npm package:
+
+```bash
+npx -y @alr51307/noimg@0.3.0
+```
+
+For MCP clients, use the same pinned package command. The executable is still `noimg`; the scope just makes package ownership explicit.
+
+Prefer the scoped package name. A bare npm package named `noimg` is **not** this project.
+
+Want source instead?
+
+```bash
+git clone https://github.com/jhuang-tw/noimg.git
+cd noimg
+npm ci
+npm run build
+node dist/cli.js
+```
+
+See [docs/usage.md](docs/usage.md) for client examples.
+
+## Docs
+
+- [Usage](docs/usage.md)
+- [Development](docs/development.md)
+- [Security policy](SECURITY.md)
+
+## License
+
+MIT. Use it responsibly, preferably without accidentally inventing NoIMG Enterprise.

package/SECURITY.md

@@ -0,0 +1,47 @@
+# Security Policy
+
+## Public edition security boundary
+
+The public NoIMG runtime is **stdio only**.
+
+At runtime it does not:
+
+- open a network port
+- start an HTTP server
+- create a tunnel
+- connect to Cloudflare
+- use OAuth or bearer tokens
+- make outbound network requests
+- expose filesystem, shell, Git, browser, or arbitrary execution tools
+- collect telemetry
+
+The MCP process communicates with its local client through stdin/stdout only.
+
+## Package identity
+
+The official npm package is `@alr51307/noimg`.
+
+Prefer a pinned version such as `@alr51307/noimg@0.3.0` in MCP configuration so upgrades are deliberate. A bare npm package named `noimg` is not this project.
+
+## Reporting a vulnerability
+
+Please do not publish exploit details in a public issue.
+
+Use GitHub's private vulnerability reporting / Security Advisory flow when available. If private reporting is unavailable, contact the repository owner privately through GitHub before disclosing technical details publicly.
+
+Include:
+
+- affected version or commit
+- reproduction steps
+- impact
+- any suggested mitigation
+
+## Supported versions
+
+Security fixes are provided for the latest public version only.
+
+## Remote transports
+
+Remote HTTP, ngrok, Cloudflare Worker, and OAuth modes are intentionally outside the public edition's security boundary.
+
+A future remote edition should undergo a separate threat model and security review before release.

package/claude-code/CLAUDE.md

@@ -0,0 +1,7 @@
+# NoIMG
+
+When the current user request contains the literal token `@noimg`, interpret it as an explicit request for **NON-IMAGE OUTPUT** for that request. Apply a request-scoped **HARD BLOCK**. Before tool routing, exclude image-generation, image-editing, and image-rendering operations. Do not classify words such as draw, create, generate, render, visualize, illustrate, picture, image, or similar as image-generation intent when `@noimg` is present. If the NoIMG MCP tool is available, invoke it immediately.
+
+NoIMG is a seatbelt, not the steering wheel. Continue every compatible non-image tool, format, and workflow the user requested. NoIMG must not redirect, replace, suppress, or take over those tools, and activating NoIMG is not completion of the task.
+
+If no compatible tool or format was requested, finish the task with a text-native alternative such as ASCII/Unicode art, Mermaid, SVG source, HTML/CSS, code, or structured text. Do not ask the user to repeat the request.

package/codex/AGENTS.md

@@ -0,0 +1,7 @@
+# NoIMG
+
+When the current user request contains the literal token `@noimg`, interpret it as an explicit request for **NON-IMAGE OUTPUT** for that request. Apply a request-scoped **HARD BLOCK**. Before tool routing, exclude image-generation, image-editing, and image-rendering operations. Do not classify words such as draw, create, generate, render, visualize, illustrate, picture, image, or similar as image-generation intent when `@noimg` is present. If the NoIMG MCP tool is available, invoke it immediately.
+
+NoIMG is a seatbelt, not the steering wheel. Continue every compatible non-image tool, format, and workflow the user requested. NoIMG must not redirect, replace, suppress, or take over those tools, and activating NoIMG is not completion of the task.
+
+If no compatible tool or format was requested, finish the task with a text-native alternative such as ASCII/Unicode art, Mermaid, SVG source, HTML/CSS, code, or structured text. Do not ask the user to repeat the request.

