MCP100 verdict
Not currently recommended. First-party evidence supports Shortlist admission; this is not a Recommended-tier security certification.
MCP100 Assessment
Editorial verdict
Reviewed October 19, 2026
Task Fit
Mapped
Specialized workflows
Trust
Status warning
Shortlist evidence is sufficient for identity, setup and task value; authenticated runtime tool-schema measurement and exhaustive security certification remain out of scope.
Maintenance
Date unavailable
No dated repository or package update is currently stored.
Popularity
Signals available
Visible usage signals are shown for discovery only, not as proof of safety.
Evidence scope
0 MCP repository stars
2.2k package downloads / 30 days
Repository identity: cloudinary/asset-management-mcp
Package identity: @cloudinary/asset-management-mcp · version 0.11.3
Stars observed October 20, 2026 · Downloads observed October 20, 2026
Current first-party Cloudinary Asset Management MCP implementation repository contains server source code; the verified GitHub API currently reports 0 stars.
Exact MCP-specific npm package identity verified against the first-party repository.
Publisher activity observed October 20, 2026
Current source snapshot
Source relationship: First-party MCP
Reviewed October 19, 2026
Evidence-backed setup
Choose your MCP client. A client connects to the MCP server; the language model is selected inside that client. Only stored, source-backed configurations are shown.
Transport not recorded
Complete client-specific setup, verification and removal are not documented in this reviewed source.
Publisher-documented setup is not the same as MCP100 execution testing. “MCP100 logic checked” means the stored configuration shape was reviewed, not that third-party MCP software was run.
Evidence checked 2026-10-20
Type-appropriate, source-backed setup for this mcp server profile.
Loading optional publisher installation details…
{"command":"npx","args":["-y","@cloudinary/asset-management-mcp","start"],"env":{"CLOUDINARY_CLOUD_NAME":"${CLOUDINARY_CLOUD_NAME}","CLOUDINARY_API_KEY":"${CLOUDINARY_API_KEY}","CLOUDINARY_API_SECRET":"${CLOUDINARY_API_SECRET}"}}Capability
Cloudinary MCP is a first-party MCP for manage cloudinary media assets, metadata, folders, transformations, and generation workflows. Authentication/setup: Cloudinary credentials for local package; hosted service authentication per Cloudinary. Uploads, deletes, renames, metadata changes, transformations, and generation mutate production media. Protect Cloudinary API secrets. Dynamic/progressive-discovery mode exposes four meta-tools but does not reduce the underlying 30-tool capability surface.
The standard server exposes 30 documented asset-management tools.
Not measured yet
Estimated token footprint of the MCP tool schemas exposed to the agent.
https://asset-management.mcp.cloudinary.com/mcp
Reviewed access
Related reviewed MCPs
Connect compatible AI clients to Contentful's documented MCP capabilities.
Choose this instead if
Choose Contentful MCP Server instead if connect compatible AI clients to Contentful's documented MCP capabilities.
Recommended after reviewed 2026-09-25 admission dossier: current_patched_first_party_server_all_selected_gates_pass.
Google Search Console MCP Server for SEOs
Choose this instead if
Choose Google Search Console MCP Server for SEOs instead if sEO analysis across Search Console properties, queries, pages, indexing status, and sitemaps.
Recommended for teams that want an AI assistant to inspect Search Console performance and indexing data through a deliberately scoped Google account.
Let AI clients inspect and automate web browsers with Playwright.
Choose this instead if
Choose Playwright MCP instead if inspecting and testing web interfaces through accessibility snapshots.
Let AI clients inspect and automate web browsers with Playwright.
Cloudinary is listed as First-party MCP in MCP100’s current evidence.
Current official resources:
From the publisher README
Original client setup and configuration retained from the publisher documentation.
Publisher-documented clients
These names appear in the publisher's installation documentation. MCP100-verified configurations are shown separately above when available.
The MCP server requires Node.js 20 or later.
Install the MCP server as a Desktop Extension using the pre-built mcp-server.mcpb file:
Simply drag and drop the mcp-server.mcpb file onto Claude Desktop to install the extension.
The MCP bundle package includes the MCP server and all necessary configuration. Once installed, the server will be available without additional setup.
[!NOTE] MCP bundles provide a streamlined way to package and distribute MCP servers. Learn more about Desktop Extensions.
