Youtube Transcripts MCP Server

The server fetches public YouTube transcripts, metadata, search results and chapters over HTTP using read-only tools, with no LLM and no evident data exfiltration, shell execution or hardcoded secrets in the reviewed code. The main concerns are that the HTTP mode relies on the hosting platform for authentication rather than enforcing it itself, and that the documented option of passing the Apify token as a URL query parameter can leak it into logs. Billing and HTTP/proxy modules were not provided, so their handling could not be verified. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity).

5 files analyzed · 6 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.