.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/tmdb-mcp-server</h1> <p><b>Search movies, TV, and people on The Movie Database (TMDB) — credits, ratings, trailers, images, recommendations, and region-aware streaming availability via MCP. STDIO or Streamable HTTP.</b> <div>8 Tools • 3 Resources</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
Eight tools organized search-before-detail — tmdb_search_titles resolves a name to an integer id, the get_* tools fetch full records, and tmdb_discover_titles / tmdb_get_trending / tmdb_get_watch_providers cover filtered browsing and streaming availability. TMDB keys on integer ids, not titles, so search comes first.
| Tool | Description |
|---|---|
tmdb_search_titles | Search movies, TV, and people by name. The required first step — resolves a name to the integer id the detail tools consume. |
tmdb_get_movie | Full movie detail in one call — synopsis, runtime, genres, US certification, budget/revenue, cast, crew, trailers, recommendations, keywords, external ids. |
tmdb_get_show | Full TV show detail — overview, air dates, status, season/episode counts, creators, networks, season summaries, cast, trailers, content rating. |
tmdb_get_season | Episode list for one season — names, air dates, runtimes, vote averages, stills, per-episode guest stars, plus the season's regular cast. |
tmdb_get_person | Person detail and full filmography — biography, vital dates, the combined_credits cast/crew lists, and cross-platform external ids. |
tmdb_discover_titles | Filtered, sorted discovery across movies or TV — the power-query: genre, date/vote ranges, vote-count floor, cast/crew/network, watch providers, runtime, sort. |
tmdb_get_trending | Trending movies, TV, or people for the day or week. |
tmdb_get_watch_providers | Region-scoped streaming availability (JustWatch) — flatrate/rent/buy/ads/free provider lists plus the TMDB link. A region code is required. |
All list and detail responses resolve image *_path fields to full https://image.tmdb.org/t/p/… URLs and resolve genre_ids[] to genre names. Every tool carries the TMDB attribution in its output enrichment.
tmdb_search_titlesResolve a movie, show, or person name to ranked results with integer ids.
multi mode (default) mixes movies, shows, and people, each result tagged with media_type; movie/tv/person restrict to one type and enable type-specific rankingyear filter (movie/tv modes), language override, include_adult toggle, and page for paging past the first 20id, media_type, title/name, release_year, overview, vote_average, resolved genre_names, and the relevant poster/profile URLtmdb_get_movieFetch full movie detail by TMDB id in a single request.
append_to_response — trim the append array to shrink the payload (e.g. ["credits"] for cast only)release_dates namespace; top-billed cast and key crew (Director/Writer/Screenplay/Producer); YouTube trailers with watch URLstmdb_get_watch_providerstmdb_get_showFetch full TV show detail by series id — the series mirror of tmdb_get_movie.
append_to_response set, with content_ratings (US TV rating) in place of release_datesseason_number from seasons[] to tmdb_get_season for the episode listtmdb_get_seasonFetch the episode list for one season of a show — bridges the show-level summary and per-episode detail.
series_id is echoed from the input — the TMDB season endpoint does not return it. Season 0 is "Specials"tmdb_get_personFetch person detail and the full combined filmography.
combined_credits split into cast_credits and crew_credits, recency-ordered (most recent first) and capped to a display size — the pre-cap totals are reported and truncation is disclosed in the enrichmenttmdb_discover_titlesThe power-query — filtered, sorted discovery across movies or TV.
with_genres/without_genres, exact year or a release_date_gte/lte window, vote_average range, vote_count_gte floor, with_cast/with_crew (movie), with_networks (tv), with_watch_providers + watch_region, with_original_language, and runtime rangevote_average.desc with vote_count_gte (~100–1000) so a 10.0-from-3-votes title does not dominatewith_cast/with_crew are movie-only and with_networks is tv-only on TMDB; the tool accepts them for both media_type values and no-ops the inapplicable ones with a noticewith_watch_providers requires a watch_region — streaming availability is region-specific. Omitting the region returns a typed region_required errortmdb_get_watch_providersFind where a movie or TV title streams in one region.