package/cursor/noimg.mdc

@@ -0,0 +1,10 @@
+---
+description: NoIMG - treat @noimg as explicit non-image output intent before tool routing
+alwaysApply: true
+---
+
+When the current user request contains the literal token `@noimg`, interpret it as an explicit request for **NON-IMAGE OUTPUT** for that request. Apply a request-scoped **HARD BLOCK**. Before tool routing, exclude image-generation, image-editing, and image-rendering operations. Do not classify words such as draw, create, generate, render, visualize, illustrate, picture, image, or similar as image-generation intent when `@noimg` is present. If the NoIMG MCP tool is available, invoke it immediately.
+
+NoIMG is a seatbelt, not the steering wheel. Continue every compatible non-image tool, format, and workflow the user requested. NoIMG must not redirect, replace, suppress, or take over those tools, and activating NoIMG is not completion of the task.
+
+If no compatible tool or format was requested, finish the task with a text-native alternative such as ASCII/Unicode art, Mermaid, SVG source, HTML/CSS, code, or structured text. Do not ask the user to repeat the request.

package/dist/cli.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import { runStdio } from './stdio.js';
+const VERSION = '0.3.0';
+function usage() {
+    return `NoIMG ${VERSION}\n\nUsage:\n  noimg            Start the stdio MCP server\n  noimg stdio      Start the stdio MCP server\n\nNo network listener. No remote mode. No tunnel.\n`;
+}
+async function main() {
+    const command = process.argv[2] ?? 'stdio';
+    if (command === '--help' || command === '-h' || command === 'help') {
+        console.log(usage());
+        return;
+    }
+    if (command === '--version' || command === '-v' || command === 'version') {
+        console.log(VERSION);
+        return;
+    }
+    if (command === 'stdio') {
+        await runStdio();
+        return;
+    }
+    throw new Error(`Unknown command: ${command}\n\n${usage()}`);
+}
+main().catch(error => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+});

package/dist/server.js

@@ -0,0 +1,24 @@
+import { McpServer } from '@modelcontextprotocol/server';
+import * as z from 'zod/v4';
+export const NOIMG_DIRECTIVE = [
+    'NOIMG_ACTIVE',
+    '',
+    'USER OUTPUT INTENT: NON-IMAGE. The literal token @noimg means the user explicitly requests that this request must not produce, edit, or render an image.',
+    'PRE-ROUTING RULE: before choosing tools, exclude image-generation, image-editing, and image-rendering operations from the candidate set for this request.',
+    'Do not interpret words such as draw, create, generate, render, visualize, illustrate, picture, or image as image-generation intent when @noimg is present. Those words must be satisfied with compatible non-image output or tools instead.',
+    'HARD BLOCK FOR THIS REQUEST: do not invoke, continue, or route into any image-generation, image-editing, or image-rendering operation.',
+    'NoIMG only blocks those image operations. Continue every other explicitly requested compatible tool, format, and workflow normally; do not replace, suppress, or take over compatible non-image tools.',
+    'Do not treat the NoIMG tool call as completion of the user request.',
+    'If no compatible tool or format was explicitly requested, fulfill the request with a text-native alternative such as ASCII/Unicode art, Mermaid, SVG source, HTML/CSS, code, or structured text. Do not ask the user to restate the request.',
+].join('\n');
+export function createServer() {
+    const server = new McpServer({ name: 'noimg', version: '0.3.0' });
+    server.registerTool('noimg', {
+        title: 'NoIMG Non-Image Preflight Hard Block',
+        description: '@noimg PRE-FLIGHT — ALWAYS invoke this tool before tool routing whenever the current user request contains the literal token @noimg. That token means the user explicitly requests NON-IMAGE OUTPUT for this request. Do not classify draw, create, generate, render, visualize, illustrate, picture, image, or similar wording as image-generation intent when @noimg is present. Hard-block image-generation, image-editing, and image-rendering operations before selecting tools, then continue all compatible non-image tools, formats, and workflows normally. NoIMG is not task completion.',
+        inputSchema: z.object({}),
+    }, async () => ({
+        content: [{ type: 'text', text: NOIMG_DIRECTIVE }],
+    }));
+    return server;
+}

