Conversions across 221 color spaces, tested against cited sources: CSS strings, gamut, LUTs
Nothing to run from here
Portrait is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
93/100
tool-list score
66
tools declared
remote
at its publisher
—
calls last 7d
What it does
Generate images, video, speech, 3D, slide decks, Word/Excel/PDF docs, product cards, and AI chat.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --transport http portrait-mcp https://arckep.ru/api/v1/mcp
# 2 — ask your agent for something these tools do
# list_models, get_balance, get_usage and 63 more
Portrait costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
ARAll 1 server
arckep1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.
Claude Codedeclared by this listing
This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it. Its publisher asks you to sign in with OAuth: run /mcp in Claude Code and pick this server, and it opens a browser for that once.
claude mcp add --scope user --transport http portrait-mcp https://arckep.ru/api/v1/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add — the only sign-in is its publisher’s own, with OAuth.
What it writes
One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.
What you approve
66 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
List image, video, 3D, chat, decision, STT and TTS models exposed by the public API. Each model includes a human-readable description and capability tags. Use modes, resolutions, aspect_ratios, duration/reference limits, output_formats and chat context_window / max_output_tokens to choose a model; null fields mean unspecified, not unlimited. Legacy image/video features may include Studio-only fun
Takes no parameters.
Get the effective personal or corporate balance in RUB.
Takes no parameters.
Get RUB spend of the caller's API keys: today, last 7 days, the last days (1-90), per day and per model, plus the balance and an estimate of the days it lasts (null without spend). key_only=true counts only the key behind this connection. Read-only; charges nothing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| days | integer | no | Window in Moscow calendar days, today included |
| key_only | boolean | no | true: only the key that signs this request; false: all your keys |
Quote an image job. Pass API fields such as model, num_images, quality and resolution.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Start a paid image job. Request needs model and prompt; max_cost_rub is optional.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | no | — |
List the caller's image jobs, newest first.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | — |
| before_id | no | — |
Get the status, cost and output of one image job. Defaults to the format requested at creation. b64_json adds original file bytes to output.images (up to 16 MiB decoded in total); URLs remain present. Use response_format=url for a compact result, including when inline retrieval exceeds its limits. Reading a result never starts or charges a job.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| generation_id | integer | yes | — |
| response_format | no | — |
Quote a video job. Pass API fields such as model, duration_seconds and resolution. Not for higgsfield-* models: use estimate_higgsfield_cinema / estimate_higgsfield_genjutsu / estimate_higgsfield_restyle / estimate_higgsfield_wan_prime.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Start a paid video job. Request follows POST /api/v1/videos/generations. Not for higgsfield-* models: use create_higgsfield_cinema / create_higgsfield_genjutsu / create_higgsfield_restyle / create_higgsfield_wan_prime.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | no | — |
List the caller's video jobs, newest first.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | — |
| before_id | no | — |
Get the status, cost and output of one video job, including Higgsfield jobs.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| video_id | integer | yes | — |
Quote a Higgsfield Cinema Studio 4.0 video (higgsfield-cinema-4) in RUB; nothing is charged. Same request as create_higgsfield_cinema (webhook_url is accepted and ignored). The price follows the provider's live estimate and depends on duration, resolution, audio and the reference videos you pass.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Start a paid Higgsfield Cinema Studio 4.0 video (POST /api/v1/higgsfield/cinema/generate). Needs prompt. duration is 4-30 seconds; resolution 480p or 720p. Reference media: image_urls (up to 30), video_urls (up to 10), audio_urls (up to 10). Each item is a public HTTPS URL or the key/url returned by upload_media (images, mp4/webm video and mp3/wav/m4a/aac audio can be uploaded). Run estimate_higg
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | no | — |
Quote a Higgsfield Genjutsu video in RUB; nothing is charged. kind motion/swap selects Genjutsu; light-motion/light-swap selects Genjutsu Light. Light uses the first 15 seconds, keeps source audio and charges input plus output seconds. Same request as create_higgsfield_genjutsu; cost_rub is the price to pass as max_cost_rub.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| kind | string | yes | — |
| request | yes | — |
Start a paid Higgsfield Genjutsu video (POST /api/v1/higgsfield/genjutsu/{kind}/generate). kind motion/swap selects Genjutsu: source 4-30 s (swap: at least 409600 frame pixels). light-motion/light-swap selects Light: the first 15 s are used and source audio is kept. Needs video_url, image_urls (1-8), resolution 480p/720p/1080p and optional prompt. Media is a public HTTPS URL or a key/url from upl
| Parameter | Type | Required | Notes |
|---|---|---|---|
| kind | string | yes | — |
| request | yes | — | |
| idempotency_key | no | — |
List the visual styles Higgsfield Genjutsu Restyle can apply (nothing is charged). Each item has id, name (English), name_ru and preview_url. Pass the chosen id as preset_id to estimate_higgsfield_restyle / create_higgsfield_restyle. The list is Higgsfield's current one; source says live, cache or fallback (our snapshot when Higgsfield did not answer).
