VidLens (thatsrajan/vidlens-mcp) is an MCP server listed on the M8ven Trust Index. It scores 62 out of 100, grade C. It declares 47 tools. No publisher has claimed this listing.

Caution

62/100

VidLens

Item: VidLens
Rating: 62
Author: M8ven

Enables AI agents to search, analyze, and extract insights from YouTube videos including transcripts, visual frames, and benchmarks without requiring API keys. Supports semantic search across playlists, sentiment analysis, and visual content indexing with automatic fallback chains for reliable access.

→ thatsrajan/vidlens-mcp · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

thatsrajan

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Known vulnerabilities in dependencies: 3 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 7 credentials: BRAVE_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, OPENAI_API_KEY, SCRAPECREATORS_API_KEY, SERPAPI_KEY, YOUTUBE_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes47 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

recallWorkspace

Recall what VidLens already has stored from previous sessions — imported transcript and comment collections, downloaded media assets, and visual indexes. CALL THIS FIRST in a new session before searching or importing: unlike raw yt-dlp, VidLens imports persist across sessions and become searchable, …

findVideos

Search YouTube videos by intent. Returns compact ranked results with provenance and engagement hints. [~1-3s]

inspectVideo

Inspect a single video with compact metadata, normalized ratios, and transcript availability. [~1-3s]

inspectChannel

Inspect a channel with summary stats and posting cadence heuristics. [~3-10s]

listChannelCatalog

List a channel's recent catalog in compact creator-analysis shape. [~3-10s]

readTranscript

Read transcript in summary, key moments, chapters, or paginated full mode with long-video safeguards. [~1-3s]

readComments

Read top-level comments with optional replies and structured provenance. [~1-3s]

measureAudienceSentiment

Heuristic audience sentiment analysis from comments with themes, risk signals, and quote samples. [~3-10s]

analyzeVideoSet

Run multiple analyses across a video set with partial success, item-level errors, and provenance. [~5-20s, scales with video count]

expandPlaylist

Expand a playlist into individual videos for downstream analysis and batch workflows. [~1-3s]

analyzePlaylist

Expand and analyze a playlist in one call with partial success and aggregate benchmarks. [~5-20s, scales with playlist size]

importPlaylist

Import a playlist into the local transcript knowledge base for semantic search in Claude Desktop. Unlike raw yt-dlp, imports persist across sessions and become searchable — call recallWorkspace or listCollections first to avoid re-importing what you already have. [~5-30s, ~2s per video]

importVideos

Import one or more videos into a local transcript collection for later semantic search. Unlike raw yt-dlp, imports persist across sessions and become searchable — call recallWorkspace or listCollections first to avoid re-importing what you already have. [~5-20s, ~2s per video]

searchTranscripts

Search imported transcript-text collections with active-collection focus by default and return ranked timestamped chunks. [~instant]

listCollections

List local transcript collections, active search focus, and indexed video/chunk counts. [~instant]

setActiveCollection

Set the default collection that transcript search should focus on when collectionId is omitted. [~instant]

clearActiveCollection

Clear the active collection so transcript search fans back out across all collections. [~instant]

checkImportReadiness

Diagnose whether a video is importable, including transcript availability, sparse-transcript warnings, and yt-dlp/API issues. [~1-3s]

buildVideoDossier

Build a one-shot video dossier with core metadata/transcript readiness, optionally extended with comments, sentiment, and provenance. [~3-10s]

checkSystemHealth

Check setup and provider health: yt-dlp, YouTube API, Gemini embeddings, and local storage. [~3-10s]

removeCollection

Delete a local transcript collection and its search index. [~instant]

scoreHookPatterns

Heuristically score first-30-second hooks across one or more videos. [~3-10s, ~1s per video]

researchTagsAndTitles

Research title structures, keywords, and tag patterns around a seed topic. [~3-10s]

compareShortsVsLong

Compare recent Shorts vs long-form performance for a channel and suggest a format mix. [~3-10s]

recommendUploadWindows

Recommend upload windows from recent publishing history for a given timezone. [~3-10s]

discoverNicheTrends

Discover what's trending in a niche right now. Returns top-performing and recent videos, momentum signals (accelerating/steady/decelerating), saturation analysis, content gap opportunities, keyword patterns, and format breakdown. Grounded in YouTube search data with honest limitations disclosed. [~5…

exploreNicheCompetitors

Discover active channels in a niche by analyzing who ranks in YouTube search results. Returns channel-level stats, top videos, and a landscape summary. Useful for competitive reconnaissance before entering a niche. [~5-20s]

inspectVideoSource

Resolve any supported video input (YouTube, X/Twitter, Instagram, TikTok, generic URL, or local file) into VidLens source metadata and capability flags. Works for Claude and Codex through the same MCP server. [~instant]

searchVideoSources

Search video sources across native YouTube, local VidLens assets, and capability-aware social/web fallback guidance. For X, Instagram, TikTok, and generic web pages, pass discovered URLs to importVideoSources/downloadAsset for reliable ingest. Material imported in previous sessions is already availa…

searchSocialTrends

Search social platforms through ScrapeCreators and return a playlist-like ranked list of posts/videos with engagement metrics and importable URLs where VidLens can ingest them. Supports TikTok, Instagram, Threads, Pinterest, Reddit, and handle-based X lookups when SCRAPECREATORS_API_KEY is configure…

importVideoSources

Import one or more video URLs or local files into the local VidLens media store, optionally building a visual index or transcript. Supports YouTube, X/Twitter, Instagram, TikTok, generic URLs via yt-dlp, and local video files via ffmpeg. [~30-180s]

