# ai.kavel/kavel-mcp

> Discover Kavel's AI photo/video generators, get tuned prompts, and open the right tool on kavel.ai.

- name: ai.kavel/kavel-mcp
- version: 0.2.0
- connection class: R0 (autonomous)
- trust: 96/100
- quality: 74/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/ai.kavel%2Fkavel-mcp
- tools: https://api.protogrid.dev/v1/servers/ai.kavel%2Fkavel-mcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "kavel-mcp": {
      "type": "http",
      "url": "https://www.kavel.ai/api/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 85
- drivers: +repository +dns-namespace +website +reachable +uptime-100% +updated-7d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 74/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 4 of 4 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: get_kavel_balance (destructiveHint, idempotentHint); find_kavel_tool (destructiveHint, idempotentHint); generate_kavel_image (idempotentHint); …
- pass `tools.token_cost`: about 684 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history recorded for 6 of the 7 days needed

### dependencies: 50 (weight 15)

- warn `deps.known_vulns`: 1 advisory of lower severity or without a published fix: GHSA-5r4p-p66f-jhc7 in hono@4.13.9 (indirect, fixed in 4.13.11)
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 3 known advisories (GHSA-22jm-h49p-29qw, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.32.0 or later
- pass `deps.resolvable`: kavel-mcp@0.1.1 resolved: 98 packages

- tools: 4, about 684 tokens to load them all
- tool set hash: f4456b3b6db64bba64b242fb9a12cf36
- badge: [![protogrid quality](https://protogrid.dev/badge/ai.kavel/kavel-mcp.svg)](https://protogrid.dev/servers/ai.kavel/kavel-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm kavel-mcp@0.1.1: resolved, 97 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-22jm-h49p-29qw (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript SDK: Experimental tasks were not tied to the session that created them" https://osv.dev/vulnerability/GHSA-22jm-h49p-29qw
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
  - GHSA-6prh-2h8m-c8cw (moderate) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.32.0 ``, advisory summary: "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies" https://osv.dev/vulnerability/GHSA-6prh-2h8m-c8cw
  - GHSA-5r4p-p66f-jhc7 (moderate) in `` hono@4.13.9 ``, indirect, fixed in `` 4.13.11 ``, advisory summary: "Hono: \`serveStatic\` decodes the request path a second time, leading to bypass of middleware on static paths" https://osv.dev/vulnerability/GHSA-5r4p-p66f-jhc7

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://www.kavel.ai/api/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- npm kavel-mcp@0.1.1

## Tools (4)

- `check_kavel_generation`: Get the result of a Kavel generation that was still rendering.
- `find_kavel_tool`: Search Kavel's AI photo and video effects (hairstyle changer, figurine, pet portrait, yearbook photo, trend dance videos and more). Returns each tool's slug, what it needs (a photo or just text) and its page on kavel.ai. Image tools can be run here with generate_kavel_image; video tools open on kavel.ai.
- `generate_kavel_image`: Create an image from a prompt, or edit the user's photo, on their Kavel account. Pass `tool` (a slug from find_kavel_tool) to apply that effect's tuned recipe, with `prompt` holding the user's own details. Photo tools need a photo: the user's attachment in `photos`, or a public link in `image_urls`. Spends credits from the linked Kavel account. Usually returns the image within a minute; otherwise returns a task_id for check_kavel_generation.
- `get_kavel_balance`: How many credits are left on the linked Kavel account.