Back to MCP Trust Indexm8ven
0
/ 100
1 month ago
glama

WhisperCUT

An MCP server that automates short-form video production for TikTok, Instagram Reels, and YouTube Shorts, using AI agents and behavioral science to generate production-ready videos from a topic and vibe.

→ wallpapa/WhisperCUT· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
3 flows detected: XAI_API_KEY, MINIMAX_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🚨
Reads files from sensitive locations
Touches: /tmp/tiktok-clone/.env, /tmp/tiktok-clone/.env
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 13 credentials: AI_API_KEY, CANVA_ACCESS_TOKEN, FAL_KEY, GEMINI_API_KEY, MEM0_API_KEY, MINIMAX_API_KEY, OPENROUTER_API_KEY, SUPABASE_ANON_KEY, SUPABASE_SERVICE_KEY, SYNC_API_KEY, TAVILY_API_KEY, XAI_API_KEY, HF_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowai@4.3.16GHSA-rwvc-j5jr-mgvh

Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files

lowuuid@11.1.0GHSA-w5hq-g745-h8pq

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretAI_API_KEY— your-key-from-aistudio.google.com
configAI_BASE_URL
configAI_MODEL— gemma3:27b
configAI_PROVIDER— openrouter
🔐 secretCANVA_ACCESS_TOKEN
configCANVA_TEMPLATE_ID
configEDGE_TTS_PYTHON
configEDGE_TTS_VOICE
🔐 secretFAL_KEY
configFB_PAGE_ID
configFFMPEG_PATH
🔐 secretGEMINI_API_KEY
configGRPO_POLICY_PATH
configIG_ACCOUNT_ID
configKAGGLE_INFERENCE_URL
configLIVEPORTRAIT_PATH
configLIVEPORTRAIT_PYTHON
🔐 secretMEM0_API_KEY
🔐 secretMINIMAX_API_KEY
configMINIMAX_GROUP_ID
configMINIMAX_TTS_URL
configMINIMAX_VOICE_ID
configOLLAMA_BASE_URL
🔐 secretOPENROUTER_API_KEY
configOUTPUT_DIR
configRESOURCE_TIER
configSADTALKER_PATH
configSADTALKER_PYTHON
configSTUDY_CHANNEL
🔐 secretSUPABASE_ANON_KEY
🔐 secretSUPABASE_SERVICE_KEY
configSUPABASE_URL
🔐 secretSYNC_API_KEY
🔐 secretTAVILY_API_KEY
configTELEMEM_URL
configTIKTOK_ACCOUNT_ID
configTIKTOK_SESSION_ID
configTIKTOK_USERNAME
configWHISPERCUT_DATA_DIR
configWHISPERCUT_DEFAULT_VOICE_PROFILE
configWHISPERCUT_SYSTEM_PYTHON
configWHISPERCUT_USER_EMAIL
configWHISPERCUT_VOICE_PROFILES_PATH
configWHISPERCUT_VOICE_TARGET_LANGUAGE
configWHISPER_MODEL
🔐 secretXAI_API_KEY
configYT_CHANNEL_ID
configYT_PROJECT_IDS
🔐 secretHF_TOKEN
configTELEMEM_DATA_DIR
configTELEMEM_CONFIG
configTELEMEM_PORT
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/wallpapa-whispercut-npgic4)](https://m8ven.ai/mcp/wallpapa-whispercut-npgic4)
commit: 830438cad583e731d6d00ba91028f75e1e259328
code hash: 30e247ac828e183d6476419d6c2342f85848dfc81ebbf2906597b90433a3a657
verified: 6/22/2026, 12:09:37 PM
view raw JSON →