Takes no parameters.
Quote a Higgsfield Genjutsu Restyle video in RUB; nothing is charged. Same request as create_higgsfield_restyle. The price depends on the source video length and resolution, not on the style.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Start a paid Higgsfield Genjutsu Restyle video (POST /api/v1/higgsfield/genjutsu/restyle/generate). Redraws the whole source video in one chosen style; motion, camera and the source audio stay. Needs video_url (a source video of 4-30 seconds) and preset_id (an id from list_higgsfield_restyle_styles). Optional: image_urls (up to 5 character photos), prompt, resolution 480p, 720p or 1080p. Media is
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | no | — |
Quote a Wan 3.0 Prime video (higgsfield-wan-3-prime) in RUB; nothing is charged. Same request as create_higgsfield_wan_prime (webhook_url is accepted and ignored). The price is per second of the finished video and depends on duration and resolution; sound, deep thinking and reference files do not change it.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Start a paid Wan 3.0 Prime video (POST /api/v1/higgsfield/wan-prime/generate). Needs prompt. duration is 2-30 seconds; resolution 480p, 720p (default) or 1080p; aspect_ratio 16:9, 4:3, 1:1, 3:4, 9:16 or adaptive; generate_audio (default true); enable_thinking makes the model plan the scene first (same price); optional seed. The input picks the mode: no files is text to video; image_url (the first
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | no | — |
Cancel a Higgsfield video that is still queued at the provider and refund the charge. Fails once the provider has started the video.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| video_id | integer | yes | — |
Quote a 3D job. Pass the API model, prompt or image_url(s) and quality settings (rodin-v2.5: variant, high_pack, tpose).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Start a paid 3D job. Request follows POST /api/v1/models3d/generations.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | no | — |
List the caller's 3D jobs, newest first.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | — |
| before_id | no | — |
Get the status, cost and output of one 3D job.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| job_id | integer | yes | — |
Download a completed 3D job as base64 binary STL or 3MF, without new provider billing.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| job_id | integer | yes | — |
| target_size_mm | no | — | |
| scale_axis | string | no | — |
| z_up | boolean | no | — |
| place_on_bed | boolean | no | — |
| print_format | string | no | — |
Run free (0 RUB) Tripo v3 pre-rigging check on an owned completed 3D job (source_job_id) or public HTTPS 3D model_url.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Quote exact RUB price for Direct Tripo v3 or Meshy Retexture (texture_model='tripo' | 'meshy-n1-retexture' | 'meshy-v7-retexture') rigging, animation retargeting, re-texturing, segmentation, retopology or conversion.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Start a paid Direct Tripo v3 or Meshy Retexture post-processing job (rig, retarget, rig_and_retarget, texture with texture_model='tripo' | 'meshy-n1-retexture' | 'meshy-v7-retexture', segment, smartsegment, complete, decimate, uv, convert).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | no | — |
Typical cost of a presentation in RUB; nothing is charged and no deck is started. Presentations are priced by actual usage (the real Claude session cost times rate_rub_per_usd), so there is no exact quote: typical_cost_rub is the median final cost per tier (fast, pro) over the last 30 days, or null while there are too few finished decks. Revisions add to the cost of the same presentation. min_bal
Takes no parameters.
