podop29/shotpipe-mcp

Shotpipe MCP is a small server that lets an AI agent take screenshots of web pages and create social card images without running a browser itself. It connects to a service called Shotpipe, which handles the actual rendering on its own servers. This matters because running a full browser inside an agent environment can be memory intensive and prone to crashes. By offloading the work, the agent stays lightweight and stable. The project addresses a specific security concern called SSRF, where a malicious URL could trick a renderer into accessing private internal networks. Shotpipe protects against this by resolving domain names itself, pinning the IP address, checking every redirect, and refusing requests to private, loopback, or cloud metadata hosts. This means an agent can safely screenshot URLs that users provide without the risk of those links reaching internal systems. Ad and cookie consent banners are stripped from screenshots by default. The server exposes two tools. The first, called screenshot, captures a web page and returns the image along with a shareable signed URL. It supports options like image format, dimensions, full page capture, dark mode, and custom wait conditions. The second tool, called og image, generates a signed URL for a social card image using a hosted template. By default it only returns the URL and does not render the image immediately, keeping things fast during builds. The image renders later when a social platform's crawler first requests it. Setup involves adding a configuration block to an MCP client such as Claude Desktop, Cursor, or Cline, pointing to the package via npx, and providing an API key and signing secret. A free key is available on the Shotpipe website without a credit card. The signing secret stays local, and every request is signed with HMAC, matching how Shotpipe's other clients work. The project is MIT licensed.