MCP Video Gen (the-code-learner/MCP-video-gen) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 128 tools. No publisher has claimed this listing.

Caution

54/100

MCP Video Gen

Item: MCP Video Gen
Rating: 54
Author: M8ven

A self-hosted MCP server that connects AI clients to local media-generation backends like ComfyUI and Blender, and provides built-in utilities for video/audio analysis, editing, subtitles, speech, and scene detection via a persistent file cache.

→ the-code-learner/MCP-video-gen · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

the-code-learner

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Secret credentials may flow to a network call

4 flows detected: BLENDER_BRIDGE_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

⚠️

Tool descriptions don’t match what handlers do

1 tool describes read intent but its handler mutates — cache_output (line 326: out.write_bytes(blob))

🔐

You'll be asked for 1 credential: BLENDER_BRIDGE_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes126 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

inventory_summary

Summarize ComfyUI reachability, loaded nodes, model folders and local runtime capabilities.

list_loaded_nodes

Return ComfyUI node classes currently registered by /object_info, optionally filtered.

get_node_definition

Return the authoritative ComfyUI definition for one loaded node class.

list_model_folders

List model folders registered by ComfyUI.

list_registered_models

List model names ComfyUI registered for a model folder.

scan_models

Scan the read-only ComfyUI models mount and return relative paths, sizes and extensions.

scan_custom_nodes

Scan the read-only custom_nodes mount to discover installed packages/files.

read_custom_node_file

Read a text source/documentation file inside custom_nodes, sandboxed to the read-only mount.

submit_workflow

Submit arbitrary ComfyUI API-format workflow JSON to /prompt.

get_queue

get_history

interrupt

upload_image_base64

Upload an image to ComfyUI /upload/image from base64 content.

cache_output

Download a ComfyUI /view output into the persistent MCP media cache.

list_cached_outputs

get_output_inline_base64

media_probe

Probe a cached media file with ffprobe.

extract_frame

Extract one frame from cached video.

transcode_video

Transcode cached media to broadly compatible H.264/AAC MP4.

concat_videos

Normalize cached clips to a common H.264/AAC profile and concatenate them.

mux_audio

Replace/add a cached video's audio track with another cached audio source.

overlay_video

Composite a cached overlay video (including HyperFrames alpha outputs where supported) over a base video.

hyperframes_info

hyperframes_list_projects

hyperframes_create_project

Create a local HyperFrames project non-interactively.

hyperframes_write_text_file

Write HTML/CSS/JS/JSON/Markdown inside a HyperFrames project.

hyperframes_read_text_file

hyperframes_import_cached_media

hyperframes_lint

hyperframes_check

hyperframes_render

Render a local HyperFrames project and place the result in the shared media cache.

advanced_capabilities

Report advanced media/audio/local-AI capabilities implemented by this MCP.

detect_beats

detect_tempo

detect_onsets

detect_pitch

denoise_voice

detect_speech_segments

whisper_info

transcribe

transcribe_to_subtitles

piper_info

piper_runtime_set_enabled

Persistently enable or disable Piper only after confirm=true. The choice applies immediately and survives restarts without changing deployment YAML.

piper_import_voice_file

tts_local

subtitle_retime

Scale all subtitle timestamps and optionally shift them in milliseconds.

transcribe_words

Transcribe media and return word-like timestamp spans from whisper.cpp.

detect_scenes

split_scenes

scene_thumbnails

subtitle_create

subtitle_shift

subtitle_convert

subtitle_style_ass

subtitle_burn

timeline_create

timeline_inspect

timeline_add_clip

timeline_move_clip

timeline_add_transition

timeline_add_marker

timeline_export

detect_silence

detect_black_frames

detect_freeze

analyze_loudness

normalize_loudness

crop_detect

detect_interlacing

extract_contact_sheet

compare_ssim_psnr

safe_crop

loop_video

reverse_video

speed_ramp

frame_similarity

motion_score

select_best_frame

detect_duplicate_frames

extract_keyframes

make_storyboard

build_status

Report build/version, safe runtime configuration and registered v3.1 local-AI/resource capabilities.

comfy_upload_cached_media

Stage a cached image, audio, video, or other file into ComfyUI `/input`.

comfy_upload_cached_image

Backward-compatible image-only cache -> ComfyUI adapter.

cache_status

Inspect persistent MCP media-cache size and the active retention policy.

cache_cleanup

Apply the configured cache-retention policy; defaults to a safe dry run.

cache_pin

Protect an important cached artifact from retention cleanup.

cache_unpin

Remove retention protection from a cached artifact.

save_uploaded_file

Save one file attached in ChatGPT directly into the Video Gen cache.