transcribeVideoSource

Transcribe a YouTube, X/Twitter, Instagram, TikTok, generic URL, or local video source into the transcript knowledge base using native captions or the configured STT provider. [~30-180s]

downloadAsset

Download or ingest a video, audio track, or thumbnail to local storage. Supports YouTube, X/Twitter, Instagram, TikTok, generic URLs via yt-dlp, and local video files for video ingestion. Does NOT perform visual indexing. Downloaded assets persist across sessions — call recallWorkspace or listMediaA…

listMediaAssets

List locally stored media assets. Filter by video or kind. Shows file paths, sizes, and manifest metadata. [~instant]

removeMediaAsset

Remove stored media assets. Specify assetId to remove one, or videoIdOrUrl to remove all assets for a video. [~instant]

extractKeyframes

Extract keyframe images from a locally downloaded video at regular intervals using ffmpeg. Requires the video to be downloaded first via downloadAsset. Does NOT do visual search or classification — produces raw frame images. [~30-60s, requires ffmpeg]

mediaStoreHealth

Check health of the local media store: disk usage, asset counts, ffmpeg/yt-dlp availability. [~instant]

indexVisualContent

Build a real visual index for a video using extracted frames, Apple Vision OCR, Apple Vision feature prints, and optional Gemini frame descriptions. Returns frame evidence with local image paths. The index persists across sessions and is queryable via searchVisualContent — call recallWorkspace first…

searchVisualContent

Search the actual visual content of a video or your indexed frame library. Uses Apple Vision OCR, optional Gemini frame descriptions, and optional Gemini semantic embeddings. Always returns frame/image evidence with timestamps. [~1-3s if indexed, ~60-120s if auto-indexing]

findSimilarFrames

Find frames that visually look like a reference frame using Apple Vision image feature prints. Accepts a frame assetId or a direct framePath and returns image-backed matches. [~30-60s, vision comparison]

importComments

Import a video's comments into the local comment knowledge base for semantic search. Fetches comments via the existing comment pipeline and indexes them for searchComments. Imports persist across sessions — call recallWorkspace or listCommentCollections first to avoid re-importing. [~3-10s]

searchComments

Search imported comment collections with ranked results. Returns matching comments with author, like count, and relevance score. Uses active comment collection by default. [~instant]

listCommentCollections

List local comment collections, active search focus, and indexed comment counts. [~instant]

setActiveCommentCollection

Set the default comment collection that searchComments should focus on when collectionId is omitted. [~instant]

clearActiveCommentCollection

Clear the active comment collection so comment search fans back out across all comment collections. [~instant]

removeCommentCollection

Delete a local comment collection and its search index. [~instant]

exploreYouTube

ALWAYS use this tool FIRST when the user wants to find, discover, or explore YouTube videos. Do NOT use web search for YouTube video discovery — use this tool instead. Searches YouTube directly with intelligent multi-query ranking and parallel enrichment. Returns ranked videos with transcript summar…

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.17.4GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.17.4GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.17.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

🔐 secretBRAVE_API_KEY/ SERPAPI_KEY Optional structured web search for social/generic URL discovery Varies Brave Search API or SerpAPI

🔐 secretGEMINI_API_KEYHigher-quality embeddings for semantic search (768d vs 384d) ✅ Free tier [Google AI Studio](https://aistudio.google.com/) → Get API Key

🔐 secretGOOGLE_API_KEY

configNO_COLOR

🔐 secretOPENAI_API_KEYOptional STT provider for transcribeVideoSource Paid/free trial varies [OpenAI Platform](https://platform.openai.com/)

🔐 secretSCRAPECREATORS_API_KEYDirect social search/trending for TikTok, Instagram, Threads, Pinterest, Reddit, and supported endpoints 100 free credits, paid after [ScrapeCreators](https://app.scrapecreators.com/)

🔐 secretSERPAPI_KEYBRAVE_API_KEY / Optional structured web search for social/generic URL discovery Varies Brave Search API or SerpAPI

configVIDLENS_ALLOW_PRIVATE_URLS

configVIDLENS_DATA_DIRpersists on disk under and is there next time — no re-downloading, no

configVIDLENS_EMBEDDING_PROVIDER

configVIDLENS_ENABLE_UNIVERSAL_EXPLORE

configVIDLENS_GEMINI_EMBEDDING_MODEL

configVIDLENS_GEMINI_STT_MODEL

configVIDLENS_GEMINI_VISION_MODEL

configVIDLENS_OPENAI_STT_MODEL

configVIDLENS_STT_LANGUAGE_HINT

🔐 secretYOUTUBE_API_KEYexport =your_youtube_key

configYOUTUBE_MCP_GEMINI_DIMENSIONS

configYOUTUBE_MCP_GEMINI_MODEL

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

47/47 tools missing one or more hints — recallWorkspace (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); findVideos (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); inspectVideo (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +44 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Shell command execution

39 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

No arbitrary install scripts

Has postinstall/preinstall script — runs arbitrary code on npm install

Remove postinstall/preinstall hooks unless they’re essential.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.17.4 (high), @modelcontextprotocol/sdk@1.17.4 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/thatsrajan/vidlens-mcp?variant=verified)](https://m8ven.ai/mcp/thatsrajan/vidlens-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: ac6c13e523502d7d73b2ddc89970503d2986e6bc

code hash: f600110856bcf83530162060b86c8640350ec3c060583901af36ec5cdb4d5bf6

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client