# Creative Assets MCP v1.0

A professional remote MCP server for Claude, Cowork, Claude Desktop, and other MCP clients.

## Main purpose

Creative Assets MCP gives Claude a governed asset layer instead of allowing random, inconsistent asset selection.

It enforces:

- One icon family per project or carousel
- No mixing of Outline and Filled icon styles
- SVG-first icon workflows
- Consistent stroke width where the SVG truly uses strokes
- Source and licensing metadata for every asset
- Export manifests and license reports
- Safe SVG validation
- Project-specific brand asset libraries

## Included MCP tools

### Discovery
- `search_assets`
- `search_icons`
- `search_brand_assets`

### Retrieval and metadata
- `get_svg`
- `get_asset_metadata`

### Transformation
- `convert_stroke_width`
- `generate_color_palette`
- `generate_svg_pattern`

### Brand library
- `register_brand_asset`

### Governance and delivery
- `validate_asset_consistency`
- `export_asset_set`
- `generate_license_report`

## Version 1.0 providers

### Public icon provider
- Iconify API

### Private/project provider
- Persistent project brand library

### Built-in generators
- Deterministic color palettes
- Repeatable SVG patterns

Version 1.0 deliberately does not fabricate integrations with illustration, font, mockup, or stock providers. Those can be added later through documented adapters.

## Local development

Requirements:

- Node.js 20 or newer
- npm

```bash
cp .env.example .env
npm install
npm run check
npm run build
npm test
npm start
```

Then open:

```text
http://localhost:3000/health
```

The MCP endpoint is:

```text
http://localhost:3000/mcp
```

Claude's web custom connector cannot connect to localhost. You must deploy the server to a public HTTPS URL.

## Docker

```bash
docker compose up --build
```

## Deploy to Render

1. Create a GitHub repository.
2. Upload this project.
3. In Render, create a Blueprint from the repository.
4. Render reads `render.yaml`.
5. Wait for deployment.
6. Copy the public URL.
7. Your MCP URL will be:

```text
https://YOUR-RENDER-SERVICE.onrender.com/mcp
```

The starter configuration creates a persistent disk.

## Deploy to Railway

1. Create a GitHub repository.
2. Upload this project.
3. Create a Railway project from the repository.
4. Railway detects the Dockerfile.
5. Add a persistent volume mounted at `/app/data` or set `DATA_DIR` to your volume.
6. Generate a public domain.
7. Use:

```text
https://YOUR-RAILWAY-DOMAIN/mcp
```

## Add to Claude and Cowork

After deployment:

1. Open Claude.
2. Go to `Customize`.
3. Open `Connectors`.
4. Click `+`.
5. Select `Add custom connector`.
6. Name it `Creative Assets MCP`.
7. Paste your public MCP URL ending in `/mcp`.
8. Add authentication details only if your deployment supports the selected authentication flow.
9. Add the connector.
10. Enable it in a conversation from the `+` menu.

## Authentication

The included server supports an optional static bearer token through:

```text
MCP_API_KEY
```

However, Claude's custom connector UI is designed primarily for public MCP endpoints or OAuth-enabled connectors. A production multi-user service should add standards-compliant OAuth instead of sharing one static key.

For a private first deployment, use one of these approaches:

- Deploy without `MCP_API_KEY` and keep the URL private while testing.
- Put the MCP server behind a compatible OAuth gateway.
- Extend the server with MCP OAuth before public release.

Do not publish an unauthenticated write-enabled MCP server as a public service.

## Persistence

Version 1.0 uses JSON files in:

```text
data/projects/
data/brand-assets/
```

For production scale, replace the JSON store with PostgreSQL, object storage, or another persistent database.

## Important stroke-width limitation

Some icon families look like outline icons but are encoded as filled path geometry. They have no real SVG `stroke-width`.

Creative Assets MCP refuses to deform those paths automatically. It returns a warning instead.

Use truly stroke-based families when exact stroke normalization is required.

## Export package

`export_asset_set` creates:

```text
set-name/
├── icon-1.svg
├── icon-2.svg
├── manifest.json
└── LICENSES.md
```

It also creates a ZIP archive.

## Production hardening checklist

Before public deployment:

- Add OAuth 2.1
- Replace JSON persistence with PostgreSQL
- Store exports in object storage
- Add rate limiting
- Add request audit logs
- Add per-user/project authorization
- Add automatic deletion policies
- Add provider health monitoring
- Add malware scanning for uploaded assets
- Add signed download URLs
- Review every third-party provider license