0 Fork 0

Files

T

tillandClaude Opus 5 4ff9f8b7a0 Fix what an independent review of the published repo turned up

- CI pinned Node 20, but `node --test` with type stripping needs 22.6, so the
  workflow could never have gone green. CI and `engines` now say 22.6.
- `docker compose up -d` failed on the documented path: the compose files
  require DB_PASSWORD and .env.example never mentioned it. Documented, and the
  README no longer claims "three secrets".
- The secret scanner treated any comment line as safe, so a pasted `.env`
  fragment — the usual way a key gets committed — slipped through. Verified
  against planted keys before and after.
- Module pages were not guarded: with KLARBILD_MODULES=print a signed-in user
  could still open /shares, /library and /queue and read about features the
  instance does not have. They now redirect, matching the API's 404 behaviour.
- German left in the English build: `bild.<ext>` as a download fallback, and
  31 t() keys with no German at all — the whole main navigation among them, so
  a German instance rendered its nav in English. Dictionary now covers every
  key in the source (1,067 entries).
- Third-party names removed from the data as well as the labels: the `theframe`
  format id is now `tv169`, and the dead Cricut admin field is gone.
- Dockerfile ignored the committed lockfile; it now copies it and uses `npm ci`.
- Dropped an unused dependency (@aws-sdk/s3-request-presigner — storage.ts
  explains why presigned URLs are not needed), a dead `/g/` entry in the
  unauthenticated path list, and an undocumented N8N_WEBHOOK_URL that nothing
  read. Documented TRUSTED_PROXIES, which the rate limiter does read.
- Migration 004 still had "nas" in its filename; README said A6–A2 where the
  list runs A6–A1; two committed screenshots were referenced nowhere.

124 tests green, type check clean, build clean, secret scan clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg

2026-09-15 15:16:51 +00:00

2.0 KiB

Raw Permalink Blame History

Klarbild MCP server

Lets an AI assistant (e.g. Claude) hand images to Klarbild and have it process them — things like "take the images from folder XY" or "process the photos someone sent me over iMessage". The assistant fetches the image files (with its own tools) and then calls the Klarbild tools.

Setup

Generate a token in Klarbild: Admin → "Automation / MCP access" → Generate token.
Install the dependency: npm i @modelcontextprotocol/sdk
Start the server (or register it in your MCP client):

{
  "mcpServers": {
    "klarbild": {
      "command": "node",
      "args": ["/path/to/mcp/klarbild-mcp.mjs"],
      "env": {
        "KLARBILD_URL": "https://klarbild.example.com",
        "KLARBILD_TOKEN": "klb_…"
      }
    }
  }
}

Tools

list_recipes — list the presets/recipes available.
process_images — upload and process images (local paths or data: URLs). Give either recipeId (a preset) or mode (each/compose/generate) + options: tasks (clean/cutout/format/contour), prompt_text, output_format (fixed, like 30x40/tv169, or custom, 25x35 / sticker5), output_ext (png/jpg, omit = global default), orientation, crop_mode, contour_mm, delivery_folder, delivery. Returns the job ID.
job_status — query the status of a job (including finish time and error messages).

Modules

Klarbild has optional modules, switched on with the KLARBILD_MODULES environment variable (see src/lib/modules.ts). A tool that belongs to a disabled module (for example process_images when the ai module is off, since it can start an AI generation) returns a 404 from the Klarbild API — the MCP server surfaces that as a tool error, it does not hide or special-case it.

Security

The token grants full programmatic access to upload/processing (not to the admin area). Treat it like a password; if you suspect it has leaked, generate a new one (which invalidates the old one).

2.0 KiB Raw Permalink Blame History