image_crop

SERVERTanod SOURCEhttps://tanod.dev/mcp

High RISK CLASS

Category Execute

Parameters 120 required

Recommended Rate-limitedsee the rule below

Registry record Grade F, identity unverified Pull the record →

This record as markdown: /tools/dev-tanod-tanod/image-crop.md

WHAT IT DOES

What image_crop does on Tanod

AI agents invoke image_crop to trigger actions in Tanod. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Parameter	Type	Required	Description
`top`	object	—	Box mode: top edge in pixels.
`url`	object	—	Public http(s) URL of the image (at most 10 MB; private, internal and IP-literal hosts are refused); or use image_base64.
`left`	object	—	Box mode: left edge in pixels (give left, top, width and height together, or aspect).
`width`	object	—	Box mode: crop width in pixels (1-32768).
`aspect`	object	—	Instead of a box, e.g. 16:9, with gravity.
`format`	object	—	Output format (default: the input's; ICO in, PNG out).
`height`	object	—	Box mode: crop height in pixels (1-32768).
`output`	string	—	base64 (default): inline. url: stored for 24 hours; link, metadata.
`gravity`	string	—	Aspect mode: the part to keep: center (default), north, south, east, west, northwest, northeast, southwest or southeast.
`quality`	object	—	Encoder quality 1-100 (lossy formats).
`auto_orient`	boolean	—	Apply the EXIF orientation first.
`image_base64`	object	—	The image as standard or url-safe base64 (at most 10 MB decoded; a data:image/...;base64, prefix is fine); or use url.

Parameters from the server's own tool schema.

RISK

Why image_crop is rated High

image_crop triggers real processes with real consequences. An agent gone sideways doesn't fire it once. It starts dozens of builds, sends mass notifications, or burns through compute before anyone looks up.

Risk signalsAccepts URL/endpoint input (url) · High parameter count (12 properties)

Attacks that exploit this kind of access

RECOMMENDED RULE

The rule that runs image_crop safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Tanod, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For image_crop, this is the rule to start with:

image_crop Rate-limited

image_crop stays usable, but rate-capped: a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "image_crop": {
      "limits": [
        {
          "counter": "image_crop_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL → Instant setup, no code required.

The button opens the PolicyLayer dashboard: create your workspace, connect Tanod, apply this rule, and every image_crop call is checked against it from then on.

FAQ

Questions about image_crop

What does the image_crop tool do? +

imagepeek: Crop an image to a box or an aspect ratio. To scale instead use image_resize. Returns the image cropped to a box (left, top, width, height; out of bounds is a 422 crop_out_of_bounds) or to an aspect ratio such as 16:9 placed by gravity (center or a side or corner); the reply carries the applied box. Reads PNG, JPEG, WebP, GIF, TIFF, BMP, ICO and AVIF; other formats and images over 40 megapixels are refused (not charged). Output: base64 data_base64, without EXIF, GPS, XMP or IPTC; over 15 MB or 50 megapixels is a 413 (not charged). Images are not logged; a result is kept only with output "url" (24 h). Typically 0.5-2 s. Price: USD 0.002. Free: 3 imagepeek calls per IP per UTC day. Docs: https://tanod.dev/learn/image-crop-api.html. It is categorised as a Execute tool in the Tanod MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

What parameters does image_crop accept? +

image_crop accepts 12 parameters: top, url, left, width, aspect, format, height, output, gravity, quality, auto_orient, image_base64. The full parameter table on this page comes from the server's own tool schema.

How do I enforce a policy on image_crop? +

Register the Tanod MCP server in PolicyLayer and add a rule for image_crop: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Tanod. Nothing to install.

What risk level is image_crop? +

image_crop is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit image_crop? +

Yes. Add a rate_limit block to the image_crop rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block image_crop completely? +

Set action: deny in the PolicyLayer policy for image_crop. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides image_crop? +

image_crop is provided by the Tanod MCP server (https://tanod.dev/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

KEEP EXPLORING

More on Tanod, and thousands of servers like it.

This server

All 308 Tanod tools → High-risk tools on this server →

Across the catalogue

All high-risk MCP tools → The MCP Attack Database →

Guides

Govern code and CI agents →Agent sandbox →Least privilege for MCP →