Is Mcp Server Youtube safe to install?

SaferSkills independently audited Mcp Server Youtube (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md5.2 KB · Markdown

mcp-server-youtube

A Rust MCP server for YouTube. Search videos, read channels, browse playlists, fetch comments, and get transcripts — all from your AI assistant.

Why this one?

Full YouTube Data API v3 coverage — videos, channels, playlists, comments, categories, trending, search with all filters and sorting options
Working transcripts — uses rustypipe (InnerTube API) for reliable subtitle/caption extraction, including auto-generated captions. No API key quota consumed for transcripts
Single binary, zero runtime dependencies — written in Rust, starts instantly
Typed filter enums — search filters (duration, definition, license, etc.) are exposed as typed enums in the JSON schema, so AI models know exactly which values are valid without guessing

Tools

Videos

Tool	Description
`videos_getVideo`	Get video details (snippet, statistics, content details)
`videos_searchVideos`	Search videos with filters for duration, definition, date range, region, captions, license, category, and more. Supports sorting by relevance, date, rating, or view count
`videos_getCategories`	List video categories for a region
`videos_getTrending`	Get trending/most popular videos for a region, optionally filtered by category

Channels

Tool	Description
`channels_getChannel`	Get channel info and statistics by channel ID
`channels_getByHandle`	Look up a channel by its handle (e.g. `@shura_stone`)
`channels_search`	Search for channels by name
`channels_listVideos`	List videos from a channel (by date) with pagination

Playlists

Tool	Description
`playlists_getPlaylist`	Get playlist info
`playlists_getPlaylistItems`	List videos in a playlist with pagination

Comments

Tool	Description
`comments_getComments`	Get comment threads on a video with pagination

Transcripts & Captions

Tool	Description
`transcripts_getTranscript`	Get video transcript/subtitles. Works with both auto-generated and manual captions. Returns plain text by default; set `include_timestamps` for per-segment timing. Uses rustypipe (InnerTube API) — no API key quota consumed
`transcripts_getBatch`	Fetch transcripts for multiple videos in one call with concurrent fetching. No API key quota consumed
`transcripts_listLanguages`	List available subtitle/caption languages for a video

Setup

Get a YouTube API Key

Go to Google Cloud Console
Create a project (or select an existing one)
Enable the YouTube Data API v3
Create an API key under Credentials

Configuration

Environment Variable	CLI Flag	Default	Description
`YOUTUBE_API_KEY`	`--youtube-api-key`	required	YouTube Data API v3 key
`YOUTUBE_TRANSCRIPT_LANG`	`--transcript-lang`	`en`	Default transcript language
`MCP_TRANSPORT`	`--transport`	`stdio`	Transport: `stdio` or `streamable-http`
`HOST`	`--host`	`127.0.0.1`	HTTP bind address
`PORT`	`--port`	`3000`	HTTP port
`YOUTUBE_TRANSCRIPT_CONCURRENCY`	`--transcript-concurrency`	`50`	Max concurrent transcript fetches for batch operations

The API key is stored as a SecretString and never appears in logs or debug output.

Usage

Claude Desktop / Claude Code

With [uvx](https://docs.astral.sh/uv/):

{
  "mcpServers": {
    "youtube": {
      "command": "uvx",
      "args": ["mcp-server-youtube"],
      "env": {
        "YOUTUBE_API_KEY": "YOUR_API_KEY"
      }
    }
  }
}

With [rvx](https://github.com/vaporif/rvx):

{
  "mcpServers": {
    "youtube": {
      "command": "rvx",
      "args": ["mcp-server-youtube"],
      "env": {
        "YOUTUBE_API_KEY": "YOUR_API_KEY"
      }
    }
  }
}

<details> <summary>Other installation methods</summary>

With Nix:

nix run github:vaporif/mcp-server-youtube

With cargo:

cargo install mcp-server-youtube

From releases:

Download a prebuilt binary from GitHub Releases.

</details>

HTTP Transport

YOUTUBE_API_KEY=your_key mcp-server-youtube --transport streamable-http --port 3000

The server listens on http://127.0.0.1:3000/mcp.

Debugging

Enable debug logging to see tool invocations:

RUST_LOG=debug mcp-server-youtube

Development

# Enter dev shell (requires Nix)
nix develop

# Build
cargo build

# Test
cargo test

# Lint
cargo clippy --workspace -- -D warnings

# Format
cargo fmt --all

License

GPL-3.0-or-later

Mcp Server Youtube— agent skill

Is Mcp Server Youtube safe to install?

mcp-server-youtube

Why this one?

Tools

Videos

Channels

Playlists

Comments

Transcripts & Captions

Setup

Get a YouTube API Key

Configuration

Usage

Claude Desktop / Claude Code

HTTP Transport

Debugging

Development

License

Audit the pieces. Scan the whole. Decide.