Venice AI

@veniceai/mcp-server

Model Context Protocol server for the Venice API - uncensored, private AI for any MCP host (Claude Desktop, Cursor, ChatGPT, LM Studio, Continue, LibreChat, Open WebUI, AnythingLLM, Jan, Le Chat).

Plug Venice's chat, image, video, audio, music, and character models into any agent in 30 seconds, including billing and API-key operations. 45 tools across all modalities, one config block.

Requires Node.js 20 or newer; Node.js 22 or 24 is recommended. CI tests Node.js 20, 22, and 24. The refreshed MCP SDK dependency graph requires Node.js 20 for fresh installs, so upgrade Node.js before installing this version if you previously used Node.js 18.

Quick start

1. Get a key from venice.ai

See the API key guide for step-by-step instructions.

2. Add this to your MCP host config

Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows), Cursor (~/.cursor/mcp.json), LM Studio, etc:

{

"mcpServers": { "venice": { "command": "npx", "args": ["-y", "@veniceai/mcp-server@0.3.2"], "env": { "VENICE_API_KEY": " " } } } }

3. Restart your MCP host

That's it. Type a prompt — your agent now has chat, image, video, music, TTS, ASR, and 39 more Venice tools.

What you get

45 tools spanning every Venice modality plus billing and API-key operations, 3 resources (venice://models, venice://styles, venice://voices) and 9 prompt templates: uncensored research, NSFW creative writing and an image style explorer, plus six creator workflows (create image, create video, create audio, YouTube thumbnail, product photoshoot and explainer video) that walk the agent from a brief to a finished result, quoting paid video and music jobs first. Hosts such as Claude Code show them as slash commands, for example /mcp__venice__create-video. VENICE_DISABLE_NSFW=1 hides the first two. The voices resource is built live from each TTS model's catalog metadata.

Every tool declares explicit readOnlyHint, destructiveHint, idempotentHint and openWorldHint annotations to help hosts decide when to request approval. Video and music status tools are marked destructive because their optional delete_media_on_completion argument can delete stored media before returning the result. Hints describe a tool's possible behavior; hosts should still enforce their own approval policy.

💬 Chat & embeddings

🎨 Image

🎬 Video

🔊 Audio (TTS / ASR)

🎵 Music

🌐 Web augment

📚 Catalog

🔐 TEE attestation

Both routes are currently live without authentication. They only apply to text models advertising supportsTeeAttestation. These tools expose evidence; they do not verify it, and this server does not encrypt chat. venice_chat rejects enable_e2ee.

Both chat tools retain the upstream completion id and actual model, when present, in structuredContent. Only responses with the upstream X-Venice-TEE: true header also include those values in an additional JSON text block for text-only clients. Pass those values to venice_tee_signature to retrieve the signature for that completion. Ordinary responses keep their existing answer text without an extra metadata block; the first block and tool-call fallbacks are unchanged. The header is an upstream indication, not cryptographic verification.

Media API behavior

• Successful upstream responses have a default 16 MiB limit, including JSON and text without a declared Content-Length. Tool-specific image, video, audio, transcription, billing, and RPC limits take precedence. Oversized responses fail without a partial result; an inference may already have completed and incurred a charge before the limit is reached. There is no environment override for this default.
• Inline uploads for image upscale, ASR, voice cloning, and document parsing should include a concrete MIME type, for example data:application/pdf;base64,.... Base64 and percent-encoded payloads preserve the original bytes; malformed base64 is rejected before upload. When the type is omitted or application/octet-stream, the server infers PDF, PNG, JPEG, GIF, WebP, WAV, or FLAC from the file signature and supplies a matching filename extension. Other formats require an explicit type; for DOCX use application/vnd.openxmlformats-officedocument.wordprocessingml.document, for MP3 use audio/mpeg, for M4A use audio/mp4, and for Ogg audio use audio/ogg. Shared container signatures and audio tags do not uniquely identify these formats, so these inputs are rejected locally until a concrete type is supplied.
• venice_embeddings accepts at most 128 texts per call, for both float and base64 output. Larger batches are rejected locally before submission, so the rejected batch incurs no upstream charge. Split larger jobs into separate calls; the server never automatically splits or retries a batch. This conservative limit avoids the observed overflow for a 256-text, 4,096-dimension float response, but is not a byte-size guarantee for every model or response encoding. The 16 MiB guard still applies, and an unusually large response from an accepted batch can still be rejected after processing upstream.
• Upstream API redirects are rejected to keep credentials and request bodies at the configured API origin.
• Image aspect_ratio and resolution values remain free strings because supported values vary by model. Venice validates them. When enhance_prompt is applied, image generate/edit/multi-edit results include the URL-decoded enhanced_prompt returned in x-venice-enhanced-prompt. Image responses are capped at VENICE_MAX_IMAGE_RESPONSE_BYTES (default 32 MiB). Unlike an oversized video, an oversized image result cannot be retried for free, so request fewer variants, a lower resolution, or jpeg/webp output for large batches.
• Current public Seedance models may reject media containing detectable persons outright. Defensive support remains for compatible or legacy needs_consent responses: the tool returns Venice's policy text, affected media roles, and next step. The three consents.seedance flags are legal attestations and must only be set to true after the user explicitly confirms all three statements. Consent is never