Immich MCP Server
immich-mcp
npm
v0.5.2
Source verified
Published by lidless-labs — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
Operator control CLI for Immich with an MCP adapter for photo search, curation, memories, duplicates, stacks, and safe agent workflows
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 3 = 97. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 0
Tools 74
Each tool and what it can reach — statically extracted from the published source.
immich_download_asset_originalingests untrusted inputimmich_download_asset_thumbnailingests untrusted inputimmich_run_jobingests untrusted inputimmich_suggest_face_namesingests untrusted inputimmich_add_assets_to_albumno sensitive capabilityimmich_add_tag_to_assetsno sensitive capabilityimmich_audit_activeno sensitive capabilityimmich_audit_trashno sensitive capabilityimmich_bulk_update_assetsno sensitive capabilityimmich_categorize_duplicatesno sensitive capability
Show 64 more tools ↓
immich_compare_assetsno sensitive capabilityimmich_create_activityno sensitive capabilityimmich_create_albumno sensitive capabilityimmich_create_shared_linkno sensitive capabilityimmich_create_stackno sensitive capabilityimmich_create_tagno sensitive capabilityimmich_daily_digestno sensitive capabilityimmich_delete_activityno sensitive capabilityimmich_delete_albumno sensitive capabilityimmich_delete_assetno sensitive capabilityimmich_delete_shared_linkno sensitive capabilityimmich_delete_stackno sensitive capabilityimmich_delete_tagno sensitive capabilityimmich_empty_trashno sensitive capabilityimmich_explain_duplicate_groupno sensitive capabilityimmich_find_byte_dupesno sensitive capabilityimmich_find_clip_dupesno sensitive capabilityimmich_get_activity_statisticsno sensitive capabilityimmich_get_albumno sensitive capabilityimmich_get_album_statisticsno sensitive capabilityimmich_get_assetno sensitive capabilityimmich_get_asset_exifno sensitive capabilityimmich_get_asset_statisticsno sensitive capabilityimmich_get_capabilitiesno sensitive capabilityimmich_get_memoryno sensitive capabilityimmich_get_personno sensitive capabilityimmich_get_person_assetsno sensitive capabilityimmich_get_server_infono sensitive capabilityimmich_get_server_statisticsno sensitive capabilityimmich_get_shared_linkno sensitive capabilityimmich_get_storageno sensitive capabilityimmich_get_tagno sensitive capabilityimmich_hide_personno sensitive capabilityimmich_list_activitiesno sensitive capabilityimmich_list_albumsno sensitive capabilityimmich_list_assetsno sensitive capabilityimmich_list_duplicatesno sensitive capabilityimmich_list_jobsno sensitive capabilityimmich_list_memoriesno sensitive capabilityimmich_list_peopleno sensitive capabilityimmich_list_shared_linksno sensitive capabilityimmich_list_stacksno sensitive capabilityimmich_list_tagsno sensitive capabilityimmich_list_trashno sensitive capabilityimmich_memories_todayno sensitive capabilityimmich_merge_peopleno sensitive capabilityimmich_pingno sensitive capabilityimmich_remove_assets_from_albumno sensitive capabilityimmich_remove_tag_from_assetsno sensitive capabilityimmich_resolve_duplicatesno sensitive capabilityimmich_resolve_with_keep_strategyno sensitive capabilityimmich_restore_by_queryno sensitive capabilityimmich_restore_from_trashno sensitive capabilityimmich_search_exploreno sensitive capabilityimmich_search_metadatano sensitive capabilityimmich_search_smartno sensitive capabilityimmich_search_then_albumno sensitive capabilityimmich_update_albumno sensitive capabilityimmich_update_assetno sensitive capabilityimmich_update_personno sensitive capabilityimmich_update_shared_linkno sensitive capabilityimmich_update_stackno sensitive capabilityimmich_update_tagno sensitive capabilityimmich_upload_asset_from_pathno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (74 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.5.2 latest |
A 97/100 | 0 | 1.13.0 | 2026-09-09 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan immich-mcp --onlineMore in Design & Media
Turn designs into shipped parts: quote 3D printing, CNC, and decals, then check out.
Aleph's official SiliconFlow media-generation MCP server (image / video / TTS)
MCP server for image generation using Google Gemini AI
Ambience AI MCP Server - Generate images, videos, and audio through Model Context Protocol
MCP server exposing every endpoint of the AstroWay Calculation API as tools — natal, synastry, transits, Vedic dashas, Tarot, Numerology, Human Design, AI horoscopes — for Claude Desktop, Cursor and any MCP-compatible AI agent.
Audio-guide and trip-planning tools for 1,100+ cities from Audiala. Free, no API key.