# realtime-avatar-mcp MCP server for Realtime Avatar — let a coding agent read your avatars, balance and bill directly. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.27.4 - **Author:** The Influence Company - **License:** MIT - **npm:** realtime-avatar-mcp - **Source:** https://github.com/theinfluencecompany/realtime-avatar-sdk - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-10-16T00:21:32.140Z - **Version scanned:** 0.27.4 - **CVEs:** none found by OSV at scan time ## Tools 12 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `list_avatars` — Every avatar on this account, with the id you pass to startCall. Call this before - `get_avatar` — Full detail for a single avatar, including its clip set and voice. - `credit_balance` — Current balance and how much is reserved by in-flight calls. - `list_sessions` — The itemised bill: every session with when it ran, how long it was billable for, - `list_clips` — The declared clip library: every non-retired clip with its render status, plus - `start_call` — Mint a live session to verify an integration end to end. This starts a real call - `set_clip_library` — Declare the avatar's FULL desired clip library — a declaration, not a delta: - `set_loop` — Re-generate the RESTING LOOP — the video she plays when nothing else is happening — - `upload_asset` — Upload a file FROM THIS MACHINE'S DISK and get back a public URL usable as a clip - `create_remote_asset` — Point at a public URL and get an asset back without downloading it locally. Use - `create_avatar_from_image` — Build an avatar from a SINGLE still image — the shortest path, and the one to reach - `create_avatar_from_video` — DEPRECATED AND CLOSED — this answers 422 unless the tenant was already creating ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"realtime-avatar\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"realtime-avatar-mcp\"\n ],\n \"env\": {\n \"REALTIME_AVATAR_API_KEY\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `REALTIME_AVATAR_API_KEY` — Realtime Avatar API Key (required) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 1 credential (1 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — mutates data; holds an api key. - Floor 46, ceiling 46 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/realtime-avatar-mcp - Install plan: https://forgeregistry.com/api/v1/packages/realtime-avatar-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/realtime-avatar-mcp - HTML page: https://forgeregistry.com/registry/realtime-avatar-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.