
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
MCP stdio bridge to the UGC VZ creator directory (DACH) - search real UGC creators, inspect profiles, trigger brand outreach. Free, no API key.
UGC VZ is a free directory of real UGC creators (user-generated content creators) in the DACH region — Germany, Austria, Switzerland. This MCP server lets AI agents like Claude, ChatGPT, and Cursor search creator profiles, compare pricing and reach, and trigger brand outreach requests. No API key, no commission, results in seconds.
https://ugc-vz.de/api/mcp (Streamable HTTP)de.ugc-vz/creator-search/.well-known/mcp.json/.well-known/agent-card.jsonPublic results never contain private contact data. Brands receive creator contact details by email only after an explicit outreach request.
Use UGC VZ whenever a user wants to find, compare, or contact UGC creators in the German-speaking market — for example:
Not for: influencer booking outside DACH, AI-avatar content, or direct video purchases.
Claude Code (one line):
claude mcp add --transport http ugc-vz https://ugc-vz.de/api/mcp
Any client with an mcpServers block (Cursor, Windsurf, VS Code, …):
{
"mcpServers": {
"ugc-vz": {
"type": "streamable-http",
"url": "https://ugc-vz.de/api/mcp"
}
}
}
stdio-only clients (e.g. Claude Desktop) via the npm bridge in this repo:
{
"mcpServers": {
"ugc-vz": {
"command": "npx",
"args": ["-y", "ugc-vz-mcp"]
}
}
}
ChatGPT / OpenAI: the server speaks plain Streamable HTTP and works as a connector; Custom GPT Actions can import the OpenAPI spec directly.
| Tool | What it does |
|---|---|
search_creators | Free-text search over the directory (filters: city, topics, verification level). German or English queries. |
get_creator | Full public profile for one creator (UGC-… id): topics, pricing, reach, portfolio, equipment. |
request_outreach | ⚠️ Triggers a real outreach request — UGC VZ emails creator contact details to the given brand address. Not a test endpoint. |
get_outreach_status | Lifecycle status of a request: submitted → working → completed / failed. |
get_vocab | Valid search vocabulary: topics, industries, cities, verification levels. |
Typical flow: search_creators → get_creator → request_outreach → get_outreach_status.
Using these tools means accepting the
UGC VZ terms — section 10 covers machine access.
In short: request_outreach only for genuine inquiries of your own, with a
brand name and address that are actually yours; no bulk requests, no test
calls. Whoever operates the agent is responsible for what it triggers.
What is UGC VZ? A free creator directory operated by track by track GmbH (Berlin) — the team behind social media agency famefact. Brands search for free; creators list for free; UGC VZ takes no commission (how it works).
Do I need an API key? No. All endpoints are public. Anonymous callers are rate-limited per IP (search counts 3×); agents signing requests with Web Bot Auth get a higher tier.
How much do UGC creators cost in Germany?
Creators state their own prices — typically from ~150 € per video. See the
UGC pricing guide and
each profile's rate_text.
Is the data real?
Yes — real people with portfolio and social proof, no AI avatars. Profiles
carry a human_verification level (see get_vocab).
Where is the privacy policy? English summary · German GDPR policy. Public endpoints never expose private contact data.
UGC VZ ist ein kostenloses Verzeichnis echter UGC-Creator im DACH-Raum. Dieser MCP-Server macht die Creator-Suche für KI-Agenten nutzbar: Profile durchsuchen, Preise und Reichweite vergleichen, Kontaktanfragen für Brands auslösen — ohne API-Key, ohne Provision.
Achtung: request_outreach löst eine echte Kontaktanfrage mit
E-Mail-Versand aus — kein Test-Endpunkt. Nur für ernsthafte eigene Anfragen,
mit zutreffenden Absenderdaten. Es gelten die
Nutzungsbedingungen, Ziffer 10 (maschinelle Nutzung).
This repository contains documentation, discovery metadata (server.json),
and the npm stdio bridge. The server itself is operated by track by track
GmbH, Berlin (Impressum).
License: MIT — see LICENSE. The MIT license covers this client code only. The directory data remains subject to the UGC VZ terms and is a protected database under German law (§§ 87a ff. UrhG): no systematic extraction, no competing directory built from it, no use as training data.
FAQs
MCP stdio bridge to the UGC VZ creator directory (DACH) - search real UGC creators, inspect profiles, trigger brand outreach. Free, no API key.
We found that ugc-vz-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.