
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@mrsknetwork/ytmcp
Advanced tools
A Model Context Protocol (MCP) server that provides tools for safely interacting with public YouTube data via the official YouTube Data API v3 and OAuth 2.0.
The following tools are exposed to any compatible MCP client (like Claude Desktop, Cursor, or Supernova):
| Tool Name | Description |
|---|---|
search_youtube_content | Search public videos, channels, and playlists. |
get_video_details | View video statistics, descriptions, and metadata. |
download_video_caption | Download and automatically parse clear-text transcripts via yt-dlp. |
get_channel_details | Inspect public channel subscriber counts and profiles. |
get_playlists | Get public user playlists. |
get_playlist_items | Look up videos inside a playlist. |
get_comment_threads | Fetch top-level comment threads for a video. |
get_comments_replies | Fetch specific comment replies. |
get_video_captions_metadata | Fetch available caption track metadata for a video. |
get_video_categories | Get localized video categories. |
get_supported_languages / Regions | Check YouTube localization support. |
(Tool capabilities matching YouTube Data API GET resources)
Create a .env file in the root directory where you are running the server.
GOOGLE_CLIENT_ID="your-google-oauth-client-id"
GOOGLE_CLIENT_SECRET="your-google-oauth-client-secret"
http://localhost:3000/oauth2callback).To install and use this MCP server with Claude Desktop, Cursor, or Antigravity, add it to your MCP server configuration:
{
"mcpServers": {
"youtube-mcp": {
"command": "npx",
"args": ["-y", "@mrsknetwork/ytmcp"]
}
}
}
git clone https://github.com/mrsknetwork/youtube-mcp.git
cd youtube-mcp
npm install
npm run build
npm start
When you run the server for the first time, it will automatically open a Google Login page in your default browser.
Authorize the application. Upon success, a tokens.json file will be generated locally so you don't continually need to authenticate.
Note: The authorization server spins up a small local express app strictly on 127.0.0.1:3000 to capture the callback securely.
ISC
FAQs
YouTube MCP Server
The npm package @mrsknetwork/ytmcp receives a total of 44 weekly downloads. As such, @mrsknetwork/ytmcp popularity was classified as not popular.
We found that @mrsknetwork/ytmcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.