Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent IMIVA ecommerce image-generation helper, but it sends your IMIVA token and selected product media to IMIVA’s MCP service.
Install this only if you trust IMIVA and the npm package it runs. Provide the MCP token through a scoped client secret or clean shell environment, do not use sensitive product/customer images unless you intend to send them to IMIVA, and confirm model, quantity, and credit cost before creating tasks. Pinning the npm package version would reduce supply-chain drift from `@latest`.
env = os.environ.copy()
env["MCP_TOKEN"] = token
env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
proc = subprocess.Popen(
[npx, "-y", PACKAGE],
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,npx = shutil.which("npx")
if not npx:
raise SystemExit("未找到 npx。请先安装 Node.js 18 或更高版本。")
token = os.environ.get("MCP_TOKEN", "").strip()
if not token:
raise SystemExit("缺少 MCP_TOKEN。请在 IMIVA 的 MCP Token 页面创建后通过环境变量提供。")
return npx, tokendef invoke(method: str, params: dict | None = None) -> dict:
npx, token = require_runtime()
env = os.environ.copy()
env["MCP_TOKEN"] = token
env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
proc = subprocess.Popen(No suspicious patterns detected.