
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@mrsknetwork/ytmcp
Advanced tools
Once connected, your AI can:
@handle (e.g. @MrBeast).The server supports three access tiers. Pick the one that fits your use case.
Works out of the box. The get_video_transcript tool uses yt-dlp to extract transcripts without any API credentials.
{
"mcpServers": {
"youtube-mcp": {
"command": "npx",
"args": ["-y", "@mrsknetwork/ytmcp@latest"]
}
}
}
Unlocks all public data tools. Best for search, metadata, comments, trending videos, and transcripts.
1. Get a Google API Key
2. Add to your MCP client config
{
"mcpServers": {
"youtube-mcp": {
"command": "npx",
"args": ["-y", "@mrsknetwork/ytmcp@latest", "YOUR_GOOGLE_API_KEY"]
}
}
}
1. Create an OAuth 2.0 Client
http://localhost:31415/oauth2callback.2. Add to your MCP client config
Credentials are passed securely via environment variables in the MCP config. They are never stored in files.
{
"mcpServers": {
"youtube-mcp": {
"command": "npx",
"args": ["-y", "@mrsknetwork/ytmcp@latest"],
"env": {
"GOOGLE_CLIENT_ID": "your-client-id.apps.googleusercontent.com",
"GOOGLE_CLIENT_SECRET": "your-client-secret"
}
}
}
}
3. First-time login
On your first tool call, the AI will share a login link. Click it, authorize the app in your browser, then tell the AI you are done. Your session is saved. You will not need to log in again unless you revoke access.
4. Signing out
Ask your AI to call revoke_oauth_token to sign out and delete your stored credentials at any time.
| Tool | Auth Required | Description |
|---|---|---|
get_video_transcript | None | Extract a full video transcript via yt-dlp. Supports language_code (e.g. 'es') and prefers manual captions by default. |
search_content | API Key / OAuth | Search for videos, channels, or playlists. Filter by date range, duration (short/medium/long), quality (hd/standard), region, and sort order. |
get_video_metadata | API Key / OAuth | Fetch metadata, duration, and stats (views, likes, comments) for specific videos. |
get_channel_metadata | API Key / OAuth | Fetch channel profile, subscriber count, and uploads playlist. Accepts channel ID or @handle. |
list_trending_videos | API Key / OAuth | Fetch currently trending videos for a country and optional category. |
list_playlists | API Key / OAuth | Retrieve playlists for a channel. |
list_playlist_items | API Key / OAuth | List videos inside a playlist. |
list_video_comments | API Key / OAuth | Get top-level comment threads for a video or channel. Supports keyword filtering. |
list_comment_replies | API Key / OAuth | Get replies to a specific comment thread. |
list_video_captions | API Key / OAuth | List available caption tracks (language, type) for a video. |
list_video_categories | API Key / OAuth | List YouTube video categories by region. |
list_supported_languages | API Key / OAuth | List all languages supported by YouTube. |
list_supported_regions | API Key / OAuth | List all regions supported by YouTube. |
list_channel_activities | API Key / OAuth | Get a channel's recent upload and activity feed. |
list_channel_sections | API Key / OAuth | Get the shelf layout of a channel page. |
list_subscriptions | API Key (public) / OAuth (own) | List subscriptions for a channel or your own account. |
list_channel_members | OAuth only | List paying members of your channel. |
list_membership_levels | OAuth only | List membership tiers for your channel. |
revoke_oauth_token | OAuth only | Sign out and delete your stored Google credentials. |
git clone https://github.com/mrsknetwork/ytmcp.git
cd ytmcp
npm install
npm run build
node build/server/index.js "YOUR_API_KEY"
Licensed under the MIT License.
FAQs
YouTube MCP Server
The npm package @mrsknetwork/ytmcp receives a total of 36 weekly downloads. As such, @mrsknetwork/ytmcp popularity was classified as not popular.
We found that @mrsknetwork/ytmcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.