Start a PowerPoint presentation built by Claude (POST /api/v1/presentations). Paid by actual usage. The balance is charged when the agent finishes each turn; a turn that ends with no result is refunded. With too little money on the balance the answer is 402 INSUFFICIENT_BALANCE and nothing is started. This is a long task of several minutes: the answer comes at once with an id and status running.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | no | — |
List the caller's presentations (id, title, status, version, cost), newest first. Files are in get_presentation.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | — |
| before_id | no | — |
Get the status, cost and files of one presentation. status: pending/running (the agent is working: ask again in a minute or two), awaiting_input (a turn is done: result is ready and revise_presentation is possible), completed, failed (error says why) or archived. When result is set, give the user result.pptx_url (editable PowerPoint) and result.pdf_url, and show result.slides (n, title, image_url
| Parameter | Type | Required | Notes |
|---|---|---|---|
| presentation_id | integer | yes | — |
Send the agent a message about a presentation (POST /api/v1/presentations/{id}/messages). Paid by actual usage. request.text is a change request ("shorten slide 3", "another theme") or a question / discussion. The agent decides from the text: it either answers and updates the presentation map without rebuilding the deck, or rebuilds the deck when asked; result.version grows only when the deck cha
| Parameter | Type | Required | Notes |
|---|---|---|---|
| presentation_id | integer | yes | — |
| request | yes | — |
Stop the agent's current turn. The presentation stays (status awaiting_input), so revise_presentation can follow.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| presentation_id | integer | yes | — |
Typical cost of a Word, Excel or PDF document in RUB; nothing is charged and nothing is started. Documents are priced by actual usage (the real Claude session cost times rate_rub_per_usd), so there is no exact quote: typical_cost_rub is the median final cost per tier (fast, pro) over the last 30 days, or null while there are too few finished documents. Revisions add to the cost of the same docume
Takes no parameters.
Start a Word, Excel or PDF document built by Claude (POST /api/v1/documents). Paid by actual usage. The balance is charged when the agent finishes each turn; a turn that ends with no result is refunded. With too little money on the balance the answer is 402 INSUFFICIENT_BALANCE and nothing is started. This is a long task of several minutes: the answer comes at once with an id and status running.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | no | — |
List the caller's documents (id, format, title, status, version, cost), newest first. Files are in get_document.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | — |
| before_id | no | — |
Get the status, cost and files of one document. status: pending/running (the agent is working: ask again in a minute or two), awaiting_input (a turn is done: result is ready and revise_document is possible), completed, failed (error says why) or archived. When result is set, give the user result.file_url (the document itself: DOCX, XLSX or PDF, see format) and result.pdf_url (a PDF copy for viewi
| Parameter | Type | Required | Notes |
|---|---|---|---|
| document_id | integer | yes | — |
Send the agent a message about a document (POST /api/v1/documents/{id}/messages). Paid by actual usage. request.text is a change request ("add a section on risks", "make the totals formulas") or a question. The agent decides from the text: it either answers and updates the summary without rebuilding the file, or rebuilds the document when asked; result.version grows only when the file changed, la
| Parameter | Type | Required | Notes |
|---|---|---|---|
| document_id | integer | yes | — |
| request | yes | — |
Stop the agent's current turn. The document stays (status awaiting_input), so revise_document can follow.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| document_id | integer | yes | — |
Price range of a Wildberries / Ozon card pack in RUB; nothing is charged and nothing is started. The planner chooses the slide count (3-12 here, 4 by default), so there is a range: cost_min_rub (1 photo, fewest slides), cost_typical_rub (1 photo, 4 slides) and cost_max_rub (8 photos, 12 slides). The pack is charged once, at its real price, when the plan is ready, and a pack that fails is refunded
Takes no parameters.