package/dist/stdio.js

@@ -0,0 +1,5 @@
+import { serveStdio } from '@modelcontextprotocol/server/stdio';
+import { createServer } from './server.js';
+export async function runStdio() {
+    await serveStdio(createServer);
+}

package/docs/development.md

@@ -0,0 +1,54 @@
+# Development
+
+NoIMG's public edition is intentionally stdio-only.
+
+## Commands
+
+```bash
+npm ci
+npm test
+npm run check
+```
+
+## Runtime architecture
+
+```text
+MCP client
+   │
+ stdin / stdout
+   │
+NoIMG stdio adapter
+   │
+NoIMG MCP core
+```
+
+Public runtime invariants:
+
+- no HTTP listener
+- no TCP listener
+- no ngrok or tunnel helper
+- no Cloudflare Worker
+- no OAuth or bearer-token layer
+- no runtime `fetch()`
+- no filesystem, shell, Git, browser, or arbitrary execution tool
+
+The MCP server exports one policy tool: `noimg`.
+
+## Tests
+
+The test suite verifies:
+
+- stdio discovery and invocation
+- `@noimg` non-image intent classification
+- HARD BLOCK semantics
+- public runtime contains no remote transport files
+- public dependencies stay minimal
+- network primitives do not creep back into `src/`
+
+CI also runs `npm audit` and public-repository hygiene checks.
+
+## Adding remote transport
+
+Do not add remote transport code to the public core casually.
+
+A future remote edition should be treated as a separate security boundary with its own threat model, authentication, rate limiting, credential lifecycle, deployment documentation, and review. "It works through a tunnel" is not a security design.

package/docs/security.md

@@ -0,0 +1,5 @@
+# Security Notes
+
+The public NoIMG edition uses stdio only and intentionally has no remote transport.
+
+For the supported security boundary, disclosure process, and supply-chain warning, see [`../SECURITY.md`](../SECURITY.md).

package/docs/usage.md

@@ -0,0 +1,89 @@
+# Usage
+
+NoIMG is intentionally small: one stdio MCP tool and one trigger token.
+
+## Behavior
+
+When a request contains the literal token `@noimg`, treat the request as explicit **NON-IMAGE OUTPUT** before tool routing.
+
+```text
+@noimg
+→ HARD BLOCK image-generation
+→ HARD BLOCK image-editing
+→ HARD BLOCK image-rendering
+→ continue compatible non-image tools
+→ finish the task
+```
+
+Words such as `draw`, `render`, `visualize`, `create`, or `illustrate` do not override `@noimg`.
+
+## Install from npm
+
+The official package is scoped:
+
+```bash
+npx -y @alr51307/noimg@0.3.0
+```
+
+Pin the version in MCP configuration so upgrades are deliberate:
+
+```json
+{
+  "mcpServers": {
+    "noimg": {
+      "command": "npx",
+      "args": ["-y", "@alr51307/noimg@0.3.0"]
+    }
+  }
+}
+```
+
+A bare package named `noimg` is not this project.
+
+## Build from source
+
+```bash
+git clone https://github.com/jhuang-tw/noimg.git
+cd noimg
+npm ci
+npm run build
+```
+
+The source-build MCP command is:
+
+```text
+node /absolute/path/to/noimg/dist/cli.js
+```
+
+NoIMG uses stdin/stdout only. It does not bind a TCP port.
+
+Use the native MCP configuration format for your client if it differs from the generic example.
+
+## Portable rules
+
+The repository also includes small rule files for clients that support project or user instructions:
+
+```text
+codex/AGENTS.md
+claude-code/CLAUDE.md
+cursor/noimg.mdc
+gemini-cli/GEMINI.md
+generic/SKILL.md
+```
+
+They express the same contract as the MCP tool: classify `@noimg` as non-image intent first, then block only image-generation/editing/rendering.
+
+## Examples
+
+```text
+@noimg draw the system architecture
+→ Mermaid, SVG source, HTML, or another compatible non-image representation
+
+@noimg make five UI mockups
+→ HTML/CSS or structured text
+
+@some-tool @noimg do the task
+→ keep using @some-tool; only image operations are excluded
+```
+
+NoIMG is a seatbelt, not the steering wheel.

