Fvs Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Fvs Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: video.future/future-video-studio -->
Future Video Studio MCP lets agents create, monitor, cancel, and download cinematic AI video renders through the Future Video Studio Agent API.
The hosted MCP server is available at:
https://mcp.future.video/mcpThe same server can also run locally over stdio from this Python package.
The hosted service also serves the ChatGPT Apps domain verification endpoint at https://mcp.future.video/.well-known/openai-apps-challenge. Set OPENAI_APPS_CHALLENGE_RESPONSE only if the submission dashboard requires an exact challenge body.
The hosted MCP server is also ready to connect as a ChatGPT App in developer mode:
Connector URL: https://mcp.future.video/mcp
App manifest: https://mcp.future.video/chatgpt-app.json
Widget URI: ui://future-video-studio/render-console-v1.htmlThe app exposes a small render console inside ChatGPT. It can prepare a render, submit account-wallet jobs, create no-account Link pay-per-render quotes, poll status, show payment links, and open the finished video when FVS returns a signed final_video_url.
ChatGPT connector setup:
X-FVS-Agent-Key as a secret connector header.X-FVS-Agent-Key unset, or setX-FVS-Billing-Mode: pay-per-render.
X-FVS-Marketplace-* headers fromthe account-linking gateway.
In ChatGPT, enable developer mode, create a connector, and use https://mcp.future.video/mcp as the connector URL. The tool metadata links the render tools to the FVS widget using the MCP Apps ui.resourceUri field and the ChatGPT openai/outputTemplate compatibility field.
The hosted service also exposes a first A2A-compatible wrapper for the Google Cloud Marketplace / Gemini Enterprise Track 3 path:
https://mcp.future.video/.well-known/agent-card.json
https://mcp.future.video/message:send
https://mcp.future.video/tasks/{task_id}
https://mcp.future.video/tasks/{task_id}:cancelThe A2A layer uses the same X-FVS-Agent-Key account credential as the MCP server, marketplace-linked account headers, or paid quote mode. A message:send request can include either plain text brief parts or a structured fvs_render_request data part. Account and marketplace submissions create an FVS Agent API render and return an A2A task whose id is the FVS project_id. Paid quote submissions return HTTP 402 with an A2A task whose id is the quote_id; pay the returned Link/Stripe MPP payment_url, then poll /tasks/{quote_id}?claim_token=....
The Agent Card advertises the Official MCP Registry name, video.future/future-video-studio, so enterprise agents can see both the A2A delegation surface and the hosted MCP tool surface.
X-FVS-Agent-Key or FVS_AGENT_API_KEY. Renders chargethe owning Future Video Studio account wallet under the same credit model and saved pipeline defaults as the web app.
X-FVS-Marketplace-Account for a linkedmarketplace customer. Production deployments should also set X-FVS-Marketplace-Entitlement, X-FVS-Marketplace-Timestamp, and X-FVS-Marketplace-Signature from the account-linking gateway. The MCP server maps the marketplace account to a stored FVS Agent API key and charges the linked wallet.
X-FVS-Billing-Mode: pay-per-render. The server returns a Link/Stripe MPP payment quote, then exposes a claim-token status URL so the agent can retrieve the result.
Agents should get explicit user approval before submitting wallet-backed account renders.
Marketplace account mapping is configured with environment variables on the MCP deployment:
$env:FVS_MARKETPLACE_MODE = "optional"
$env:FVS_MARKETPLACE_SHARED_SECRET = "replace-with-random-secret"
$env:FVS_MARKETPLACE_REQUIRE_SIGNATURE = "true"
$env:FVS_MARKETPLACE_ACCOUNT_KEYS_JSON = '{"acct_google_123":{"api_key":"fvs_live_replace_me","entitlement_id":"ent_123","plan":"starter","status":"active"}}'The marketplace signature is HMAC-SHA256 over:
{unix_timestamp}.{marketplace_account_id}.{marketplace_entitlement_id}Send it as X-FVS-Marketplace-Signature: sha256=<hex>. The default timestamp window is 300 seconds and can be adjusted with FVS_MARKETPLACE_SIGNATURE_MAX_SKEW_SECONDS.
For Cloud Run production deploys, pass FVS_MARKETPLACE_SHARED_SECRET_SECRET and FVS_MARKETPLACE_ACCOUNT_KEYS_JSON_SECRET to scripts/deploy_mcp_cloud.ps1 so the HMAC secret and account-key mapping come from Secret Manager instead of plain environment variables.
fvs_submit_render: submit a render request, optionally with public asset URLsfvs_create_paid_render_quote: create a no-account Link payment quotefvs_get_render_status: check a render by project_id or status_urlfvs_get_paid_render_status: check a paid render by status_url or quote_id plus claim_tokenfvs_cancel_render: cancel a render by project_id or cancel_urlfvs_download_final_video: save a completed render from its signed URLfvs_example_render_request: return an example scene render payloadfvs_open_chatgpt_app: open the ChatGPT app widget without creating a renderUse fvs_download_final_video only after fvs_get_render_status or fvs_get_paid_render_status returns a final_video_url for a completed render. If a signed URL has expired, call the relevant status tool again to refresh it.
The download tool:
final_video_urloutput_path on the MCP server's local filesystemoverwrite is trueFVS_AGENT_API_KEYParameters:
final_video_url: an absolute HTTPS signed URL returned by a completed renderstatus response. Do not pass arbitrary or untrusted URLs.
output_path: a local path visible to the MCP server process, such asC:/Users/me/Videos/fvs-result.mp4 or /tmp/fvs-result.mp4.
overwrite: defaults to false; set it to true only when replacing thedestination file is intended.
Account mode:
{
"mcpServers": {
"future-video-studio": {
"url": "https://mcp.future.video/mcp",
"headers": {
"X-FVS-Agent-Key": "fvs_live_replace_me"
}
}
}
}Pay-per-render mode:
{
"mcpServers": {
"future-video-studio": {
"url": "https://mcp.future.video/mcp"
}
}
}Marketplace-linked mode:
{
"mcpServers": {
"future-video-studio": {
"url": "https://mcp.future.video/mcp",
"headers": {
"X-FVS-Billing-Mode": "marketplace-linked-account",
"X-FVS-Marketplace-Account": "acct_google_123",
"X-FVS-Marketplace-Entitlement": "ent_123",
"X-FVS-Marketplace-Timestamp": "<unix_timestamp>",
"X-FVS-Marketplace-Signature": "sha256=<hmac>"
}
}
}
}python -m pip install future-video-studio-mcp
python -m fvs_mcp_serverExample local stdio MCP config:
{
"mcpServers": {
"future-video-studio": {
"command": "python",
"args": ["-m", "fvs_mcp_server"],
"env": {
"FVS_AGENT_API_KEY": "fvs_live_replace_me",
"FVS_AGENT_BASE_URL": "https://app.future.video"
}
}
}
}FVS_AGENT_API_KEY is optional. Leave it unset to use paid quote mode. FVS_AGENT_BASE_URL defaults to https://app.future.video.
python -m pip install -e ".[dev]"
python -m pytest
python -m fvs_mcp_serverRun the HTTP transport locally:
$env:FVS_MCP_TRANSPORT = "streamable-http"
python -m fvs_mcp_serverBuild and check the package:
python -m build
python -m twine check dist/*This package is intended to publish to PyPI as:
future-video-studio-mcpThe MCP Registry package verification marker is the hidden comment near the top of this README:
<!-- mcp-name: video.future/future-video-studio -->video.future/future-video-studio~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.