
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@mrsknetwork/ytmcp
Advanced tools
A Model Context Protocol (MCP) server that provides AI assistants (including Claude Desktop, Cursor, VS Code, and Antigravity) with tools for interacting with public and private YouTube data.
This server interfaces securely with the official YouTube Data API v3 and supports a tiered authentication system for maximum flexibility and reliability.
download_video_caption, function via yt-dlp extraction methods.revoke_authentication tool for secure session termination.yt-dlp integration.The recommended initialization method utilizes an existing YouTube Data API Key. This provides access to all public data endpoints (Search, Details, Captions).
Add the following configuration to your MCP client:
{
"mcpServers": {
"youtube-mcp": {
"command": "npx",
"args": [
"-y",
"@mrsknetwork/ytmcp@latest",
"YOUR_GOOGLE_API_KEY"
]
}
}
}
Accessing private data requires OAuth 2.0 configuration.
http://localhost:3000/oauth2callback.Define the credentials within your client's environment variables. The server will detect these variables, prioritize them over the positional API Key argument, and initiate the OAuth2 authorization flow upon the first tool execution.
{
"mcpServers": {
"youtube-mcp": {
"command": "npx",
"args": ["-y", "@mrsknetwork/ytmcp@latest"],
"env": {
"GOOGLE_CLIENT_ID": "your-google-oauth-client-id",
"GOOGLE_CLIENT_SECRET": "your-google-oauth-client-secret"
}
}
}
}
Note: The initial OAuth tool invocation will generate a secure URL requiring explicit browser authorization.
| Tool Name | Description | Requires Authentication |
|---|---|---|
download_video_caption | Extracts clear-text video transcripts via yt-dlp. | No (Guest Mode Supported) |
search_youtube_content | Performs queries for videos, channels, and playlists. | API Key or OAuth |
get_video_details | Retrieves video statistics, descriptions, and metadata. | API Key or OAuth |
get_channel_details | Retrieves channel subscriber metrics and profiles. | API Key or OAuth |
get_playlists | Retrieves user or channel playlists. | API Key or OAuth |
get_playlist_items | Retrieves the video index within a specified playlist. | API Key or OAuth |
get_comment_threads | Retrieves top-level comment threads for a video. | API Key or OAuth |
get_comments_replies | Retrieves specific reply threads to top-level comments. | API Key or OAuth |
get_subscriptions_list | Retrieves subscription data. | OAuth Only |
get_memberships_levels | Retrieves membership pricing tiers for a channel. | OAuth Only |
revoke_authentication | Terminates the active session and deletes stored tokens. | OAuth Only |
To compile and execute the server directly from source:
git clone https://github.com/mrsknetwork/youtube-mcp.git
cd youtube-mcp
npm install
npm run build
npx ts-node src/server/index.ts "YOUR_API_KEY"
When executing global installations (npm i -g @mrsknetwork/ytmcp) on Windows architectures, the following mitigations apply to common errors:
EPERM): Ensure all consuming agents (e.g., Claude Desktop) are completely exited before executing an upgrade. Active server instances will lock dependency files.bin-version-check): If the yt-dlp-exec Python verification framework fails, bypass the check utilizing environment variables:
$env:YTDLP_SKIP_PYTHON_CHECK="true"; npm i -g @mrsknetwork/ytmcp
Licensed under the MIT License.
FAQs
YouTube MCP Server
The npm package @mrsknetwork/ytmcp receives a total of 36 weekly downloads. As such, @mrsknetwork/ytmcp popularity was classified as not popular.
We found that @mrsknetwork/ytmcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.