Back to MCP Trust Indexm8ven
50
/ 100
23 days ago
glama

omnicinema-mcp

Local MCP server that plans, generates, and assembles production assets (images, audio, video) through multi-agent personas and official APIs, with free-tier budget guard.

→ joeshwoa/omnicinema-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
⚠️
Tests do not pass
Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 10 credentials: ANTHROPIC_API_KEY, FAL_API_KEY, FREESOUND_API_KEY, GITHUB_TOKEN, HUGGINGFACE_API_TOKEN, OMNICINEMA_IPC_TOKEN, PEXELS_API_KEY, PIXABAY_API_KEY, REPLICATE_API_TOKEN, UNSPLASH_ACCESS_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretANTHROPIC_API_KEY— Optional screenplay enrichment console.anthropic.com
configANTHROPIC_MODEL
🔐 secretFAL_API_KEY— + FAL_VIDEO_MODEL fal.ai video fal.ai
configFAL_IMAGE_MODEL
configFAL_VIDEO_MODEL— FAL_API_KEY + fal.ai video fal.ai
🔐 secretFREESOUND_API_KEY— Stock SFX / ambience freesound.org/apiv2/apply
🔐 secretGITHUB_TOKEN
configHF_IMAGE_MODEL— HUGGINGFACE_API_TOKEN + / HF_TTS_MODEL / HF_MUSIC_MODEL / HF_VIDEO_MODEL HF Inference image / TTS / music / video huggingface.co/settings/tokens
configHF_MUSIC_MODEL— HUGGINGFACE_API_TOKEN + HF_IMAGE_MODEL / HF_TTS_MODEL / / HF_VIDEO_MODEL HF Inference image / TTS / music / video huggingface.co/settings/tokens
configHF_TTS_MODEL— HUGGINGFACE_API_TOKEN + HF_IMAGE_MODEL / / HF_MUSIC_MODEL / HF_VIDEO_MODEL HF Inference image / TTS / music / video huggingface.co/settings/tokens
configHF_VIDEO_MODEL— HUGGINGFACE_API_TOKEN + HF_IMAGE_MODEL / HF_TTS_MODEL / HF_MUSIC_MODEL / HF Inference image / TTS / music / video huggingface.co/settings/tokens
🔐 secretHUGGINGFACE_API_TOKEN— + HF_IMAGE_MODEL / HF_TTS_MODEL / HF_MUSIC_MODEL / HF_VIDEO_MODEL HF Inference image / TTS / music / video huggingface.co/settings/tokens
configOMNICINEMA_IPC_HOST
configOMNICINEMA_IPC_PORT
🔐 secretOMNICINEMA_IPC_TOKEN
🔐 secretPEXELS_API_KEY— / PIXABAY_API_KEY / UNSPLASH_ACCESS_KEY Stock video/photos/stills pexels.com/api · pixabay.com/api/docs · unsplash.com/developers
🔐 secretPIXABAY_API_KEY— PEXELS_API_KEY / / UNSPLASH_ACCESS_KEY Stock video/photos/stills pexels.com/api · pixabay.com/api/docs · unsplash.com/developers
🔐 secretREPLICATE_API_TOKEN— + REPLICATE_IMAGE_MODEL / REPLICATE_MUSIC_MODEL / REPLICATE_VIDEO_MODEL Replicate image / music / video replicate.com
configREPLICATE_IMAGE_MODEL— REPLICATE_API_TOKEN + / REPLICATE_MUSIC_MODEL / REPLICATE_VIDEO_MODEL Replicate image / music / video replicate.com
configREPLICATE_MUSIC_MODEL— REPLICATE_API_TOKEN + REPLICATE_IMAGE_MODEL / / REPLICATE_VIDEO_MODEL Replicate image / music / video replicate.com
configREPLICATE_VIDEO_MODEL— REPLICATE_API_TOKEN + REPLICATE_IMAGE_MODEL / REPLICATE_MUSIC_MODEL / Replicate image / music / video replicate.com
🔐 secretUNSPLASH_ACCESS_KEY— PEXELS_API_KEY / PIXABAY_API_KEY / Stock video/photos/stills pexels.com/api · pixabay.com/api/docs · unsplash.com/developers
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/joeshwoa-omnicinema-mcp-1vclr9)](https://m8ven.ai/mcp/joeshwoa-omnicinema-mcp-1vclr9)
commit: fb9d5598f71e5c5585c81c4ced9ca95f35061e0a
code hash: e637ae920b78a4e8e1ff4d380f40278d2d1434d2f719f4d5dbe965d361e2f9a9
verified: 7/8/2026, 8:45:03 AM
view raw JSON →