link — the supported path to actual deep linkswatch_region (ISO 3166-1 alpha-2) is required: availability is region-specific and there is no global answer; the response always carries a region caveattmdb_discover_titles with_watch_providers| Type | Name | Description |
|---|---|---|
| Resource | tmdb://movie/{movie_id} | Movie detail by id, as injectable context — the same enriched record as tmdb_get_movie. |
| Resource | tmdb://tv/{series_id} | Show detail by id — the same enriched record as tmdb_get_show. |
| Resource | tmdb://person/{person_id} | Person detail and filmography by id — the same record as tmdb_get_person. |
All resource data is also reachable via tools — the three resources are convenience wrappers over the detail service methods, so tool-only clients lose nothing. Search, discovery, trending, and seasons are query paths or intermediate records, not addressable entities, so they have no resources. There are no prompts: this is a data/lookup server with no recurring multi-step interaction template.
Built on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1TMDB-specific:
Authorization: Bearer*_path fields resolved to full https://image.tmdb.org/t/p/{size}{path} URLs — null paths omit the field rather than emitting a broken URLgenre_ids[] resolved to genre names from per-media_type maps cached at startup, so list results carry readable genres without an extra callappend_to_responseAgent-friendly output:
enrichment.attribution so it reaches both the structuredContent and content[] client surfacesA TMDB API Read Access Token is required. Create a free TMDB account, then copy the API Read Access Token (a v4 JWT) from your API settings — this server authenticates v3 endpoints with Authorization: Bearer <token>, not the legacy ?api_key= query parameter.
Add the following to your MCP client configuration file.
{
"mcpServers": {
"tmdb-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/tmdb-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"TMDB_API_KEY": "your-tmdb-read-access-token"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"tmdb-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/tmdb-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"TMDB_API_KEY": "your-tmdb-read-access-token"
}
}
}
}Or with Docker:
{
"mcpServers": {
"tmdb-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"-e", "TMDB_API_KEY=your-tmdb-read-access-token",
"ghcr.io/cyanheads/tmdb-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 TMDB_API_KEY=... bun run start:http
# Server listens at http://localhost:3010/mcpRefer to "your MCP client configuration file" generically — different clients use different config paths, and this server isn't client-specific.
git clone https://github.com/cyanheads/tmdb-mcp-server.gitcd tmdb-mcp-serverbun installcp .env.example .env
# edit .env and set TMDB_API_KEYAll configuration is validated at startup via Zod schemas. Key environment variables:
| Variable | Description | Default |
|---|---|---|
TMDB_API_KEY | Required. TMDB v4 API Read Access Token (JWT), sent as Authorization: Bearer. Not the v3 ?api_key= value. | — |
TMDB_LANGUAGE | Default response language as ISO 639-1, optionally with region (e.g. en-US). A per-call language input overrides it. | en-US |
TMDB_DEFAULT_REGION | Default ISO 3166-1 country hint used in region-aware error messages. tmdb_get_watch_providers still requires an explicit watch_region. | US |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for the HTTP server. | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (RFC 5424). | info |
STORAGE_PROVIDER_TYPE | Storage backend. | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t tmdb-mcp-server .
docker run --rm -e TMDB_API_KEY=your-token -p 3010:3010 tmdb-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/tmdb-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools and resources, and primes the startup cache in setup(). |
src/config | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools | Tool definitions (*.tool.ts) — the eight TMDB tools. |
src/mcp-server/resources | Resource definitions (*.resource.ts) — movie, TV, and person detail. |
src/services/tmdb | TMDB v3 REST client — Bearer auth, retry/timeout, the image/genre startup cache, and the imageUrl/genreNames helpers. |
tests/ | Unit and integration tests mirroring src/. |
See AGENTS.md (or CLAUDE.md, the same content) for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/mcp-server/*/definitions/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
<img src="https://www.themoviedb.org/assets/2/v4/logos/v2/blue_long_2-9665a76b1ae401a510ec1e0ca40ddcb3b0cfe45f1d51b77a308fea0845885648.svg" alt="TMDB" height="20"> This product uses the TMDB API but is not endorsed or certified by TMDB. Streaming availability data is provided by JustWatch via TMDB and is region-specific.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.