Start a pack of product cards for Wildberries or Ozon (POST /api/v1/marketplace-cards/generations). Paid. From 1-8 photos of one product and its description the service plans the pack and draws a cleaned product photo plus 3-12 slides (cover, benefits, specs, details, ...) in the marketplace's 3:4 format, keeping the marketplace's safe zones free. This is a long task of 3-8 minutes: the answer co
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | no | — |
List the caller's finished card packs, newest first (id, marketplace, title, cost, pictures). before_id is the id of the last pack already seen. A pack that is still running is not listed: ask for it with get_marketplace_cards by the id create_marketplace_cards returned.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | — |
| before_id | no | The id of the last pack already seen |
Get the status, cost and pictures of one card pack. status: queued/processing (the pack is being built: progress_pct says how far, ask again in a minute or two), completed or failed (nothing stays charged). When completed, give the user output.images: index 0 with role clean is the cleaned product photo, the rest are the slides (cover first), each with its url, role and headline. output.warnings
| Parameter | Type | Required | Notes |
|---|---|---|---|
| pack_id | string | yes | — |
Upload an image, video (mp4/webm), audio (mp3/wav/m4a/aac) or a document for a presentation or document job, up to 10 MiB, as base64. Returns key and url; either can be used as a media reference (for example Higgsfield image_urls, video_urls, audio_urls). The file type is checked by content, not by the header. A document (PPTX, PDF, DOCX, XLSX, TXT, MD, CSV) is for the file_urls of create_presen
| Parameter | Type | Required | Notes |
|---|---|---|---|
| filename | string | yes | — |
| content_type | string | yes | — |
| content_base64 | string | yes | — |
Run a paid chat completion. Pass model and messages; streaming is unavailable in an MCP tool result.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Estimate speech-to-text cost for a model and duration in seconds.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Transcribe base64 audio, up to 10 MiB. Larger files use the HTTP multipart API. Completes synchronously. Keep the same idempotency_key on retries after a timeout. request contains model, language, diarize, word_timestamps and response_format.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| filename | string | yes | — |
| content_base64 | string | yes | — |
| idempotency_key | string | yes | — |
| content_type | string | no | — |
Estimate Gemini speech cost. Approximate: actual text and audio tokens determine the charge.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Generate Gemini speech synchronously, returning a completed result with a WAV URL. Supports style, two-speaker turns and owned custom voices. Reuse idempotency_key on retry.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | string | yes | — |
List the caller's completed Gemini speech (studio and API), newest first.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | — |
| before_id | no | — |
Get owned completed Gemini speech with a fresh WAV download URL.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| speech_id | integer | yes | — |
List Google's prebuilt voices without generating audio.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| search | string | no | — |
| page_token | string | no | — |
List the caller's unexpired custom Google voices, created in the studio or with this API. Use a voice's id as custom_voice_id in create_speech. saved_limit is how many saved (stored) voices you may keep. Google's private voice keys are never returned.
Takes no parameters.
Create a custom voice from a text description. Free; the voice lives 365 days. request: display_name, prompt (10-1000 characters: age, timbre, pace, manner, accent), gender (male, female or neutral) and optional language_code (default ru-RU). The result holds the voice (use its id as custom_voice_id in create_speech) and a short sample. An account keeps at most 5 saved voices (made here or in the
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Clone a voice from a recording. Free. Only for a voice whose owner has agreed to be cloned. source_audio_base64: the voice sample. consent_audio_base64: the same person reading the consent phrase, recorded separately. Both are WAV, 24 kHz, mono, 16-bit, up to 5 MiB each, as base64; the sample lasts 10-30 s and the consent recording 2-30 s. The consent phrase must be read word for word, in Russian
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| source_audio_base64 | string | yes | — |
| consent_audio_base64 | string | yes | — |
Delete one of your own custom voices (id from list_my_speech_voices). A stored voice is also removed at Google.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| voice_id | integer | yes | — |
Ask a typed decision: Jev (text state + questions object) or GPT-6 Luna (input text/base64 images + questions list). Returns probabilities, not prose. Charges input tokens.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Search the web: ranked results with title, url, snippet and a longer summary. Pass need_content=true for the page text. Charges a flat RUB price per request that returns results; an empty result is free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Read one web page (http/https url) and return its text as Markdown. Charges a flat RUB price per page that is read; a page that cannot be read is free.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — |
Create a paid OpenAI or Anthropic chat batch with a caller-supplied idempotency key.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| request | yes | — | |
| idempotency_key | string | yes | — |
List recent public chat batches.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| limit | integer | no | — |
Get one chat batch and its provider status.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| batch_id | string | yes | — |
Get completed batch items and their final charges.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| batch_id | string | yes | — |
Cancel an in-progress chat batch.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| batch_id | string | yes | — |
Free
$0 forever
- Every tool — any call limit is its publisher’s, not ours
- No card, and mcprush charges nothing for it
- Runs at its publisher’s own address — this marketplace is not in the path
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Portrait or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATool-list grade · score 93 / 100
Release 1.0.0 · scanned 9 Nov 2026
Graded from the tools this server lists, not from its source code.
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score93
Findings0 threat · 1 capability
Capabilitymoderate
Coveragemanifest
Verificationnot in this report
Surface digest60833d3c4a0b221385394c17396e55f9659331e8143fb37e2cf8daf91b6f88cf
Score vectorthreat 100 → client 93
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | moderate | capability blast radius (moderate) — client exposure if the model is manipulated | −3 |
| coverage-honesty | manifest | inspection depth (manifest) — how much of the target the scan could see | −4 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.