Or manually:
{
"command": "npx",
"args": [
"@cloudinary/asset-management-mcp",
"start",
"--api-key",
"",
"--api-secret",
"",
"--cloud-name",
""
]
}
claude mcp add CloudinaryAssetMgmt -- npx -y @cloudinary/asset-management-mcp start --api-key --api-secret --cloud-name
gemini mcp add CloudinaryAssetMgmt -- npx -y @cloudinary/asset-management-mcp start --api-key --api-secret --cloud-name
Refer to Official Windsurf documentation for latest information
Manage MCPs. (To Manage MCPs you should be signed in with a Windsurf Account)View raw config to open up the mcp configuration file.{
"command": "npx",
"args": [
"@cloudinary/asset-management-mcp",
"start",
"--api-key",
"",
"--api-secret",
"",
"--cloud-name",
""
]
}
Or manually:
Refer to Official VS Code documentation for latest information
MCP: Open User Configuration. This should open mcp.json file{
"command": "npx",
"args": [
"@cloudinary/asset-management-mcp",
"start",
"--api-key",
"",
"--api-secret",
"",
"--cloud-name",
""
]
}
npx @cloudinary/asset-management-mcp start --api-key --api-secret --cloud-name
For a full list of server arguments, run:
npx @cloudinary/asset-management-mcp --help
Original product, capability, tool, and usage documentation from the MCP publisher. Installation sections appear under Install & Agents.
The MCP server supports the following environment variables:
| Variable | Description | Required |
|---|---|---|
CLOUDINARY_CLOUD_NAME | Your Cloudinary cloud name | Yes |
CLOUDINARY_API_KEY | Your Cloudinary API key | Yes |
CLOUDINARY_API_SECRET | Your Cloudinary API secret | Yes |
CLOUDINARY_URL | Complete Cloudinary URL (alternative to individual vars) | No |
CLOUDINARY_COLLECT_HEADERS | Collect API response headers (see below) | No |
CLOUDINARY_MCP_APPS | Override MCP Apps default (see MCP Apps) | No |
You can use a single CLOUDINARY_URL instead of individual variables:
CLOUDINARY_URL=cloudinary://API_KEY:API_SECRET@CLOUD_NAME
You can configure the server to include Cloudinary API response headers (such as x-request-id and rate limit info) in tool output. This is useful for debugging and monitoring.
Set CLOUDINARY_COLLECT_HEADERS to control which headers are collected:
# Collect all response headers
CLOUDINARY_COLLECT_HEADERS=true
# Collect specific headers by exact name (comma-separated)
CLOUDINARY_COLLECT_HEADERS=x-request-id,x-featureratelimit-limit,x-featureratelimit-remaining
# Mix exact names, prefix matching, and regex matching
CLOUDINARY_COLLECT_HEADERS=x-request-id,prefix:x-featureratelimit-
Each entry in the comma-separated list is matched against response header names:
| Format | Example | Behaviour |
|---|---|---|
| exact name | x-request-id | matches only x-request-id |
prefix:<value> | prefix:x-featureratelimit- | matches any header starting with x-featureratelimit- |
regex:<pattern> | regex:ratelimit | matches any header whose name contains ratelimit |
You can also set this via the CLOUDINARY_URL query parameter:
CLOUDINARY_URL=cloudinary://API_KEY:API_SECRET@CLOUD_NAME?collect_headers=true
When enabled, collected headers appear in an _headers field in the tool response. When not set, no headers are collected and responses are unchanged.
The server can expose interactive MCP UI Apps (spec-aligned with io.modelcontextprotocol/ui) that hosts can render alongside tool results — for example, an asset gallery for list results, a single-asset detail view, and an upload UI.
Apps are enabled by default. Use the --mcp-apps flag (available on both start and serve) or the CLOUDINARY_MCP_APPS environment variable to override this behaviour:
| Value | Effect |
|---|---|
| unset | Default — all apps enabled |
bare --mcp-apps (no value), all, or true | Enable every app (same as default) |
none or false | Disable every app (kill-switch) |
comma-separated subset, e.g. asset-gallery,asset-details | Enable only the listed apps |
Available app names: asset-gallery, asset-details, asset-upload.
# Disable all apps
npx @cloudinary/asset-management-mcp serve --mcp-apps none
# Enable only the gallery
npx @cloudinary/asset-management-mcp start --mcp-apps asset-gallery
# Disable via env var
CLOUDINARY_MCP_APPS=none npx @cloudinary/asset-management-mcp start
Precedence: CLI flag > environment variable > built-in default.
The MCP server uses your Cloudinary API key and secret for authentication:
{
"env": {
"CLOUDINARY_CLOUD_NAME": "demo",
"CLOUDINARY_API_KEY": "123456789012345",
"CLOUDINARY_API_SECRET": "abcdefghijklmnopqrstuvwxyz12"
}
}
The MCP server exposes Cloudinary's Asset Management API as tools. Use your AI application to discover and invoke the available tools for uploading, managing, searching, and transforming your media assets.
