# @alisaitteke/noun-mcp Production MCP server for The Noun Project — search & download icons in Cursor/Claude with OAuth… - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 1.0.6 - **Author:** io.github.alisaitteke - **License:** Unknown - **npm:** @alisaitteke/noun-mcp - **Source:** https://github.com/alisaitteke/noun-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-09-17T13:24:19.832Z - **Version scanned:** 1.0.6 - **CVEs:** none found by OSV at scan time ## Tools 7 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `search_icons` — Search The Noun Project for icons. Returns IDs, style, license, thumbnails, tags, and attribution. This is a cheap *service* call — do NOT follow up with get_ic - `get_icon` — Get extra details for one icon, including a temporary SVG icon_url (expires in 1 hour). This is an expensive *icon* call (FREE trial: 150/day and 150/month). Sk - `download_icon` — Download one icon as SVG or PNG (optional color/size; FREE trial is public-domain only). This is an expensive *icon* call (150/day on the free trial). Use only - `search_collections` — Search Noun Project collections (icon sets). Service call — cheaper than get_icon/download_icon. - `get_collection` — Get a collection and a page of its icons. Service call. Prefer this over calling get_icon on each member. - `icon_autocomplete` — Autocomplete icon search terms (max 10). Cheap service call — use before searching if the query is ambiguous. - `check_usage` — Show current API usage vs limits for hourly, daily, and monthly windows, split into service calls vs icon calls. Cached for 5 minutes. ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"noun\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@alisaitteke/noun-mcp\"\n ],\n \"env\": {\n \"NOUN_CONSUMER_KEY\": \"\",\n \"NOUN_CONSUMER_SECRET\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `NOUN_CONSUMER_KEY` — Noun Consumer Key (required) - `NOUN_CONSUMER_SECRET` — Noun Consumer Secret (required) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 2 credentials (2 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Moderate blast radius — holds an api key; runs on your machine. - Floor 25, ceiling 25 (tier: moderate) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40alisaitteke%2Fnoun-mcp - Install plan: https://forgeregistry.com/api/v1/packages/%40alisaitteke%2Fnoun-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40alisaitteke%2Fnoun-mcp - HTML page: https://forgeregistry.com/registry/%40alisaitteke%2Fnoun-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.