mcp-openshorts (mutonby/openshorts) is an MCP server listed on the M8ven Trust Index. It scores 98 out of 100, grade A. It declares 8 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
A
Trusted
98/100
5 days ago

mcp-openshorts

OpenShorts turns long videos into vertical clips readys for Social Media posting

→ mutonby/openshorts· listed on glama

Trusted. Deep verification, no outstanding findings, and an established reputation. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

mutonby

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
5 flows detected: GEMINI_API_KEY, OPENSHORTS_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 15 credentials: GEMINI_API_KEY, UPLOAD_POST_API_KEY, LLM_API_KEY, AWS_SECRET_ACCESS_KEY, OPENSHORTS_API_KEY, OPENPANEL_CLIENT_SECRET, JWT_SECRET, TELEGRAM_BOT_TOKEN, GOOGLE_CLIENT_SECRET, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, AGENTLEDGER_API_KEY, MANAGED_GEMINI_API_KEY, MANAGED_UPLOAD_POST_API_KEY, R2_SECRET_ACCESS_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values.
configOUTPUT_DIR
configREMOTION_BUNDLE_PATH
configVITE_PROXY_TARGET
configVITE_RENDER_TARGET
configPUBLIC_API_URL
configBILLING_ENABLED
configMAX_CONCURRENT_JOBSConcurrent processing limit (default: 5)
configTIKTOK_POST_MODE
configOUTPUT_MAX_GB
configUPLOADS_MAX_GB
configQUALITY_GATE_MIN_HEIGHT
configMIN_SOURCE_SECONDS
configDISABLE_YOUTUBE_URL
configJOB_RETENTION_SECONDS
configSOURCE_RETENTION_SECONDS
🔐 secretGEMINI_API_KEYGoogle Gemini — required unless LLM_BASE_URL is set (then only for layout picking and silent videos)
🔐 secretUPLOAD_POST_API_KEYUpload-Post — required, for social posting
configINSTANCE_ID
configDRAIN_TIMEOUT_SECONDS
configPROXY_DRAIN_SECONDS
configHARD_EXIT_SECONDS
configUPLOAD_TTL_SECONDS
configSOURCE_URL_TTL_SECONDS
configYOLO_MODEL_PATH
configJUMP_CONFIRM_FRAMES
configSCENE_CUT_RESET
configDETECT_STRIDE
configYOUTUBE_COOKIES
configPROXY_URL
configSTATIC_PROXY_URLS
configBGUTIL_BASE_URL
configBGUTIL_SCRIPT_PATH
configDIRECT_FIRST
configAUTO_CAPTIONS
configAUTO_HOOK_STYLE
configAUTO_HOOK_SECONDS
configREFRAME_ENGINE
configLLM_SCORE_BATCHabove 3 only if your context allows it. 7-8B models
configGEMINI_MODEL
configMIN_SPEECH_WORDS_PER_MIN
configMIN_SPEECH_WORDS
configWATERMARK
configAUTO_HOOK
configCLIP_WORKERS
configSPEAKER_SIGNAL
configSPEAKER_CUT
configSPLIT_MIN_SHARE
configINSET_PADDING
configGEMINI_MODEL_EDITOR
configAUDIO_NORMALIZE
configFFMPEG_ENCODER
configGEMINI_THINKING_SCORE
configHOOK_GROUNDING_FRAMES
configHOOK_GROUNDING_WIDTH
configHOOK_GROUNDING_MIN_SHARE
configHOOK_GROUNDING
configAUTO_LAYOUTautomatic layout picker (), the on-screen content detector
configLAYOUT_SAMPLE_FRAMES
configLAYOUT_SAMPLE_WIDTH
configLLM_PROVIDER
configLLM_BASE_URLViral moment detection instead of Gemini (LLM_BASE_URL)
configLLM_MODELModel name on that server (default llama3.1:8b)
configLLM_TIMEOUT
🔐 secretLLM_API_KEYBearer token for that server, if it checks one
configPANEL_LAYOUT
configPANEL_TIGHTNESS
configPUNCH_IN
configPUNCH_IN_ZOOM
configGENERAL_CONTENT_HEIGHT_RATIO
configAWS_ACCESS_KEY_IDAWS access key for S3
🔐 secretAWS_SECRET_ACCESS_KEYAWS secret key
configAWS_REGIONAWS region (default: us-east-1)
configAWS_S3_BUCKETPrivate bucket for clip backup
configAWS_S3_PUBLIC_BUCKETPublic bucket for gallery/avatars
configGEMINI_MODEL_SAAS
configSCENE_ENGINE
configTRANSNETV2_DEVICE
configTRANSNETV2_THRESHOLD
configSCENE_MIN_SEC
configSCREENCAST_LAYOUT
configSPLIT_LAYOUT
configSPLIT_TIGHTNESS
configWHISPER_MODEL
configWHISPER_DEVICE
configWHISPER_COMPUTE
configGEMINI_MODEL_THUMBNAIL
configGEMINI_IMAGE_MODEL
configASR_GPU_CONCURRENCY
configTRANSCRIBE_BACKEND
configOPENSHORTS_API_URL
🔐 secretOPENSHORTS_API_KEY
configOPENPANEL_CLIENT_ID
configOPENPANEL_API_URL
🔐 secretOPENPANEL_CLIENT_SECRET
🔐 secretJWT_SECRET
configFRONTEND_URL
configALLOWED_ORIGINS
configEMAIL_FROM
configADMIN_EMAIL
🔐 secretTELEGRAM_BOT_TOKEN
configTELEGRAM_CHAT_ID
configGOOGLE_CLIENT_ID
🔐 secretGOOGLE_CLIENT_SECRET
🔐 secretSTRIPE_SECRET_KEY
🔐 secretSTRIPE_WEBHOOK_SECRET
configAGENTLEDGER_API_URL
🔐 secretAGENTLEDGER_API_KEY
configAGENTLEDGER_TREASURY_ID
🔐 secretMANAGED_GEMINI_API_KEY
🔐 secretMANAGED_UPLOAD_POST_API_KEY
configOPENSHORTS_LOGO_URL
configR2_ENDPOINT
configR2_BUCKET
configR2_ACCESS_KEY_ID
🔐 secretR2_SECRET_ACCESS_KEY
configR2_PUBLIC_BASE
configOAUTH_REDIRECT_URI
configPAID_PROXY_DAILY_MB
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
deployDATABASE_URL
deploySMTP_HOST
deploySMTP_PORT
deploySMTP_USER
deploySMTP_PASSWORD
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

8/8 tools missing one or more hints — process_video (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_upload (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_job_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +5 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

6/8 tools referenced in tests (75%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets not logged

4 secret values sent to print

Redact or omit secret values from log output.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/mutonby/openshorts)](https://m8ven.ai/mcp/mutonby/openshorts)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 959407c30ed60892e8f35877c87b062a827b55c1
code hash: 70930a1bbb84b93bd89c57ed3c0e71f39bd73cd9a69d294a2e3eb498805c9c66
verified: 9/6/2026, 7:29:01 AM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client