@r16t/multimodal-mcp 1.3.1 → 1.4.0

package/README.md

@@ -19,19 +19,19 @@ Set the API key for at least one provider. Most users only need one — add more
 
 ```bash
 # Using OpenAI
-claude mcp add multimodal-mcp -e OPENAI_API_KEY=sk-... -- npx @r16t/multimodal-mcp@latest
+claude mcp add multimodal-mcp -e OPENAI_API_KEY=sk-... -- npx -y @r16t/multimodal-mcp@latest
 
 # Or using xAI
-# claude mcp add multimodal-mcp -e XAI_API_KEY=xai-... -- npx @r16t/multimodal-mcp@latest
+# claude mcp add multimodal-mcp -e XAI_API_KEY=xai-... -- npx -y @r16t/multimodal-mcp@latest
 
 # Or using Gemini
-# claude mcp add multimodal-mcp -e GEMINI_API_KEY=AIza... -- npx @r16t/multimodal-mcp@latest
+# claude mcp add multimodal-mcp -e GEMINI_API_KEY=AIza... -- npx -y @r16t/multimodal-mcp@latest
 
 # Or using ElevenLabs (audio + transcription)
-# claude mcp add multimodal-mcp -e ELEVENLABS_API_KEY=xi-... -- npx @r16t/multimodal-mcp@latest
+# claude mcp add multimodal-mcp -e ELEVENLABS_API_KEY=xi-... -- npx -y @r16t/multimodal-mcp@latest
 
 # Or using BFL/FLUX (images)
-# claude mcp add multimodal-mcp -e BFL_API_KEY=... -- npx @r16t/multimodal-mcp@latest
+# claude mcp add multimodal-mcp -e BFL_API_KEY=... -- npx -y @r16t/multimodal-mcp@latest
 ```
 
 Using a different editor? See [setup instructions](#editor-setup) for Claude Desktop, Cursor, VS Code, Windsurf, and Cline.

package/build/errors.js

@@ -4,6 +4,8 @@ const API_KEY_PATTERNS = [
     /AIzaSy[a-zA-Z0-9_-]{10,}/g,
     /key=[a-zA-Z0-9_-]{20,}/g,
     /xi-[a-zA-Z0-9_-]{10,}/g,
+    /\b[a-f0-9]{32}\b/g,
+    /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi,
 ];
 export function sanitizeError(error) {
     let message;

package/build/providers/bfl.d.ts

@@ -11,5 +11,8 @@ export declare class BFLProvider implements MediaProvider {
     private submitTask;
     private pollTask;
     private downloadResult;
+    private validateModel;
+    private validatePollingUrl;
+    private validateDownloadUrl;
     private mapAspectRatio;
 }

