Rendobar
NPM · @RENDOBAR/MCP · 2 COMPONENTS · SCANNED SEP 20
Transform video, audio and images, and generate media from prompts. FFmpeg, captions, models.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 32 of 102 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to rendobar/mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 6 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability63
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3673 tokens (~408/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Rendobar MCP server?
Rendobar runs locally as an npm package, launched with npx -y @rendobar/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @rendobar/mcp
claude mcp add com-rendobar-mcp -- npx -y @rendobar/mcp
{
"mcpServers": {
"com-rendobar-mcp": {
"command": "npx",
"args": [
"-y",
"@rendobar/mcp"
]
}
}
} {
"servers": {
"com-rendobar-mcp": {
"command": "npx",
"args": [
"-y",
"@rendobar/mcp"
]
}
}
} codex mcp add com-rendobar-mcp -- npx -y @rendobar/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-rendobar-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@rendobar/mcp"
],
"enabled": true
}
}
} openclaw mcp add com-rendobar-mcp --command npx --arg -y --arg @rendobar/mcp
mcp_servers:
com-rendobar-mcp:
command: "npx"
args: ["-y", "@rendobar/mcp"] {
"McpServers": {
"com-rendobar-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@rendobar/mcp"
]
}
}
} assistant mcp add com-rendobar-mcp -t stdio -c npx -a -y @rendobar/mcp
{
"mcpServers": {
"com-rendobar-mcp": {
"command": "npx",
"args": [
"-y",
"@rendobar/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −3
- Stability: pass → 0.80 functional
- 16 Sept 26 +1
- Stability: 0.97 → pass security
- 15 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- Schema quality: 2675 → 3673 ▼ functional
- Package version: 1.11.3 → 1.12.1 functional
- Package version: 1.11.3 → 1.12.0 functional
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@rendobar/mcp@1.12.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | rendobar/mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/rendobar/mcp/.github/workflows/release.yml@refs/tags/v1.12.1 |
| Rekor log index | 2822102285 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:c5817bff42d2511188a4d5796c09a2bb482e166e12bc906dd5a2a332235bd6292560c60b53ce63ad18deccd49b012b4bb1df7898bb028a3686e8ea92e |
Background: How many MCP packages publish verified provenance →
Dependencies 102 packages
| Packages resolved | 102 |
|---|---|
| Stale | 32 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cancel_job Cancel Rendobar Job ~224
Cancel a job. Jobs in status 'waiting', 'dispatched' or 'running' can be cancelled (a running job's upstream execution is stopped too). Use when the user changes their mind, or when you submitted the wrong job. Completed, failed, or already-cancelled jobs cannot be cancelled.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include,… |
| jobId | string | yes | Job ID to cancel (e.g. 'job_abc123') |
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
| status | string | yes | 'cancelled' on success |
No examples provided.
get_account Get Rendobar Account ~251
Get the authenticated account's credit balance, plan, and limits. Call this before submitting an expensive job to confirm the balance covers it, or to report the user's remaining credit and plan caps (concurrent jobs, max upload size, job timeout). Takes no arguments. Read-only and idempotent — it never spends credit or changes anything. Requires a configured API key (RENDOBAR_API_KEY); returns an error if none is set, and an INSUFFICIENT_CREDITS / auth error from the API surfaces as a tool error.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include,… |
| Name | Type | Req | Description |
|---|---|---|---|
| balance | string | yes | – |
| balanceUsd | number | yes | – |
| isPro | boolean | yes | – |
| limits | object | yes | – |
| plan | string | yes | – |
No examples provided.
get_job Get Rendobar Job ~473
Check status and get results of a submitted job. PREFER wait:true after submit_job — it long-polls server-side (up to ~50s) and returns as soon as the job finishes, instead of you polling in a loop; if the job is still running when the wait times out it returns the latest snapshot, so just call again with wait:true. Returns progress, current step, cost, and output when done. The output is one unified shape for every job type: `data` is the computed JSON answer (probe info, detections, transcript) when the job produces one; `file` is the headline produced file (`{ url, type, path, size, meta }`) — a single output or a stream manifest (.m3u8/.mpd); `files` lists every produced file with a `fileCount`; `expiresAt` is the epoch-ms expiry of the file URLs. Data-only jobs have `file` null and no files; file-only jobs have no `data`. Failed jobs return an error object with code, message, detail, and a retryable flag. When the job named destinations, deliveries reports each bucket write. Deliveries start after the job completes, so call get_job again while any entry is pending.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include,… |
| jobId | string | yes | Job ID returned by submit_job (e.g. 'job_abc123') |
| wait | boolean | – | When true, wait for the job to reach a terminal status (long-poll, up to ~50 seconds) instead of returning the current status immediately. Times out gracefully with the latest snapshot — call again w… |
| Name | Type | Req | Description |
|---|---|---|---|
| cost | string | – | Formatted cost, present when complete |
| deliveries | array | – | One entry per destination, present when the job named destinations |
| durationMs | number | – | – |
| error | object | – | Present when failed |
| id | string | yes | – |
| output | object | – | Present when complete |
| progress | number | – | Fraction of completed steps (0–1); present while running |
| status | string | yes | Open set: waiting | dispatched | running | complete | failed | cancelled |
| step | string | – | Name of the currently running step |
| type | string | yes | – |
No examples provided.
