Snipaya

[Snipaya app icon]

snipaya-mcp

[CI] [npm version] [npm downloads] [MIT license] [snipaya-mcp on Glama]

Connect any MCP client that speaks stdio to Snipaya, the image and screenshot annotator for macOS. Your assistant can read the canvas, add arrows, text, shapes and callouts, redact sensitive data, crop, and export, while you watch the result in Snipaya.

Snipaya has an MCP server built in, served over Streamable HTTP on 127.0.0.1. snipaya-mcp is a thin bridge for clients that only start local stdio servers: it forwards every MCP message between the client and Snipaya, unchanged.

Tools and prompts are listed even before Snipaya is open. Until Snipaya answers, the bridge lists them from a built-in catalog, and a tool call returns a message that says what to do.

[An assistant documenting a ticket in Snipaya: four screenshots on one canvas with numbered steps, arrows and callouts]

Listed on the MCP Registry as io.github.krzysztofsurdy/snipaya-mcp, on Glama and in TensorBlock awesome-mcp-servers.

Requirements

• Snipaya for macOS. It comes with a 14-day free trial.
• Node.js 20 or newer (for the npx setup).

Turn on the MCP server in Snipaya

The server is off by default.

1. Open Snipaya, then Settings > AI Assistants.
2. Turn on Allow AI assistants. The status changes to Running.

That is all the bridge needs. It reads the access token and port from the settings Snipaya saves on this Mac, so you do not have to copy them.

Setup

npx

npx -y snipaya-mcp

If Snipaya is not running but Allow AI assistants is on, the bridge opens Snipaya in the background and waits up to 10 seconds for its server.

To override what Snipaya saved, set these variables or flags. Flags win over variables, and variables win over the saved settings.

Prefer the environment variable over --token: command-line flags are visible to other processes on the Mac.

JSON config

For clients configured with an mcpServers JSON file:

{  "mcpServers": {    "snipaya": {      "command": "npx",      "args": ["-y", "snipaya-mcp"],      "env": {        "npm_config_registry": "https://registry.npmjs.org/"      }    }  }}

For a custom setup, pass the values in env instead:

{  "mcpServers": {    "snipaya": {      "command": "npx",      "args": ["-y", "snipaya-mcp"],      "env": {        "npm_config_registry": "https://registry.npmjs.org/",        "SNIPAYA_MCP_TOKEN": "<access token>",        "SNIPAYA_MCP_URL": "<server url>"      }    }  }}

If your client supports Streamable HTTP servers directly, you do not need this bridge: use Copy MCP config in Snipaya instead.

MCP Bundle (.mcpb)

1. Download snipaya-mcp-<version>.mcpb from the latest release.
2. Open it with an MCP client that supports MCP Bundles, or drag it into the client's extensions settings.
3. Leave the token and URL empty to use what Snipaya saved, or paste the values from Settings > AI Assistants for a custom setup.

Security model

• Local only. Snipaya's server listens on 127.0.0.1 and accepts only loopback Host headers and requests without an Origin header, so websites in your browser cannot reach it. The bridge refuses any URL whose host is not 127.0.0.1 or localhost, and never sends an Origin header.
• Off by default. Nothing listens until you turn on Allow AI assistants.
• Token. Every request carries Authorization: Bearer <token>. Snipaya generates the token, and Regenerate in Settings revokes the old one. The bridge never writes the token to its logs.
• Saved settings. Without SNIPAYA_MCP_TOKEN, the bridge reads the token and port from ~/Library/Application Support/Snipaya/mcp.json, which Snipaya writes readable only by your macOS user. The bridge never writes to it.
• Opening Snipaya. Only on macOS and only when Allow AI assistants is on, the bridge first sends one request without the token to see whether Snipaya answers. If the connection is refused, it runs open -g -b dev.snipaya.app (no shell) and retries. It does this at start, and again for a tool call while Snipaya is not reachable. Any other failure, such as a rejected token, never opens the app. SNIPAYA_MCP_NO_LAUNCH=1 turns this off.
• The bridge only forwards. It runs no tools itself, stores nothing, and connects only to Snipaya. While Snipaya is not reachable, it answers the tool and prompt lists from a catalog shipped in the package. All actions run inside Snipaya, which shows connected assistants and recent activity in Settings > AI Assistants.

Tools

The tools come from the Snipaya version you have installed. Until Snipaya answers, the bridge lists the tools of Snipaya 1.3.3 from its catalog, and once Snipaya answers, the list of your installed version applies. Snipaya 1.3 provides:

Prompts

Troubleshooting

The bridge writes the problem to stderr (never stdout, which carries the protocol). While Snipaya is not reachable, it still lists the tools, and returns the same text as the result of each tool call. When Snipaya starts answering, for example after you open it or accept the license agreement, the next tool call reaches it without a restart.

Run npx -y snipaya-mcp --help to see the options.

Development

npm cinpm run lintnpm run typechecknpm test          # builds, then runs the bridge over stdio against a local test servernpm run pack:mcpb # builds snipaya-mcp-<version>.mcpb with the official mcpb CLI

Catalog

catalog.json holds the tools, prompts and instructions the bridge serves while Snipaya is not reachable, and manifest.json lists the same tools and prompts. Regenerate both from a checkout of the Snipaya app (default ../snipaya) with Node 22.6 or newer, and commit the result:

npm run sync:catalog -- ../snipaya

Without a token or URL, the bridge reads the settings of the installed Snipaya in ~/Library/Application Support/Snipaya. Development builds of Snipaya keep their settings in their own Snipaya Dev profile folder, so to bridge to one, set SNIPAYA_MCP_TOKEN and SNIPAYA_MCP_URL to the values shown in its Settings > AI Assistants.

Releasing

Pushing a v* tag runs .github/workflows/release.yml. It runs the CI checks, checks that the tag matches the version in package.json, package-lock.json, server.json and manifest.json, stages the version on npm (with provenance), waits up to 60 minutes for a maintainer to approve it, then creates the GitHub release with the .mcpb attached, and publishes server.json to the MCP Registry.

One-time setup

On npmjs.com, open snipaya-mcp > Settings > Trusted publishing, choose GitHub Actions and enter:

npm expires a trusted publisher that has not published within 2 days, so add it shortly before the first release. The MCP Registry and the GitHub release need no setup: they use the workflow's own GitHub token.

Cut a release

npm version minor        # or patch, major: bumps all four files, commits and tags v<version>git push --follow-tags

When the workflow reaches Publish to npm, approve the staged version with a 2FA prompt: npm stage approve snipaya-mcp@<version>, or on the package page on npmjs.com. The rest of the release continues on its own.

Re-running a failed release is safe: it skips the npm and MCP Registry publish when that version is already there, and replaces the bundle on an existing GitHub release.

License

MIT