tillandClaude Opus 5
4ff9f8b7a0
- CI pinned Node 20, but `node --test` with type stripping needs 22.6, so the workflow could never have gone green. CI and `engines` now say 22.6. - `docker compose up -d` failed on the documented path: the compose files require DB_PASSWORD and .env.example never mentioned it. Documented, and the README no longer claims "three secrets". - The secret scanner treated any comment line as safe, so a pasted `.env` fragment — the usual way a key gets committed — slipped through. Verified against planted keys before and after. - Module pages were not guarded: with KLARBILD_MODULES=print a signed-in user could still open /shares, /library and /queue and read about features the instance does not have. They now redirect, matching the API's 404 behaviour. - German left in the English build: `bild.<ext>` as a download fallback, and 31 t() keys with no German at all — the whole main navigation among them, so a German instance rendered its nav in English. Dictionary now covers every key in the source (1,067 entries). - Third-party names removed from the data as well as the labels: the `theframe` format id is now `tv169`, and the dead Cricut admin field is gone. - Dockerfile ignored the committed lockfile; it now copies it and uses `npm ci`. - Dropped an unused dependency (@aws-sdk/s3-request-presigner — storage.ts explains why presigned URLs are not needed), a dead `/g/` entry in the unauthenticated path list, and an undocumented N8N_WEBHOOK_URL that nothing read. Documented TRUSTED_PROXIES, which the rate limiter does read. - Migration 004 still had "nas" in its filename; README said A6–A2 where the list runs A6–A1; two committed screenshots were referenced nowhere. 124 tests green, type check clean, build clean, secret scan clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg
Klarbild MCP server
Lets an AI assistant (e.g. Claude) hand images to Klarbild and have it process them — things like "take the images from folder XY" or "process the photos someone sent me over iMessage". The assistant fetches the image files (with its own tools) and then calls the Klarbild tools.
Setup
- Generate a token in Klarbild: Admin → "Automation / MCP access" → Generate token.
- Install the dependency:
npm i @modelcontextprotocol/sdk - Start the server (or register it in your MCP client):
{
"mcpServers": {
"klarbild": {
"command": "node",
"args": ["/path/to/mcp/klarbild-mcp.mjs"],
"env": {
"KLARBILD_URL": "https://klarbild.example.com",
"KLARBILD_TOKEN": "klb_…"
}
}
}
}
Tools
- list_recipes — list the presets/recipes available.
- process_images — upload and process images (local paths or
data:URLs). Give eitherrecipeId(a preset) ormode(each/compose/generate) + options:tasks(clean/cutout/format/contour),prompt_text,output_format(fixed, like30x40/tv169, or custom,25x35/sticker5),output_ext(png/jpg, omit = global default),orientation,crop_mode,contour_mm,delivery_folder,delivery. Returns the job ID. - job_status — query the status of a job (including finish time and error messages).
Modules
Klarbild has optional modules, switched on with the KLARBILD_MODULES environment
variable (see src/lib/modules.ts). A tool that belongs to a disabled module
(for example process_images when the ai module is off, since it can start an
AI generation) returns a 404 from the Klarbild API — the MCP server surfaces that
as a tool error, it does not hide or special-case it.
Security
The token grants full programmatic access to upload/processing (not to the admin area). Treat it like a password; if you suspect it has leaked, generate a new one (which invalidates the old one).