The 85-line client only submits remote jobs
Media Inference Worker is smaller and narrower than its name suggests. The repository contains 6 files and about 85 lines of source. generate.py maps a friendly model name to a hosted Higgsfield path, sends a prompt, and polls the returned status URL. It does not host a queue, run an inference model, process returned media, or expose a worker service. Think of it as a saved API experiment with a command-line wrapper.
The script recognizes 7 aliases: three image routes and four video routes. Qwen Image 3, Nano Banana 2 Lite, and GPT Image 2 are listed for images; MiniMax H3, LTX 2.5 Pro, Kling 3.0, and Veo 3.1 Fast are listed for video. Each request carries one user-controlled field, prompt. A completed image job prints images[0].url, while a completed video job prints video.url.
Seven aliases still expose only one setting
The shared request shape makes this handy for checking whether a credential and prompt reach the service. You can run python generate.py, choose one of the 7 names, and pass the prompt on the same command line. The polling interval starts at 2 seconds, grows by a factor of 1.5, and stops growing at 10 seconds. Individual POST and GET requests have timeouts of 60 and 30 seconds.
That simplicity becomes a hard limit as soon as a model needs its normal controls. The client does not accept aspect ratio, resolution, seed, duration, reference media, or provider-specific options. Issue 2 asks for aspect ratio and other settings, which matches the code we read: line 51 sends only {"prompt": prompt}. Adding those controls means designing per-model inputs rather than extending one generic argument.
What happened when we ran it
Our sandbox installed the project in 20 seconds, adding 35 packages and consuming 37 MB on disk. The build succeeded in 10 seconds. The checkout itself measured 0 MB at the reporting precision used by our lab, which fits a repository with 6 small files. These are modest local costs for a Python request client.
There was no tests script or target, so the test step was skipped. Pip-audit found 0 known vulnerabilities among the installed packages. Those results cover dependency installation and the supplied build path at commit eab94b0; they do not prove that any of the 7 remote model routes returned media. Our unprivileged Debian sandbox had 3 CPUs, 8 GB of RAM, and no secrets, so it could not submit an authenticated job.
The tracked .env makes the default checkout unsafe
Commit eab94b0 includes a 134-byte .env with values for HF_API_KEY_ID and HF_API_KEY_SECRET. We did not print or use either value. The README says the service account was still active when copied, while also saying the remaining credit and rotation date were unknown. That is enough to treat both values as exposed, regardless of whether they still work on August 27, 2026.
The repository's .gitignore excludes .venv, Python cache files, bytecode, and an output directory, but it does not exclude .env. Safe reuse starts by revoking or rotating the 2 published values, removing the file from version control, adding .env to the ignore rules, and providing an example file with variable names only. Copying this checkout into another private repository would preserve the leak in its Git history.
Polling has request timeouts but no job deadline
After the initial POST, the script trusts the response to contain request_id and status_url. It then polls until the status becomes completed, failed, nsfw, or canceled. A server that keeps returning a different status can keep the process alive indefinitely because the 30-second GET timeout applies to each call, not the whole job. There is no retry policy for a temporary HTTP error, and raise_for_status() ends the process on one failed response.
Finished work is not downloaded or recorded. The 85-line program prints a hosted URL and exits, leaving retention, access control, filename selection, storage, and verification to the caller. The runbook shows a cancellation URL in the queued response, but generate.py never calls it. A production queue would also need durable job state, idempotency, rate-limit handling, structured logs, and a way to cancel work when its caller disappears. None of those behaviors is promised by this repository.
One commit and no release leave no dependable upgrade path
GitHub shows 102 stars, 1 open issue, and a last push on August 26, 2026. The issue received 4 comments through August 27, so there is recent attention as well as a recent push. That activity happened within roughly one day of the repository's creation. It is too short a history to show how the maintainer handles credential disclosure, endpoint changes, bug reports, or compatibility.
There is no published release or declared license, and the lab found 0 CI workflow files, no Dockerfile, and no test target. A missing license is especially practical: public source code is visible, but reuse terms are unspecified. Replicate's Python client, fal, and Hugging Face Hub all have explicit Apache-2.0 licensing and maintained client surfaces. Use this project to understand a 1-file request flow, then rebuild that flow around credentials and provider documentation you can rely on.