package/build/providers/bfl.js

@@ -1,7 +1,14 @@
 import { pollForCompletion } from "./polling.js";
-const BFL_BASE_URL = "https://api.bfl.ml/v1";
+const BFL_BASE_URL = "https://api.bfl.ai/v1";
 const IMAGE_MODEL = "flux-pro-1.1";
 const EDIT_MODEL = "flux-kontext-pro";
+const ALLOWED_MODELS = new Set([
+    "flux-pro-1.1",
+    "flux-pro-1.1-ultra",
+    "flux-dev",
+    "flux-kontext-pro",
+    "flux-kontext-max",
+]);
 const ASPECT_RATIO_MAP = {
     "1:1": { width: 1024, height: 1024 },
     "16:9": { width: 1344, height: 768 },
@@ -9,6 +16,15 @@ const ASPECT_RATIO_MAP = {
     "4:3": { width: 1152, height: 896 },
     "3:4": { width: 896, height: 1152 },
 };
+const ALLOWED_POLL_HOSTS = new Set([
+    "api.bfl.ai",
+    "api.bfl.ml",
+]);
+const ALLOWED_DOWNLOAD_HOSTS = new Set([
+    "delivery-bfl.ai",
+    "cdn.bfl.ai",
+    "cdn.bfl.ml",
+]);
 export class BFLProvider {
     name = "bfl";
     capabilities = {
@@ -32,16 +48,22 @@ export class BFLProvider {
         const modelName = model ?? IMAGE_MODEL;
         const { width, height } = this.mapAspectRatio(params.aspectRatio);
         const task = await this.submitTask(modelName, { prompt: params.prompt, width, height, ...options });
-        const result = await this.pollTask(task.id);
-        return this.downloadResult(result.result.sample, modelName);
+        const result = await this.pollTask(task.polling_url);
+        const sample = result.result?.sample;
+        if (!sample)
+            throw new Error("BFL returned Ready status with no result sample");
+        return this.downloadResult(sample, modelName);
     }
     async editImage(params) {
         const { model, ...options } = params.providerOptions ?? {};
         const modelName = model ?? EDIT_MODEL;
         const input_image = params.imageData.toString("base64");
         const task = await this.submitTask(modelName, { prompt: params.prompt, input_image, ...options });
-        const result = await this.pollTask(task.id);
-        return this.downloadResult(result.result.sample, modelName);
+        const result = await this.pollTask(task.polling_url);
+        const sample = result.result?.sample;
+        if (!sample)
+            throw new Error("BFL returned Ready status with no result sample");
+        return this.downloadResult(sample, modelName);
     }
     async generateVideo(_params) {
         throw new Error("BFL does not support video generation");
@@ -50,25 +72,37 @@ export class BFLProvider {
         throw new Error("BFL does not support audio generation");
     }
     async submitTask(model, body) {
+        this.validateModel(model);
         const response = await fetch(`${BFL_BASE_URL}/${model}`, {
             method: "POST",
-            headers: { "Content-Type": "application/json", "X-Key": this.apiKey },
+            headers: { "Content-Type": "application/json", "x-key": this.apiKey },
             body: JSON.stringify(body),
         });
         if (!response.ok) {
             throw new Error(`BFL task submission failed: ${response.status}`);
         }
-        return response.json();
+        const task = await response.json();
+        this.validatePollingUrl(task.polling_url);
+        return task;
     }
-    async pollTask(taskId) {
+    async pollTask(pollingUrl) {
         return pollForCompletion(async () => {
-            const response = await fetch(`${BFL_BASE_URL}/get_result?id=${taskId}`, {
-                headers: { "X-Key": this.apiKey },
+            const response = await fetch(pollingUrl, {
+                headers: { "x-key": this.apiKey },
             });
+            if (!response.ok) {
+                throw new Error(`BFL poll failed: ${response.status}`);
+            }
             return response.json();
-        }, (result) => result.status === "Ready", { timeoutMs: 300_000, intervalMs: 3_000 });
+        }, (result) => {
+            if (result.status === "Error" || result.status === "Failed") {
+                throw new Error(`BFL task failed with status: ${result.status}`);
+            }
+            return result.status === "Ready";
+        }, { timeoutMs: 300_000, intervalMs: 3_000 });
     }
     async downloadResult(url, model) {
+        this.validateDownloadUrl(url);
         const response = await fetch(url);
         if (!response.ok) {
             throw new Error(`BFL image download failed: ${response.status}`);
@@ -77,6 +111,23 @@ export class BFLProvider {
         const data = Buffer.from(await response.arrayBuffer());
         return { data, mimeType, metadata: { model, provider: "bfl" } };
     }
+    validateModel(model) {
+        if (!ALLOWED_MODELS.has(model)) {
+            throw new Error(`Unknown BFL model: ${model}. Allowed: ${[...ALLOWED_MODELS].join(", ")}`);
+        }
+    }
+    validatePollingUrl(url) {
+        const parsed = new URL(url);
+        if (!ALLOWED_POLL_HOSTS.has(parsed.hostname)) {
+            throw new Error(`Unexpected BFL polling host: ${parsed.hostname}`);
+        }
+    }
+    validateDownloadUrl(url) {
+        const parsed = new URL(url);
+        if (!ALLOWED_DOWNLOAD_HOSTS.has(parsed.hostname)) {
+            throw new Error(`Unexpected BFL download host: ${parsed.hostname}`);
+        }
+    }
     mapAspectRatio(ratio) {
         const dimensions = ASPECT_RATIO_MAP[ratio];
         if (!dimensions) {