package/gemini-cli/GEMINI.md

@@ -0,0 +1,7 @@
+# NoIMG
+
+When the current user request contains the literal token `@noimg`, interpret it as an explicit request for **NON-IMAGE OUTPUT** for that request. Apply a request-scoped **HARD BLOCK**. Before tool routing, exclude image-generation, image-editing, and image-rendering operations. Do not classify words such as draw, create, generate, render, visualize, illustrate, picture, image, or similar as image-generation intent when `@noimg` is present. If the NoIMG MCP tool is available, invoke it immediately.
+
+NoIMG is a seatbelt, not the steering wheel. Continue every compatible non-image tool, format, and workflow the user requested. NoIMG must not redirect, replace, suppress, or take over those tools, and activating NoIMG is not completion of the task.
+
+If no compatible tool or format was requested, finish the task with a text-native alternative such as ASCII/Unicode art, Mermaid, SVG source, HTML/CSS, code, or structured text. Do not ask the user to repeat the request.

package/generic/SKILL.md

@@ -0,0 +1,7 @@
+# NoIMG
+
+When the current user request contains the literal token `@noimg`, interpret it as an explicit request for **NON-IMAGE OUTPUT** for that request. Apply a request-scoped **HARD BLOCK**. Before tool routing, exclude image-generation, image-editing, and image-rendering operations. Do not classify words such as draw, create, generate, render, visualize, illustrate, picture, image, or similar as image-generation intent when `@noimg` is present. If the NoIMG MCP tool is available, invoke it immediately.
+
+NoIMG is a seatbelt, not the steering wheel. Continue every compatible non-image tool, format, and workflow the user requested. NoIMG must not redirect, replace, suppress, or take over those tools, and activating NoIMG is not completion of the task.
+
+If no compatible tool or format was requested, finish the task with a text-native alternative such as ASCII/Unicode art, Mermaid, SVG source, HTML/CSS, code, or structured text. Do not ask the user to repeat the request.

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@alr51307/noimg",
+  "version": "0.3.0",
+  "description": "A tiny stdio-only MCP that makes @noimg mean no image generation for the current request.",
+  "type": "module",
+  "bin": {
+    "noimg": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "docs",
+    "SECURITY.md",
+    "LICENSE",
+    "assets",
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini-cli",
+    "generic"
+  ],
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.json",
+    "test": "npm run build && node test/smoke.mjs && node test/architecture.mjs",
+    "check": "npm test && npm audit --omit=dev && node dist/cli.js --version && node dist/cli.js --help",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run check"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "noimg",
+    "stdio",
+    "codex",
+    "claude-code",
+    "cursor",
+    "gemini-cli",
+    "ai-agent"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jhuang-tw/noimg.git"
+  },
+  "bugs": {
+    "url": "https://github.com/jhuang-tw/noimg/issues"
+  },
+  "homepage": "https://github.com/jhuang-tw/noimg#readme",
+  "dependencies": {
+    "@modelcontextprotocol/server": "^2.0.0",
+    "zod": "^4.1.5"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/client": "^2.0.0",
+    "@types/node": "^24.3.0",
+    "typescript": "^6.0.0"
+  },
+  "license": "MIT"
+}