I
io.github.nhatvu148/video-transcriber-mcp
yt-dlp
Transcribe videos from 1000+ platforms or local files offline, and search across every transcript
No known CVEs
Apache-2.0 license
Actively maintained
Last commit 1d ago
Works with most clients
Transport: stdio, sse, http
7 tools · ~186 tok
Grade A · 0.1% of 200K ctx
MCPpedia last refreshed this data
io.github.nhatvu148/video-transcriber-mcp is an MCP server that transcribe videos from 1000+ platforms or local files offline, and search across every transcript. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 88/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients — only the file and path differ.
CD
Supported in Claude Desktopstdio, sse, http · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"video-transcriber-mcp": {
"url": "http://localhost:8080/mcp"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/io-github-nhatvu148-video-transcriber-mcp)
Read me
What io.github.nhatvu148/video-transcriber-mcp does
High-performance video transcription MCP server using whisper.cpp (Rust)
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
uvx 'yt-dlp' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Loading README…
Scored, not listed
Why this score
Five weighted categories — click any category to see the underlying evidence.
Score breakdown
88/100across 5 weighted dimensions
0255075100
30
13
20
15
10
−12
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev12 fixed
CVE-2026-55404high · fixedCVSS 7.5
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated `.url` or `.desktop` files.
CVE-2026-50574high · fixedCVSS 8.3
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. ### Details When downloading a fragmented manifest format such as an HLS or DASH strea
CVE-2026-50023high · fixedCVSS 8.3
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
### Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as `.desktop`, `.url`, `.webloc`) to the user's filesystem, bypassing the remediation for `CVE-2024-38519`. ### Details The fix for `CVE-2024-38519` enforced an allowlist for file extensions, in order to prevent writing files with unsafe extensions (such as `.exe` or `.sh`) during file downloads. However, this allowlist explicitly included the unsafe extensions `.desktop`, `.ur
CVE-2026-50019medium · fixedCVSS 6.1
yt-dlp: File Downloader cookie leak with curl
### Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. This is the equivalent to [GHSA-v8mc-9377-rwjj](<https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj>) for the `curl` downloader. The vulnerable behavior is present in [yt-dlp](https://github.com/yt-dlp/yt-dlp) released since 2023.09.24. ### Details At the file download st
CVE-2026-26331high · fixedCVSS 8.8
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
### Summary When yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. ### Impact yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be
Inventory
Tools (7)
Click any tool to inspect its schema.
~186 tokens total
Community
Reviews
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is io.github.nhatvu148/video-transcriber-mcp safe to use?
- io.github.nhatvu148/video-transcriber-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
- How do I install io.github.nhatvu148/video-transcriber-mcp?
- io.github.nhatvu148/video-transcriber-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What can io.github.nhatvu148/video-transcriber-mcp do?
- io.github.nhatvu148/video-transcriber-mcp provides 7 tools: Educational, News, Prerequisites, Transcript, Build and 2 more. See the full tools list on the server page for descriptions and parameters.
- What AI clients work with io.github.nhatvu148/video-transcriber-mcp?
- io.github.nhatvu148/video-transcriber-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
- Is io.github.nhatvu148/video-transcriber-mcp actively maintained?
- io.github.nhatvu148/video-transcriber-mcp is actively maintained — last commit was 1 day ago. It has 17 GitHub stars.
Related
Similar servers
Others in other
Headroom95Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.
67.5k 3
T
Transport Stdio95Transport for TMCP using STDIO
197 14
Flare95The graph based agentic IDE
148 3
A
app.fojin/fojin-mcp94Buddhist canon tools: search, passages, cross-canon parallels, dictionaries — all URN-cited.
331 8
MCP Security Weekly
Get CVE alerts and security updates for io.github.nhatvu148/video-transcriber-mcp and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.