package/build/providers/elevenlabs.js

@@ -1,7 +1,7 @@
 const BASE_URL = "https://api.elevenlabs.io/v1";
 const DEFAULT_VOICE_ID = "JBFqnCBsd6RMkjVDRZzb";
 const DEFAULT_TTS_MODEL = "eleven_flash_v2_5";
-const TRANSCRIPTION_MODEL = "scribe_v1";
+const TRANSCRIPTION_MODEL = "scribe_v2";
 export class ElevenLabsProvider {
     name = "elevenlabs";
     capabilities = {
@@ -79,7 +79,7 @@ export class ElevenLabsProvider {
     }
     async generateSoundEffect(params) {
         const filtered = Object.fromEntries(Object.entries(params.providerOptions ?? {}).filter(([k]) => k !== "mode"));
-        const response = await fetch(`${BASE_URL}/text-to-sound-effects`, {
+        const response = await fetch(`${BASE_URL}/sound-generation`, {
             method: "POST",
             headers: { "Content-Type": "application/json", "xi-api-key": this.apiKey },
             body: JSON.stringify({ text: params.text, ...filtered }),

package/build/providers/registry.js

@@ -23,7 +23,7 @@ export class ProviderRegistry {
         return [...this.providers.values()].filter((p) => p.capabilities.supportsAudioGeneration);
     }
     getTranscriptionProviders() {
-        return [...this.providers.values()].filter((p) => p.capabilities.supportsTranscription);
+        return [...this.providers.values()].filter((p) => typeof p.transcribeAudio === "function");
     }
     listCapabilities() {
         return [...this.providers.values()].map((p) => ({

package/build/providers/types.d.ts

@@ -12,7 +12,7 @@ export interface ProviderCapabilities {
     supportsImageEditing: boolean;
     supportsVideoGeneration: boolean;
     supportsAudioGeneration: boolean;
-    supportsTranscription: boolean;
+    supportsTranscription?: boolean;
     supportedImageAspectRatios: string[];
     supportedVideoAspectRatios: string[];
     supportedVideoResolutions: string[];

package/build/tools/list-providers.js

@@ -10,18 +10,18 @@ export function buildListProvidersHandler(registry) {
             };
         }
         const lines = providers.map((p) => {
-            const caps = [];
+            const capabilityLabels = [];
             if (p.capabilities.supportsImageGeneration)
-                caps.push("image");
+                capabilityLabels.push("image");
             if (p.capabilities.supportsImageEditing)
-                caps.push("image editing");
+                capabilityLabels.push("image editing");
             if (p.capabilities.supportsVideoGeneration)
-                caps.push("video");
+                capabilityLabels.push("video");
             if (p.capabilities.supportsAudioGeneration)
-                caps.push("audio");
+                capabilityLabels.push("audio");
             if (p.capabilities.supportsTranscription)
-                caps.push("transcription");
-            return `- ${p.name}: ${caps.join(", ")}`;
+                capabilityLabels.push("transcription");
+            return `- ${p.name}: ${capabilityLabels.join(", ")}`;
         });
         return {
             content: [{

package/build/tools/transcribe-audio.js

@@ -15,7 +15,7 @@ export function buildTranscribeAudioHandler(registry) {
                 content: [{ type: "text", text }],
             };
         }
-        if (!provider.capabilities.supportsTranscription || !provider.transcribeAudio) {
+        if (!provider.transcribeAudio) {
             const available = registry.getTranscriptionProviders().map((p) => p.name).join(", ") || "none";
             return {
                 isError: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r16t/multimodal-mcp",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "mcpName": "io.github.rsmdt/multimodal",
   "description": "Multi-provider media generation MCP server",
   "type": "module",