Tool surfaceread
Implementation sourcenot available
Package metadatanot available
Live transportnot available
The implementation source was not read — this reflects the declared tool metadata only.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| list_models | no tags | |
| get_balance | no tags | |
| get_usage | no tags | |
| estimate_image | no tags | |
| create_image | state-write | state-write: declares readOnlyHint: false |
| list_images | no tags | |
| get_image | no tags | |
| estimate_video | no tags | |
| create_video | state-write | state-write: declares readOnlyHint: false |
| list_videos | no tags | |
| get_video | no tags | |
| estimate_higgsfield_cinema | no tags | |
| create_higgsfield_cinema | external-sinkstate-write | external-sink: keyword "webhook"; state-write: declares readOnlyHint: false |
| estimate_higgsfield_genjutsu | no tags | |
| create_higgsfield_genjutsu | external-sinkstate-write | external-sink: keyword "webhook"; state-write: declares readOnlyHint: false |
| list_higgsfield_restyle_styles | no tags | |
| estimate_higgsfield_restyle | no tags | |
| create_higgsfield_restyle | external-sinkstate-write | external-sink: keyword "webhook"; state-write: declares readOnlyHint: false |
| estimate_higgsfield_wan_prime | no tags | |
| create_higgsfield_wan_prime | external-sinkstate-write | external-sink: keyword "webhook"; state-write: declares readOnlyHint: false |
| cancel_higgsfield_video | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| estimate_3d | no tags | |
| create_3d | state-write | state-write: declares readOnlyHint: false |
| list_3d | no tags | |
| get_3d | no tags | |
| download_3d_stl | untrusted-input | untrusted-input: keyword "download" |
| check_3d_rig | state-write | state-write: declares readOnlyHint: false |
| estimate_3d_process | no tags | |
| create_3d_process | state-write | state-write: declares readOnlyHint: false |
| estimate_presentation | no tags | |
| create_presentation | untrusted-inputstate-write | untrusted-input: keyword "fetch"; state-write: declares readOnlyHint: false |
| list_presentations | no tags | |
| get_presentation | no tags | |
| revise_presentation | state-write | state-write: declares readOnlyHint: false |
| cancel_presentation | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| estimate_document | no tags | |
| create_document | untrusted-inputstate-write | untrusted-input: keyword "fetch"; state-write: declares readOnlyHint: false |
| list_documents | no tags | |
| get_document | no tags | |
| revise_document | state-write | state-write: declares readOnlyHint: false |
| cancel_document | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| estimate_marketplace_cards | no tags | |
| create_marketplace_cards | untrusted-inputstate-write | untrusted-input: keyword "fetch"; state-write: declares readOnlyHint: false |
| list_marketplace_cards | no tags | |
| get_marketplace_cards | no tags | |
| upload_media | state-write | state-write: declares readOnlyHint: false |
| chat_completion | state-write | state-write: declares readOnlyHint: false |
| estimate_transcription | no tags | |
| create_transcription | state-write | state-write: declares readOnlyHint: false |
| estimate_speech | no tags | |
| create_speech | state-write | state-write: declares readOnlyHint: false |
| list_speech | no tags | |
| get_speech | untrusted-input | untrusted-input: keyword "download" |
| list_speech_voices | no tags | |
| list_my_speech_voices | no tags | |
| design_speech_voice | state-write | state-write: declares readOnlyHint: false |
| replicate_speech_voice | state-write | state-write: declares readOnlyHint: false |
| delete_speech_voice | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
| decide | state-write | state-write: declares readOnlyHint: false |
| web_search | untrusted-inputstate-write | untrusted-input: keyword "web_search"; state-write: declares readOnlyHint: false |
| web_fetch | untrusted-inputstate-write | untrusted-input: keyword "fetch"; state-write: declares readOnlyHint: false |
| create_chat_batch | state-write | state-write: declares readOnlyHint: false |
| list_chat_batches | no tags | |
| get_chat_batch | no tags | |
| get_chat_batch_results | no tags | |
| cancel_chat_batch | state-write | state-write: declares readOnlyHint: false, destructiveHint: true |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
flow-1
Untrusted input can drive an external action even though no sensitive source is exposed.
Supply chain and provenance
Integrityfirst-seen
Surface digest60833d3c4a0b2213
Scanned2026-11-09
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
This is an address its publisher runs: which release it serves is theirs to choose, so there is nothing here to pin. The history below is for reading; the current release on file is 1.0.0.
1.0.0
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Portrait can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.