1. Upload a local image: "Upload file:///Users/me/photo.jpg to Cloudinary as 'hero-image'"
2. Transform it: "Transform asset 'hero-image' with transformations 'c_fill,w_800,h_600/e_sharpen'"
3. Get details: "Show me details for asset with ID [asset-id]"
1. Search for images: "Find all images with tag 'product' uploaded in the last 7 days"
2. Create folder: "Create a new folder called 'summer-2024-products'"
3. List assets: "Show me all video assets in the 'marketing' folder"
1. Get transformation docs: "Show me the Cloudinary transformation reference"
2. Apply transformations: "Transform 'banner' asset with 'c_scale,w_1200/f_auto,q_auto'"
3. Create archive: "Generate a ZIP archive of all images with tag 'export-ready'"
1. Upload multiple files: "Upload all images from folder /assets/new-products/"
2. Add tags: "Update asset [asset-id] and add tags 'featured,homepage'"
3. Get usage stats: "Show my Cloudinary account usage statistics"
This MCP server includes two powerful custom tools:
get-tx-referenceRetrieves the complete Cloudinary transformation reference documentation.
When to use:
Example:
Use get-tx-reference to learn about available transformations
transform-assetApplies transformations to existing assets using Cloudinary's explicit API.
Parameters:
publicId - The asset's public IDtransformations - Transformation string (e.g., c_fill,w_300,h_200)resourceType - Type: image, video, or raw (default: image)invalidate - Invalidate CDN cache (default: false)Example:
Transform asset "sample" with transformations "c_fill,w_500,h_500/e_sepia"
MCP servers with many tools can bloat LLM context windows, leading to increased token usage and tool confusion. Dynamic mode solves this by exposing only a small set of meta-tools that let agents progressively discover and invoke tools on demand.
To enable dynamic mode, pass the --mode dynamic flag when starting your server:
{
"mcpServers": {
"CloudinaryAssetMgmt": {
"command": "npx",
"args": ["@cloudinary/asset-management-mcp", "start", "--mode", "dynamic"],
// ... other server arguments
}
}
}
In dynamic mode, the server registers only the following meta-tools instead of every individual tool:
list_tools: Lists all available tools with their names and descriptions.describe_tool_input: Returns the input schema for one or more tools by name.execute_tool: Executes a tool by name with its arguments.list_scopes: Lists the scopes available on the server.This approach significantly reduces the number of tokens sent to the LLM on each request, which is especially useful for servers with a large number of tools.
You can combine dynamic mode with scope and tool filters:
{
"mcpServers": {
"CloudinaryAssetMgmt": {
"command": "npx",
"args": ["@cloudinary/asset-management-mcp", "start", "--mode", "dynamic", "--scope", "admin"],
// ... other server arguments
}
}
}
# Clone the repository
git clone https://github.com/cloudinary/asset-management-mcp.git
cd asset-management-mcp
# Install dependencies
npm install
# Build the project
npm run build
# Run locally
npm start
asset-management-mcp/
├── src/
│ ├── hooks/ # SDK hooks (manual)
│ │ ├── cloudinaryAuthHook.ts # Auth & file:// handling
│ │ ├── customHeadersHook.ts # Inject custom request headers
│ │ ├── responseHeadersHook.ts # Collect response headers
│ │ ├── userAgentHook.ts # Build User-Agent string
│ │ └── registration.ts # Hook registration
│ ├── mcp-server/ # MCP server implementation
│ │ ├── server.ts # Main server (auto-generated)
│ │ ├── server.extensions.ts # Custom tools & app wiring (manual)
│ │ ├── tools/ # Generated tool wrappers
│ │ └── apps/ # MCP UI Apps (manual)
│ │ ├── config.ts # App registry & --mcp-apps parsing
│ │ ├── cli-flag.ts # stricli flag definition
│ │ ├── extensions.ts # Resource-template registration
│ │ ├── uri.ts # App URI helpers / tool-name injection
│ │ ├── tool-hooks.ts # Per-tool app hooks
│ │ ├── app-shared.ts # Shared app utilities
│ │ ├── asset-gallery-app.ts # List results gallery UI
│ │ ├── asset-details-app.ts # Single-asset detail UI
│ │ └── asset-upload-app.ts # Upload UI
│ ├── funcs/ # API function implementations
│ └── models/ # Type definitions
├── .github/
│ └── workflows/ # CI/CD workflows
└── .speakeasy/ # Speakeasy configuration
While we value contributions to this MCP Server, most of the code is generated programmatically from the Cloudinary API spec. Any manual changes to generated files will be overwritten on the next generation — please direct your changes to the manual extension points below.
What you can contribute:
src/mcp-server/server.extensions.tssrc/mcp-server/apps/ (gallery, details, upload, and new apps)src/hooks/ (auth, custom headers, response headers, user agent)Generated files (do not edit):
src/mcp-server/server.tssrc/mcp-server/tools/*.tssrc/funcs/*.tssrc/models/*.tsWhen touching generated files is unavoidable, prefer updating the upstream spec or Speakeasy configuration in .speakeasy/ so the change survives regeneration.
We look forward to hearing your feedback. Feel free to open a PR or issue with a proof of concept and we'll do our best to include it in a future release.