@kolbo/mcp 1.18.0 → 1.19.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kolbo/mcp",
-  "version": "1.18.0",
+  "version": "1.19.1",
   "description": "Kolbo AI MCP Server - Generate images, videos, music, speech, and sound effects from Claude Code",
   "main": "src/index.js",
   "bin": {

package/src/index.js

@@ -90,8 +90,10 @@ function createServer(opts = {}) {
     version: '1.0.0'
   });
 
-  // Register all tools
-  registerGenerateTools(server, client);
+  // Register all tools. `inlineImages` (off by default) is opt-in: only the
+  // remote HTTP host enables it, so stdio clients (Kolbo Code / Desktop / Cursor)
+  // keep identical text-URL output.
+  registerGenerateTools(server, client, { inlineImages: !!opts.inlineImages });
   registerModelTools(server, client);
   registerChatTools(server, client);
   registerVisualDnaTools(server, client);

package/src/tools/_shared.js

@@ -240,6 +240,47 @@ const projectIdField = z.string().optional().describe(
   'Project ObjectId to drop this generation into. Call `list_projects` to discover IDs (the API has no concept of project names — only ObjectIds). Omit to use the user\'s default "API Generations" project. Requires owner / edit / full permission on the project; view-only is rejected.'
 );
 
+// ─── Optional inline-image content blocks ────────────────────────────────────
+// When a host opts in (the remote HTTP connector sets inlineImages:true), turn
+// generated IMAGE urls into MCP `image` content blocks so clients render them
+// inline instead of a "Show Image" link. Strictly gated + bounded:
+//   - only runs when opts.enabled is true (stdio/Kolbo Code never enables it,
+//     so their behavior is byte-identical: text URL only);
+//   - caps the number of images and the bytes per image;
+//   - ONLY embeds responses whose content-type is image/* — a video/audio URL
+//     can never be base64-embedded even if mistakenly passed in;
+//   - any fetch/decoding failure silently falls back to URL-only.
+const INLINE_IMG_MAX_COUNT = 4;
+const INLINE_IMG_MAX_BYTES = 8 * 1024 * 1024; // 8 MB per image
+
+async function inlineImageBlocks(urls, opts = {}) {
+  if (!opts || !opts.enabled) return [];
+  if (!Array.isArray(urls) || urls.length === 0) return [];
+  // Fetch the (≤4) images in parallel — they're independent, the cap already
+  // bounds concurrency, and this sits on the connector response path right
+  // after generation. Order is preserved by map-then-filter; any failure falls
+  // back to URL-only for that image.
+  const blocks = await Promise.all(
+    urls.slice(0, INLINE_IMG_MAX_COUNT).map(async (url) => {
+      try {
+        if (typeof url !== 'string' || !isHttpUrl(url)) return null;
+        const res = await safeFetch(url);
+        if (!res.ok) return null;
+        const contentType = (res.headers.get('content-type') || '').split(';')[0].trim().toLowerCase();
+        if (!contentType.startsWith('image/')) return null; // never embed non-images
+        const declaredLen = Number(res.headers.get('content-length') || 0);
+        if (declaredLen && declaredLen > INLINE_IMG_MAX_BYTES) return null;
+        const ab = await res.arrayBuffer();
+        if (ab.byteLength > INLINE_IMG_MAX_BYTES) return null;
+        return { type: 'image', data: Buffer.from(ab).toString('base64'), mimeType: contentType };
+      } catch (_) {
+        return null;
+      }
+    })
+  );
+  return blocks.filter(Boolean);
+}
+
 module.exports = {
   MAX_FILE_BYTES,
   VISUAL_DNA_MAX_BYTES,
@@ -251,4 +292,5 @@ module.exports = {
   resolveToBuffer,
   creditFields,
   projectIdField,
+  inlineImageBlocks,
 };

package/src/tools/generate.js

@@ -6,9 +6,13 @@
 const { z } = require('zod');
 const FormData = require('form-data');
 const { pollUntilDone } = require('../polling');
-const { resolveToBuffer, creditFields, projectIdField } = require('./_shared');
+const { resolveToBuffer, creditFields, projectIdField, inlineImageBlocks } = require('./_shared');
 
-function registerGenerateTools(server, client) {
+function registerGenerateTools(server, client, options = {}) {
+  // Only enabled by hosts that explicitly opt in (the remote HTTP connector).
+  // stdio hosts (Kolbo Code, Claude Desktop, Cursor) leave this false, so their
+  // tool output is unchanged: a text block with the image URL.
+  const inlineImages = !!options.inlineImages;
   // ─── generate_image ────────────────────────────────────────
   server.tool(
     'generate_image',
@@ -38,6 +42,7 @@ function registerGenerateTools(server, client) {
         timeout: 120000
       });
 
+      const images = await inlineImageBlocks(result.result.urls, { enabled: inlineImages });
       return {
         content: [{
           type: 'text',
@@ -48,7 +53,7 @@ function registerGenerateTools(server, client) {
             prompt_used: result.result.prompt_used,
             _followup_hint: 'If the user asks to edit/change/modify this image next, pass urls[0] to generate_image_edit (free-form edits) or edit_image (upscale/reframe/removebg/enhance_skin/magic_edit). Do NOT call generate_image again.'
           }, null, 2)
-        }]
+        }, ...images]
       };
     }
   );
@@ -85,6 +90,7 @@ function registerGenerateTools(server, client) {
         timeout: heavy ? 240000 : 120000
       });
 
+      const images = await inlineImageBlocks(result.result.urls, { enabled: inlineImages });
       return {
         content: [{
           type: 'text',
@@ -95,7 +101,7 @@ function registerGenerateTools(server, client) {
             prompt_used: result.result.prompt_used,
             _followup_hint: 'If the user asks for another edit on this output, pass urls[0] back into generate_image_edit as source_images. For targeted ops (upscale/reframe/removebg/enhance_skin) use edit_image instead. Do NOT call generate_image from scratch.'
           }, null, 2)
-        }]
+        }, ...images]
       };
     }
   );