Lamina MCP Server
https://app.uselamina.ai/mcp/agent
Remote
v1.0.0
Published by app.uselamina.ai — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
On-brand product photos, model try-ons, video reels & banners from a brief + brand kit.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 6.3 = 94. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −6.3 | Annotation contradicts behavior on "lamina_compose_plan" MTC-CAP-003 | permissions |
2. Client adoption risk — 94 − 6 = 88. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 7
high Tool "lamina_compose_video" exposes command/code executionMTC-CAP-001
Tool "lamina_compose_video" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool lamina_compose_video
high Tool "lamina_compose_plan" exposes command/code executionMTC-CAP-001
Tool "lamina_compose_plan" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool lamina_compose_plan
medium Annotation contradicts behavior on "lamina_compose_plan"MTC-CAP-003
Tool "lamina_compose_plan" advertises readOnlyHint=true but its derived capabilities include state-modifying actions (code-exec). Tool annotations are attacker-controllable and must never be trusted; a mismatch like this is exactly how a hostile server hides a destructive tool.
Fix: Ignore server-provided annotations for security decisions; gate destructive tools on explicit user consent.
Location: tool lamina_compose_plan
medium Unconstrained command parameter "script" on "lamina_compose_video"MTC-CAP-006
Tool "lamina_compose_video" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool lamina_compose_video · inputSchema.properties.script
medium Unconstrained command parameter "script" on "lamina_compose_plan"MTC-CAP-006
Tool "lamina_compose_plan" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool lamina_compose_plan · inputSchema.properties.script
low Mutating tool "lamina_compose_video" declares no destructiveHintMTC-CAP-005
Tool "lamina_compose_video" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool lamina_compose_video
low Mutating tool "lamina_compose_plan" declares no destructiveHintMTC-CAP-005
Tool "lamina_compose_plan" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool lamina_compose_plan
Tools 30
Each tool and what it can reach — enumerated from the running server.
lamina_compose_planruns code / shelllamina_compose_videoruns code / shelllamina_app_versionsno sensitive capabilitylamina_brandno sensitive capabilitylamina_brand_complianceno sensitive capabilitylamina_brand_feedbackno sensitive capabilitylamina_brand_kitno sensitive capabilitylamina_brand_scoreno sensitive capabilitylamina_cancelno sensitive capabilitylamina_compose_formatsno sensitive capability
Show 20 more tools ↓
lamina_createno sensitive capabilitylamina_creditsno sensitive capabilitylamina_describeno sensitive capabilitylamina_discoverno sensitive capabilitylamina_generate_hookno sensitive capabilitylamina_generate_imageno sensitive capabilitylamina_generate_videono sensitive capabilitylamina_generate_workflowno sensitive capabilitylamina_models_describeno sensitive capabilitylamina_models_listno sensitive capabilitylamina_plv_backgroundno sensitive capabilitylamina_refine_to_brandno sensitive capabilitylamina_runno sensitive capabilitylamina_save_to_brand_kitno sensitive capabilitylamina_set_brandno sensitive capabilitylamina_set_brand_kit_elementno sensitive capabilitylamina_set_visibilityno sensitive capabilitylamina_statusno sensitive capabilitylamina_topupno sensitive capabilitylamina_upload_assetno sensitive capability
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.0.0 latest |
B 88/100 | 7 | 1.12.1 | 2026-07-29 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan https://app.uselamina.ai/mcp/agent --onlineMore in Design & Media
Turn designs into shipped parts: quote 3D printing, CNC, and decals, then check out.
Aleph's official SiliconFlow media-generation MCP server (image / video / TTS)
MCP server for image generation using Google Gemini AI
Ambience AI MCP Server - Generate images, videos, and audio through Model Context Protocol
MCP server exposing every endpoint of the AstroWay Calculation API as tools — natal, synastry, transits, Vedic dashas, Tarot, Numerology, Human Design, AI horoscopes — for Claude Desktop, Cursor and any MCP-compatible AI agent.
Audio-guide and trip-planning tools for 1,100+ cities from Audiala. Free, no API key.