save_uploaded_files

Save several ChatGPT-attached files directly into the Video Gen cache.

external_backends_status

Return availability and configuration status for every external execution backend.

blender_info

Return Blender bridge availability/version without failing when Blender is absent.

blender_execute_python

Execute a Blender Python job on the optional host bridge.

blender_render_blend

Render one frame from a cached .blend file through the optional Blender bridge.

blender_render_animation

Render a cached .blend animation to H.264 MP4 through the optional Blender bridge.

blender_export_glb

Export a cached .blend scene, including animation when present, as binary glTF/GLB.

import_remote_file

Import a server-retrievable HTTPS file reference into the MCP cache.

file_transfer_guide

Return the canonical routing rules for moving files through MCP Video Gen.

cache_text_file

Import UTF-8 text authored by the client/AI into the persistent cache.

get_cached_file_info

Return cache metadata and transfer options for one local file_id.

26 further tools are not listed here. The complete surface is in the source.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configCOMFYUI_SCHEME

configCOMFYUI_HOST

configCOMFYUI_PORT

configCOMFYUI_BASE_PATH

configMCP_LISTEN_PORT

configMCP_RUN_UID

configMCP_RUN_GID

configMAX_UPLOAD_MB

configMAX_INLINE_OUTPUT_MB

configSCAN_MAX_FILES

configFFMPEG_TIMEOUT_SEC

configHYPERFRAMES_TIMEOUT_SEC

configCF_ACCESS_TEAM_DOMAIN

configCF_ACCESS_AUD

configPUBLIC_BASE_URLWhen is set, the URI points to:

configVIDEO_MCP_DATA_ROOT

configHYPERFRAMES_PROJECTS_ROOT

configVIDEO_MCP_APP_VERSION

configSILERO_VAD_MODEL_PATH

configWHISPER_CPP_BINARY

configWHISPER_MODEL_PATH

configPIPER_ENABLED

configBLENDER_BRIDGE_BIND

configBLENDER_BRIDGE_PORT

🔐 secretBLENDER_BRIDGE_TOKEN

configBLENDER_BRIDGE_ROOT

configBLENDER_BINARY

configBLENDER_BRIDGE_MAX_INPUT_MB

configBLENDER_BRIDGE_MAX_SCRIPT_CHARS

configBLENDER_BRIDGE_MAX_TIMEOUT_SEC

configBLENDER_BRIDGE_MAX_LOG_CHARS

configBLENDER_BRIDGE_JOB_TTL_SEC

configQWEN_TTS_DEVICE

configQWEN_TTS_ATTENTION

configQWEN_TTS_MAX_NEW_TOKENS

configPIPER_VOICES_ROOT

configAUDIT_RETENTION_DAYS

configAUDIT_MAX_ROWS

configVIDEO_MCP_SOURCE_REF

configVIDEO_MCP_APP_DIR

configREMOTE_IMPORT_ALLOWED_HOSTS

configREMOTE_IMPORT_MAX_REDIRECTS

configREMOTE_IMPORT_TIMEOUT_SEC

configBLENDER_BRIDGE_URL

configBLENDER_BRIDGE_TIMEOUT_SEC

configBLENDER_INPUT_DIR

configBLENDER_OUTPUT_DIR

configMUSIC_MAX_DOWNLOAD_MB

configQWEN_TTS_REQUEST_TIMEOUT_SEC

configWEBGUI_ENABLED

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

128/128 tools missing one or more hints — inventory_summary (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_loaded_nodes (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_node_definition (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +125 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

15 tools perform destructive updates without destructiveHint — concat_videos deletes at line 520 (shutil.rmtree(temp, ignore_errors=True)); denoise_voice deletes at line 74 (finally:shutil.rmtree(w,ignore_errors=True)); detect_speech_segments deletes at line 104 (finally:shutil.rmtree(w,ignore_errors=True))

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Descriptions match behaviour

1 tool describes read intent but its handler mutates — cache_output (line 326: out.write_bytes(blob))

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool test coverage

86/128 tools referenced in tests (67%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets stay with their owner

4 secrets sent to a request target we could not resolve (BLENDER_BRIDGE_TOKEN → dynamic, BLENDER_BRIDGE_TOKEN → dynamic) — often a configured endpoint, not necessarily third-party

Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.

Tool description accuracy

cache_output: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/the-code-learner/mcp-video-gen?variant=verified)](https://m8ven.ai/mcp/the-code-learner/mcp-video-gen)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: e220e9d4fde42a60e647d6ff27ffbc119b043728

code hash: 127fea50107a324e847c28edcaf7aabdc1e9c9e1c68a612613548b7d5a9d9902

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client