Borrowing it
Nothing to install: this file belongs to hanoak/pixabay-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/hanoak/pixabay-mcp-server/main/CLAUDE.mdgit clone --depth 1 https://github.com/hanoak/pixabay-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/hanoak/pixabay-mcp-server/claude-md)<a href="https://agentmods.dev/instructions/hanoak/pixabay-mcp-server/claude-md"><img src="https://agentmods.dev/badge/instructions/hanoak/pixabay-mcp-server/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/hanoak/pixabay-mcp-server/claude-md"><img src="https://agentmods.dev/badge/instructions/hanoak/pixabay-mcp-server/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.03594 | $0.03594 |
| Opus 5 | $0.01797 | $0.01797 |
| Sonnet 5 | $0.00719 | $0.00719 |
| Haiku 4.5 | $0.00359 | $0.00359 |
Grade A, and why
pixabay-mcp-server CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 244 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
Guidance for Claude Code (and any contributor) working in this repository.
Project overview
@hanoak/pixabay-mcp-server is a production-ready Model Context Protocol (MCP) server
for the Pixabay API — search and fetch royalty-free
images and videos. Unofficial; not affiliated with or endorsed by Pixabay.
Quality bar: production-ready, legal/safe, community-maintained open-source npm package —
not a prototype. Every decision should be defensible to a stranger reading the repo cold.
This bar and most of the conventions below are carried over as-is from the author's prior
unsplash-mcp-server project; deviations exist only where Pixabay's API genuinely differs
(see "Where this differs from unsplash-mcp-server" at the end).
Tech stack (decided — do not relitigate without discussion)
- Language/runtime: TypeScript, Node.js
>=20, ESM-only. - MCP SDK:
@modelcontextprotocol/sdk. - Validation:
zodfor both tool input schemas and Pixabay response schemas. - Transport:
stdioonly. No HTTP/SSE unless a concrete client need appears. - Build:
tsup→ single ESM bundle indist/,#!/usr/bin/env nodebanner,.d.tsoutput. - Test runner:
vitest(+@vitest/coverage-v8). - Lint/format: ESLint flat config (
typescript-eslint+eslint-config-prettier); Prettier (semi: false,singleQuote: true,printWidth: 100,trailingComma: all). - Release: Changesets → GitHub Actions → npm publish with provenance.
- Commits: Conventional Commits, enforced by commitlint on a
commit-msghook. - npm package:
@hanoak/pixabay-mcp-server, binpixabay-mcp-server, mcp registry nameio.github.hanoak/pixabay-mcp-server. First release is1.0.0, not0.1.0.
Pixabay API facts that drive design (verify against current docs before relying on exact numbers)
- Auth: a single API key passed as the
keyquery parameter — Pixabay has no header option. This is an upstream constraint, not a choice; see Security below for how it's compensated for. - No OAuth, no write endpoints. Pixabay's public API is search/read-only (images +
videos). There is no user-authenticated tier-2 surface, so this project has no
auth/directory, nologin/logoutCLI, no credential store — a deliberate simplification versusunsplash-mcp-server. - Two resource domains only: images (
GET https://pixabay.com/api/) and videos (GET https://pixabay.com/api/videos/). No users/collections/topics/stats endpoints. - Rate limit: ~100 requests / 60 seconds per key, surfaced via
X-RateLimit-Limit/X-RateLimit-Remaining/X-RateLimit-Resetresponse headers; exceeding it returns429with an"API rate limit exceeded"message. - Mandatory 24-hour response caching. Unlike Unsplash (where caching was explicitly skipped), Pixabay's terms require callers to cache results for 24 hours to keep the API fast for everyone. This is a required architecture component here, not an optimization — see the cache layer below.
- No permanent hotlinking. Pixabay's terms disallow using Pixabay CDN URLs as permanent image sources in an app; images displayed persistently should be downloaded to your own server first (videos may be embedded directly). An MCP server returns URLs to an LLM client for a single, ephemeral display in conversation — arguably not the "permanent hotlinking in an app" the term targets — but this is a genuine gray area, not a settled fact. Do not treat this as legally resolved; flag it in the ROADMAP for an explicit, documented policy decision before v1 ships, and revisit if Pixabay clarifies.
- No systematic mass downloads. The API is "made for real human requests." Don't build a tool that auto-paginates through an entire result set or fires many requests per user turn.
- Attribution is optional, not required — all content is under the Pixabay License
(free for commercial and noncommercial use). Surface a courtesy credit
(
"by {user} via Pixabay"+ a link to thepageURL) when convenient; never gate functionality on it, and never claim it's legally mandatory in docs/instructions text. - Content safety: the
safesearchboolean param exists; default it totrueon search/lookup tools, mirroring Unsplash'scontent_filter=highdefault.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 244 lines · 3,594 tokens per session scan A 694c5ca35258
pixabay-mcp-server CLAUDE.md is an instructions file published in the GitHub repository hanoak/pixabay-mcp-server (1 stars, last pushed 13d ago), licensed MIT. It adds 3,594 tokens to every session, about $0.0180 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.