
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
runsheet-mcp
Advanced tools
Runsheet's local MCP server. Uploads videos from your own machine straight to YouTube and schedules them, and forwards the rest of Runsheet's YouTube toolkit to Claude, Cursor or any MCP client.
The local MCP server for Runsheet, a YouTube scheduling app. It connects Claude, Cursor or any MCP client to your YouTube channel, and uploads videos from your own machine straight to YouTube.
npx -y runsheet-mcp
Published on npm as runsheet-mcp. No install step,
no dependencies, Node 20 or newer.
Runsheet also has a hosted MCP server at https://runsheet.buildifyapp.in/api/mcp. For reading
your channel, writing copy and scheduling, that is the simpler option: nothing to run on your
machine. Setup is at https://runsheet.buildifyapp.in/mcp.
This package exists for the one thing a hosted server cannot do. MCP carries JSON-RPC messages and has no file channel, and a remote server cannot read your disk, so uploading a video is impossible over a hosted endpoint. A process running on your own machine can do both.
To upload, this server asks Runsheet to open a YouTube resumable upload session, then streams the file from your disk directly to Google. Runsheet sees the title, description, tags and a session URL. It never receives a byte of the video. That is the same path the upload in Runsheet's website takes.
Sign in at https://runsheet.buildifyapp.in, open Settings, then API keys, and create a key.
rsk_live_ and is shown once. Permissions are fixed when a key is made, so a
leaked read-only key can never gain write access. To change permissions, make a new key.The key goes in the RUNSHEET_API_KEY environment variable.
Claude Code
claude mcp add --env RUNSHEET_API_KEY=rsk_live_your_key_here --transport stdio runsheet -- npx -y runsheet-mcp
Cursor: add this to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project).
Claude Desktop: add this to claude_desktop_config.json, found through Settings, Developer,
Edit Config. It lives at ~/Library/Application Support/Claude/ on macOS and %APPDATA%\Claude\ on
Windows. Restart Claude Desktop afterwards.
{
"mcpServers": {
"runsheet": {
"command": "npx",
"args": ["-y", "runsheet-mcp"],
"env": { "RUNSHEET_API_KEY": "rsk_live_your_key_here" }
}
}
}
Any other MCP client that can launch a stdio server takes the same command, arguments and environment variable.
The tool list is fetched from Runsheet when the server starts, so a tool added to Runsheet appears here without a new version of this package.
ffprobe is optional. It ships with ffmpeg. With it, Short versus long video is detected from
the file's dimensions. Without it, pass kind yourself.Local, only in this package:
| Tool | What it does |
|---|---|
runsheet_list_local_videos | Lists video files in a folder with size, duration, orientation and whether a thumbnail sits next to each |
runsheet_upload_video | Streams a file from your disk to YouTube, private, with an optional publish time and thumbnail |
A thumbnail is picked up automatically if an image sits next to the video with the same name, or is
named thumbnail or thumbnail_16x9 (.png, .jpg, .jpeg or .webp, under 2MB).
Forwarded to the hosted server, subject to your key's permissions:
It cannot publish anything immediately. An upload always goes up private. Either you give it a publish time at least fifteen minutes away and YouTube publishes it itself at that moment, or it stays a private draft. This is enforced on Runsheet's server, not by a prompt, because a model that publishes the wrong file to a real audience cannot take it back.
It cannot delete anything. There is no tool for it.
Until Runsheet's YouTube API compliance audit clears, uploads are capped at:
A large batch uploads up to the limit and then stops, with a message saying when the allowance returns. YouTube's quota resets at midnight Pacific time.
A channel connected with its own Google client, under Advanced on Runsheet's connect screen, spends its own YouTube allowance and is exempt from both limits.
| Variable | Required | Default |
|---|---|---|
RUNSHEET_API_KEY | yes | none |
RUNSHEET_URL | no | https://runsheet.buildifyapp.in |
RUNSHEET_URL exists for development against a local copy of Runsheet. You will not need it. Your
key is sent to whatever address it names, so never point it at a server you do not trust.
"RUNSHEET_API_KEY is not set": the key is not reaching the process. Most clients need it under
env in the server config rather than in your shell.
"This API key does not have the upload permission": make a new key with Upload from this machine ticked. Existing keys cannot be upgraded.
"That API key is not valid, or it has been revoked": the key was mistyped or deleted. Make a new one under Settings, API keys.
The client shows no tools: check your client's MCP logs. This server writes its diagnostics to stderr and never to stdout, because anything on stdout that is not a JSON-RPC message corrupts the stream.
npx is not found on Windows: some clients cannot launch npx directly. Use
"command": "cmd" and "args": ["/c", "npx", "-y", "runsheet-mcp"].
MIT. See LICENSE.
FAQs
Runsheet's local MCP server. Uploads videos from your own machine straight to YouTube and schedules them, and forwards the rest of Runsheet's YouTube toolkit to Claude, Cursor or any MCP client.
We found that runsheet-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.