nanobanana-mcp

A hardened MCP server for Gemini image generation. Fork of ConechoAI/Nano-Banana-MCP with security fixes, strict TypeScript, and model selection.

Features

• 3 tools: generate_image, edit_image, continue_editing

• Model selection via NANOBANANA_MODEL env var with whitelist validation

• Security hardened: path traversal protection, file size limits, no plaintext key storage

• Strict TypeScript: zero any types, Zod validation on all inputs

Related MCP server: Nano-Banana MCP Server

Quick Start

Claude Code

Add to ~/.claude/settings.json:

{
  "mcpServers": {
    "nanobanana": {
      "command": "npx",
      "args": ["tsx", "/path/to/nanobanana-mcp/src/index.ts"],
      "env": {
        "GEMINI_API_KEY": "your-api-key",
        "NANOBANANA_MODEL": "gemini-2.5-flash-image"
      }
    }
  }
}

Other MCP Clients

GEMINI_API_KEY=your-key npx tsx src/index.ts

The server communicates over stdio using the MCP protocol.

Tools

generate_image

Generate a new image from a text prompt.

prompt (required): Text describing the image to create (max 10,000 chars)

edit_image

Edit an existing image with a text prompt.

imagePath (required): Full file path to the image to edit
prompt (required): Text describing the modifications (max 10,000 chars)
referenceImages (optional): Array of file paths to reference images

continue_editing

Continue editing the last generated/edited image in the current session.

prompt (required): Text describing changes to make (max 10,000 chars)
referenceImages (optional): Array of file paths to reference images

Configuration

All configuration is via environment variables. No config files are written to disk.

Available Models

Output

Generated images are saved to ~/nanobanana-images/ with unique filenames. The tool response includes both the file path and the image data inline.

Security

This fork addresses the following security issues from the original:

Development

npm install
npm run typecheck   # Type check without emitting
npm run dev         # Run with tsx (hot reload)
npm run build       # Compile to dist/

Project Structure

src/
  index.ts          # MCP server entry point (3 tool handlers)
  gemini-client.ts  # Gemini API wrapper with model selection
  file-handler.ts   # Secure file I/O with path validation
  types.ts          # TypeScript interfaces and Zod schemas

License

MIT - Based on ConechoAI/Nano-Banana-MCP