
Security News
Insecure Agents Podcast: How to Keep AI Agents From Bypassing Security Controls
Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.
@sylphx/cue
Advanced tools
Cue — Evidence-first video reading for AI agents — ffprobe, subtitles, scenes, transcripts, and timelines without frame-by-frame LLM vision. (brand alias of @sylphx/video-reader-mcp)
Cue (transitional package @sylphx/video-reader-mcp) — local video timeline evidence, not frame-by-frame VLM.
Evidence-first video reading for AI agents. One call turns any local video into a timeline document — ffprobe streams, chapters, embedded subtitles, scene boundaries, and warnings you can cite without frame-by-frame vision LLM calls.
Local-first · One smart read_video call · Timeline evidence + provenance · 20 tests
SOTA family roadmap: docs/roadmap/sota-family-roadmap.md.
⭐ Star this repo if agents should read video timelines with proof, not sampled frame captions. · Quick start · See it work · Why not frame-by-frame vision?
This repository is product SSOT. Sibling agent tools live in separate repos. Each instrument is an independent repository (marketplace + stars).
Cue is local-first timeline architecture: streams, dialogue, scene cuts, structural keyframes, and agent_index for text-only agents.
Spec: docs/specs/agent-video-read-contract.md
Local-first frontier: ffmpeg/ffprobe + structural keyframes, optional local whisper ASR. No cloud required.
| Doc | Purpose |
|---|---|
| docs/POSITIONING.md | Strategic positioning |
| docs/COMPETITIVE.md | Peer anchors and wedge |
| docs/EVIDENCE_CONTRACT.md | Evidence = result contract |
| docs/TOOL_SURFACE.md | Few clear tools policy |
| docs/PRODUCT_INDEPENDENCE.md | This repo is SSOT |
| docs/IPPB.md | Independent public product bar |
| docs/PUBLISH.md | npm/git publish status |
Videos are not a pile of frames. They are codecs, chapters, embedded subtitles, scene cuts, variable frame rates, and timelines measured in milliseconds.
Most agent stacks sample frames and ask a vision LLM what it sees. Subtitles get skipped. Scene boundaries vanish. Duration and stream metadata never reach context. Citations become "around minute two, I think." Then the agent hallucinates — confidently.
Video Reader MCP is built for the moment your agent needs a citeable timeline, not a slideshow summary.
| Typical vision path | Video Reader MCP |
|---|---|
| Sample N frames into a vision model | ffprobe format + stream metadata in one call |
| Paraphrased "what happens" | Embedded subtitle cues with start_ms, end_ms, and provenance |
| Scene changes guessed from captions | Optional ffmpeg scene filter with timestamp evidence |
| Missing audio / VFR silently ignored | Warnings for missing ffmpeg/ffprobe, VFR, missing audio, skipped ASR |
| Cloud API by default | Local-first — ffprobe + ffmpeg on your machine |
| Ship and pray | 20 tests on parsers, fixture corpus, doctor, release gate, and integration |
npm install -g @sylphx/video-reader-mcp
cue doctor
claude mcp add cue -- npx @sylphx/video-reader-mcp
Install once. Call once.
claude mcp add video-reader -- npx @sylphx/video-reader-mcp
{
"sources": [{ "path": "/absolute/path/to/demo.mp4" }],
"include_subtitles": true,
"include_scenes": true
}
read_video builds a timeline document per source — no per-frame vision LLM
calls:
{
"source": "/absolute/path/to/demo.mp4",
"success": true,
"data": {
"provenance": {
"source": "/absolute/path/to/demo.mp4",
"tool": "read_video",
"version": "0.1.0",
"extracted_at": "2026-07-09T12:00:00.000Z"
},
"format": {
"format_name": "mov,mp4,m4a,3gp,3g2,mj2",
"duration_ms": 125500
},
"streams": [
{ "index": 0, "codec_type": "video", "width": 1920, "height": 1080 },
{ "index": 1, "codec_type": "audio", "channels": 2, "sample_rate": 48000 }
],
"chapters": [
{ "id": 0, "start_ms": 0, "end_ms": 60250, "title": "Intro" }
],
"subtitles": [
{
"index": 0,
"start_ms": 1200,
"end_ms": 3400,
"text": "Welcome to the demo.",
"provenance": { "method": "ffmpeg_extract", "format": "srt" }
}
],
"scenes": [
{
"index": 0,
"time_ms": 45200,
"provenance": { "method": "ffmpeg_scene_filter", "threshold": 0.4 }
}
],
"warnings": []
}
}
Abbreviated shape — optional local ASR transcript hooks skip gracefully when no adapter is wired.
>=22.13PATH| Tool | Use it when the agent needs to... |
|---|---|
read_video | Read one or more local videos and return ffprobe metadata, chapters, subtitles, scenes, and timeline warnings. |
Supported formats: MP4, M4V, MKV, MOV, WebM, and other formats ffprobe can inspect.
claude mcp add video-reader -- npx @sylphx/video-reader-mcp
Add this to claude_desktop_config.json:
{
"mcpServers": {
"video-reader": {
"command": "npx",
"args": ["@sylphx/video-reader-mcp"]
}
}
}
npx @sylphx/video-reader-mcp
MCP_TRANSPORT=http MCP_HTTP_PORT=8080 npx @sylphx/video-reader-mcp
read_video inspects local files; remote URLs are not fetched by default.Claims are backed by CI benchmark:release-gate, fixture corpus checks, and the shipped-path matrix (Rust-default primary tools).
bun run benchmark:release-gate
Artifact: benchmark-artifacts/video_reader_release_gate.json — must report status: passed before release.
git clone https://github.com/SylphxAI/video-reader-mcp.git
cd video-reader-mcp
bun install
bun run build
bun test
bun run doctor
bun run benchmark:release-gate
Useful checks:
bun run check
bun run typecheck
bun run benchmark:release-gate
Example read_video requests live in examples/. CI runs parser,
fixture corpus, doctor, and release-gate checks; integration tests exercise ffmpeg
when available on the runner.
If frame-by-frame vision guesses have wasted your context, your citations, or your trust in agent output, you are exactly who this project is for.
⭐ Star the repo — it is the fastest way to help more agent builders find evidence-first video reading. Share it in your MCP client setup, team wiki, or agent stack README.
| Channel | Status |
|---|---|
| Glama MCP directory | Listed — claim server for full discoverability |
| Official MCP Registry | Listed — io.github.SylphxAI/video-reader-mcp @ v0.1.0 |
| TensorBlock MCP Index PR #1113 | Open — multimedia/document processing listing |
| MCP servers community issue #4500 | Open — community server highlight |
| mcp.so listing issue #3068 | Open — directory submission request |
| mcpservers.org submit | Not listed yet — free web-form submission |
Know another MCP directory? Open an issue with the link.
MIT © SylphxAI
FAQs
Cue — video answers with timestamp-level proof. The default read returns container metadata, streams, chapters, and embedded subtitles. Scenes and frames are separate.
The npm package @sylphx/cue receives a total of 301 weekly downloads. As such, @sylphx/cue popularity was classified as not popular.
We found that @sylphx/cue demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Socket CTO Ahmad Nassri discusses how to keep AI agents from bypassing package blocks, limit credential access, and monitor their actions.

Security News
GPT-6 Astra tried to plant malicious code in simulated open source projects using fake GitHub accounts and deceptive PRs during an assigned CTF challenge.

Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.