github TypeScript analyzed eba6e53

thenavidm/youtube-mcp

YouTube MCP server for Claude Code and AI agents. Transcripts, channel research, performance analysis, comments, analytics, multi-channel management.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 16 tools

transport stdio · streamable-http · http counts 16 tools · 0 res · 0 prompts permission surface via README inference

analyze_channel

Recent videos scored against that channel's own median
delete_video

Permanent. Needs confirm: true
get_channel

Subscribers, total views, video count, uploads playlist
get_channel_analytics

Watch time, retention, traffic sources, subscriber change
get_my_channel

Your exact subscriber count, not the rounded public one
get_transcript

The full transcript, as prose or timestamped lines
get_transcripts

Up to 20 videos in one call
get_video

Full detail for one video
list_accounts

Every connected channel
list_comments

Comment threads on a video
list_my_videos

Your videos, including private and unlisted
list_transcript_languages

Every caption language, and whether it is auto-generated
reply_to_comment

Public reply. Needs confirm: true
search_transcript

Find a phrase, get timestamps that link to the second
search_videos

Search, with view counts and duration joined on
update_video

Title, description, tags, privacy

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit eba6e53 · analyzer v33 · 2w ago

credential in logs credential in log thenavidm-youtube-mcp-eba6e53/src/auth.ts :165 console.log(` YOUTUBE_REFRESH_TOKEN=${token.refresh_token}\n`);

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 19

fs thenavidm-youtube-mcp-eba6e53/src/safety.ts :20 import { appendFileSync } from "node:fs";
fs thenavidm-youtube-mcp-eba6e53/src/youtube/ytdlp.ts :17 import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";

shell thenavidm-youtube-mcp-eba6e53/src/auth.ts :15 import { spawn } from "node:child_process";
shell thenavidm-youtube-mcp-eba6e53/src/youtube/ytdlp.ts :16 import { spawn } from "node:child_process";

net thenavidm-youtube-mcp-eba6e53/src/auth.ts :13 import { createServer } from "node:http";
net thenavidm-youtube-mcp-eba6e53/src/transport/http.ts :14 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
net thenavidm-youtube-mcp-eba6e53/src/youtube/api.ts :92 const res = await fetch(TOKEN_URL, {
net thenavidm-youtube-mcp-eba6e53/src/youtube/transcripts.ts :114 const res = await fetch(url, { headers: HEADERS, signal: controller.signal });

secrets thenavidm-youtube-mcp-eba6e53/src/auth.ts :52 process.env.YOUTUBE_CLIENT_SECRET ??
secrets thenavidm-youtube-mcp-eba6e53/src/config.ts :55 process.env.YOUTUBE_CLIENT_SECRET ??
secrets thenavidm-youtube-mcp-eba6e53/src/transport/http.ts :31 token: process.env.YOUTUBE_HTTP_TOKEN || undefined,
secrets (weak) thenavidm-youtube-mcp-eba6e53/tests/config.test.ts :34 process.env.YOUTUBE_OAUTH_CLIENT_SECRET = "secret";