
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@mrsknetwork/ytmcp
Advanced tools
Once connected, your AI can:
The server supports three access tiers. Pick the one that fits your use case.
Works out of the box. The get_video_transcript tool uses yt-dlp to extract transcripts without any API credentials.
{
"mcpServers": {
"youtube-mcp": {
"command": "npx",
"args": ["-y", "@mrsknetwork/ytmcp@latest"]
}
}
}
Unlocks all public data tools. Best for search, metadata, comments, and transcripts.
1. Get a Google API Key
2. Add to your MCP client config
{
"mcpServers": {
"youtube-mcp": {
"command": "npx",
"args": ["-y", "@mrsknetwork/ytmcp@latest", "YOUR_GOOGLE_API_KEY"]
}
}
}
1. Create an OAuth 2.0 Client
http://localhost:31415/oauth2callback.2. Add to your MCP client config
Credentials are passed securely via environment variables in the MCP config. They are never stored in files.
{
"mcpServers": {
"youtube-mcp": {
"command": "npx",
"args": ["-y", "@mrsknetwork/ytmcp@latest"],
"env": {
"GOOGLE_CLIENT_ID": "your-client-id.apps.googleusercontent.com",
"GOOGLE_CLIENT_SECRET": "your-client-secret"
}
}
}
}
3. First-time login
On your first tool call, the AI will share a login link. Click it, authorize the app in your browser, then tell the AI you are done. Your session is saved - you won't need to log in again unless you revoke access.
| Tool | Auth Required | Description |
|---|---|---|
get_video_transcript | None | Extract a full video transcript via yt-dlp. |
search_content | API Key / OAuth | Search for videos, channels, or playlists. |
get_video_metadata | API Key / OAuth | Fetch metadata and stats for specific videos. |
get_channel_metadata | API Key / OAuth | Fetch channel profile and subscriber info. |
list_playlists | API Key / OAuth | Retrieve playlists for a channel. |
list_playlist_items | API Key / OAuth | List videos inside a playlist. |
list_video_comments | API Key / OAuth | Get top-level comments for a video or channel. |
list_comment_replies | API Key / OAuth | Get replies to a specific comment. |
list_video_captions | API Key / OAuth | List available caption tracks for a video. |
list_video_categories | API Key / OAuth | List YouTube video categories by region. |
list_supported_languages | API Key / OAuth | List languages supported by YouTube. |
list_supported_regions | API Key / OAuth | List regions supported by YouTube. |
list_channel_activities | API Key / OAuth | Get recent activity for a channel. |
list_channel_sections | API Key / OAuth | Get the sections on a channel page. |
list_subscriptions | OAuth only | List subscriptions for a channel or your account. |
list_channel_members | OAuth only | List members of your channel. |
list_membership_levels | OAuth only | List membership tiers for your channel. |
git clone https://github.com/mrsknetwork/ytmcp.git
cd ytmcp
npm install
npm run build
node build/server/index.js "YOUR_API_KEY"
Licensed under the MIT License.
FAQs
YouTube MCP Server
The npm package @mrsknetwork/ytmcp receives a total of 36 weekly downloads. As such, @mrsknetwork/ytmcp popularity was classified as not popular.
We found that @mrsknetwork/ytmcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.