Back to Browse

Videohub Port MCP Server

Developer ToolsModerate5.8MCP RegistryLocal
Free

Server data from the Official MCP Registry

YouTube videos, channels, playlists, comments and transcripts as MCP tools.

About

YouTube videos, channels, playlists, comments and transcripts as MCP tools.

Security Report

5.8
Moderate5.8Moderate Risk

videohub-port is a read-only YouTube Data API v3 MCP server that requires YOUTUBE_API_KEY from the environment, sends it only as a query parameter over HTTPS to googleapis.com, and exposes no write tools. The only findings are minor: the API key is placed in the URL query string (which can surface in logs or error paths), and the transcript tool calls the unofficial timedtext endpoint, which is a reliability rather than a security concern. Permissions (outbound network to YouTube, env var read for the key) match the stated purpose. Supply chain analysis found 4 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

8 files analyzed · 9 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

YOUTUBE_API_KEYRequired

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cloudcorprecords-videohub-port": {
      "env": {
        "YOUTUBE_API_KEY": "your-youtube-api-key-here"
      },
      "args": [
        "-y",
        "@reneturcios/videohub-port"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

videohub-port

YouTube videos, channels and playlists as MCP tools, talking to the YouTube Data API v3. videohub-port is a clean-room rebuild of the core surface of the community YouTube MCP servers, under a new name: fresh code, no copied branding.

Auth model: TOKEN/KEY-ENV ONLY. Public reads use the YouTube Data API v3 with YOUTUBE_API_KEY sent as the key query parameter. The community originals' OAuth flow (for uploads, subscriptions writes and my-channel management) is NOT reproduced — there are no write tools in this subset.

Tools (core subset, 12)

search_videos, get_video, list_video_comments, get_channel, search_channels, list_playlists, get_playlist, list_playlist_items, get_video_transcript, list_channel_videos, get_video_categories, get_trending_videos.

The transcript tool is simplified: it is not a Data API call. It fetches the public timedtext endpoint with fmt=json3 for the requested language track directly (no caption-track listing/selection, no key parameter) and joins the json3 events into plain text; when no track is available it returns an honest "no caption track available" error and never invents text.

Not in this subset: the OAuth flow and all writes (uploads, playlist create/edit, subscriptions, likes/ratings, comments posting), my-channel/subscriptions reads requiring OAuth, live streaming, video insert/update/delete, channel sections/branding, i18n depth beyond categories/trending region, the analytics API, and captions download in srt/vtt formats or caption-track listing.

Setup

Create an API key in the Google Cloud console (YouTube Data API v3 enabled) and set it:

export YOUTUBE_API_KEY=AIza...

Optionally override the API base with YOUTUBE_API_BASE_URL (default https://www.googleapis.com/youtube/v3) and the transcript base with YOUTUBE_TIMEDTEXT_BASE_URL (default https://www.youtube.com/api/timedtext). Every Data API request carries Accept: application/json and the key as the key query parameter (no Authorization header). Without the key, every tool call fails with an error naming the missing variable.

CLI

npx @reneturcios/videohub-port search_videos '{"query":"lo fi"}'
npx @reneturcios/videohub-port mcp        # stdio MCP server

Each tool name is a subcommand taking one JSON object argument.

MCP client config

{
  "mcpServers": {
    "videohub-port": {
      "command": "npx",
      "args": ["-y", "@reneturcios/videohub-port", "mcp"],
      "env": { "YOUTUBE_API_KEY": "AIza..." }
    }
  }
}

Docker

docker run -i -e YOUTUBE_API_KEY ghcr.io/cloudcorprecords/videohub-port

Development

npm install
npm run build
npm test

License

MIT

Reviews

No reviews yet

Be the first to review this server!