
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
runsheet-mcp
Advanced tools
Runsheet's local MCP server. Uploads videos from your own machine straight to YouTube and schedules them, and forwards the rest of Runsheet's YouTube toolkit to Claude, Cursor or any MCP client.
The local MCP server for Runsheet, a YouTube scheduling app. It connects Claude, Cursor or any MCP client to your YouTube channel, and uploads videos from your own machine straight to YouTube.
npx -y runsheet-mcp
Published on npm as runsheet-mcp. No install step,
no dependencies, Node 20 or newer.
Runsheet also has a hosted MCP server at https://runsheet.buildifyapp.in/api/mcp. For reading
your channel, writing copy and scheduling, that is the simpler option: nothing to run on your
machine. Setup is at https://runsheet.buildifyapp.in/mcp.
This package exists for the one thing a hosted server cannot do. MCP carries JSON-RPC messages and has no file channel, and a remote server cannot read your disk, so uploading a video is impossible over a hosted endpoint. A process running on your own machine can do both.
To upload, this server asks Runsheet to open a YouTube resumable upload session, then streams the file from your disk directly to Google. Runsheet sees the title, description, tags and a session URL. It never receives a byte of the video. That is the same path the upload in Runsheet's website takes.
Sign in at https://runsheet.buildifyapp.in, open Settings, then API keys, and create a key.
rsk_live_ and is shown once. Permissions are fixed when a key is made, so a
leaked read-only key can never gain write access. To change permissions, make a new key.The key goes in the RUNSHEET_API_KEY environment variable.
Claude Code
claude mcp add --env RUNSHEET_API_KEY=rsk_live_your_key_here --transport stdio runsheet -- npx -y runsheet-mcp
Cursor: add this to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project).
Claude Desktop: add this to claude_desktop_config.json, found through Settings, Developer,
Edit Config. It lives at ~/Library/Application Support/Claude/ on macOS and %APPDATA%\Claude\ on
Windows. Restart Claude Desktop afterwards.
{
"mcpServers": {
"runsheet": {
"command": "npx",
"args": ["-y", "runsheet-mcp"],
"env": { "RUNSHEET_API_KEY": "rsk_live_your_key_here" }
}
}
}
Any other MCP client that can launch a stdio server takes the same command, arguments and environment variable.
The tool list is fetched from Runsheet when the server starts, so a tool added to Runsheet appears here without a new version of this package.
ffprobe is optional. It ships with ffmpeg. With it, Short versus long video is detected from
the file's dimensions. Without it, pass kind yourself.Local, only in this package:
| Tool | What it does |
|---|---|
runsheet_list_local_videos | Lists video files in a folder with size, duration, orientation and whether a thumbnail sits next to each |
runsheet_upload_video | Streams a file from your disk to YouTube as public (at a publish time), unlisted or private, with its title, description, tags and thumbnail |
A thumbnail is picked up automatically if an image sits next to the video with the same name, or is
named thumbnail or thumbnail_16x9 (.png, .jpg, .jpeg or .webp, under 2MB).
Forwarded to the hosted server, subject to your key's permissions:
It cannot make anything public on the spot. You choose who can watch each upload with privacy:
public goes up private and YouTube makes it public itself at a publish time at least fifteen
minutes away, unlisted goes up now for people with the link, and private goes up now as a private
draft. Public right now is left to you, in Runsheet or Studio. This is enforced on Runsheet's server,
not by a prompt, because a model that publishes the wrong file to a real audience cannot take it back.
It deletes nothing on its own. Deleting a video is a separate permission on the hosted server, never ticked by default: it needs the video's exact title and always waits ten minutes with an Undo emailed to the creator.
Until Runsheet's YouTube API compliance audit clears, uploads are capped at:
A large batch uploads up to the limit and then stops, with a message saying when the allowance returns. YouTube's quota resets at midnight Pacific time.
| Variable | Required | Default |
|---|---|---|
RUNSHEET_API_KEY | yes | none |
RUNSHEET_URL | no | https://runsheet.buildifyapp.in |
RUNSHEET_URL exists for development against a local copy of Runsheet. You will not need it. Your
key is sent to whatever address it names, so never point it at a server you do not trust.
"RUNSHEET_API_KEY is not set": the key is not reaching the process. Most clients need it under
env in the server config rather than in your shell.
"This API key does not have the upload permission": make a new key with Upload from this machine ticked. Existing keys cannot be upgraded.
"That API key is not valid, or it has been revoked": the key was mistyped or deleted. Make a new one under Settings, API keys.
The client shows no tools: check your client's MCP logs. This server writes its diagnostics to stderr and never to stdout, because anything on stdout that is not a JSON-RPC message corrupts the stream.
npx is not found on Windows: some clients cannot launch npx directly. Use
"command": "cmd" and "args": ["/c", "npx", "-y", "runsheet-mcp"].
The full policy is at https://runsheet.buildifyapp.in/privacy. In short, for this extension:
MIT. See LICENSE.
FAQs
Runsheet's local MCP server, for the YouTube autopilot. Uploads videos from your own machine straight to YouTube and schedules them, and forwards the rest of Runsheet's YouTube toolkit to Claude, Cursor or any MCP client.
We found that runsheet-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.