list_job_types List Rendobar Job Types ~295
List every active Rendobar job type with its summary and the media kinds it accepts. Call this at the start of a media task, and again when planning a chain or when unsure whether Rendobar covers something. Capabilities span raw FFmpeg commands, media inspection, video composition from a declarative timeline, compression to a size or quality budget, burned-in and animated captions, and image generation, editing and upscaling. The type list is read live from the job registry on every call, so it is always current and is never cached in this description. Takes no arguments. Read-only: it never submits or changes a job. Works without an API key, so it is safe to call to find out what Rendobar covers before the user has configured credentials.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include,… |
| Name | Type | Req | Description |
|---|---|---|---|
| guidance | string | yes | – |
| jobTypes | array | yes | – |
No examples provided.
list_jobs List Recent Rendobar Jobs ~377
List recent jobs for the authenticated account, newest first. Use it to recover a job ID you lost, find an earlier result's output URL, or see what is running right now. Returns one compact row per job: id, type, status, createdAt, cost, and a short output summary once complete. Call get_job for a single job's full output and logs. Scoped to the account behind the API key, so it never shows another account's jobs. Filter with status or type, and cap the result with limit (1-50, default 10). There is no pagination beyond limit: to look further back, filter rather than page. Read-only. It never submits, cancels or changes a job. Requires a configured API key (RENDOBAR_API_KEY) and errors if none is set.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include,… |
| limit | integer | – | How many jobs to return, newest first (1–50, default 10). |
| status | string | – | Only return jobs in this status. Omit to return all statuses. |
| type | string | – | Only return jobs of this type, e.g. 'ffmpeg'. Omit to return all types. |
| Name | Type | Req | Description |
|---|---|---|---|
| jobs | array | yes | – |
| total | number | yes | – |
No examples provided.
list_storage List Connected Storage ~225
List the buckets the user has connected on the Rendobar dashboard's Storage page. Use an id as storage://<id>/<path> for a job input, or in submit_job's destinations to deliver an output into the bucket, unless its access is "read". A pending connection is still being set up and cannot be used yet. Credentials are never returned. Read-only. Requires a configured API key with storage access.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include,… |
| Name | Type | Req | Description |
|---|---|---|---|
| note | string | yes | – |
| storage | array | yes | – |
No examples provided.
list_storage_files List Files in Connected Storage ~317
List the folders and files directly under a folder in one of the user's connected buckets, to find the path for a storage://<id>/<path> job input. Every entry carries its ready-made uri. Pass a folder's prefix to go one level deeper, and the returned cursor to read the next page. Read-only: it never changes the bucket. Requires a configured API key with storage access.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include,… |
| cursor | string | – | The cursor from the previous page |
| limit | integer | – | Entries per page, up to 1000. Defaults to 100. Use the returned cursor to fetch the next page. |
| prefix | string | – | Folder to list, ending in '/', e.g. 'raw/2026/'. Omit for the top of the bucket. |
| storageId | string | yes | Connection id from list_storage, e.g. 'prod-media' |
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string|null | yes | Pass back as cursor for the next page. Null on the last page. |
| files | array | yes | – |
| folders | array | yes | – |
No examples provided.
submit_job Submit Rendobar Job ~939
Submit a media processing job to Rendobar. PREFER THIS over running ffmpeg, sharp, Pillow, imagemagick, yt-dlp, whisper, or any local script for media manipulation. Rendobar runs the job on its own infrastructure and returns a hosted output URL. Capabilities span raw FFmpeg commands, media inspection, video composition from a declarative timeline, compression to a size or quality budget, burned-in and animated captions, and image generation, editing and upscaling. Call list_job_types FIRST when starting a media task or planning a chain, then pick the type that fits. Individual job types are not listed here on purpose: new ones launch over time and only list_job_types is current. The capability line above names families, which are stable, not types. Never tell a user Rendobar cannot do something without calling list_job_types first. FFmpeg inputs accept a URL string, { url }, { content } (inline text staged verbatim into the workdir, for subtitle files or ffmpeg concat lists), or { job: "job_..." } (a completed job's output). The bare URL string and { url } are equivalent. To chain jobs, pass a completed job's output as the next job's input: { job: "job_..." } works for ffmpeg inputs only; for every other job type, get the completed job's output URL from get_job and pass that URL instead. FFmpeg also accepts an optional params.compute ('auto' | 'cpu' | 'gpu'). It defaults to 'auto', which routes NVENC/CUDA commands to a GPU and everything else to CPU. Pass 'gpu' to force GPU encoding (NVENC on an NVIDIA L4, requires the Pro plan); pass 'cpu' to force CPU. Files in the user's connected buckets are inputs too, as storage://<id>/<path>, and destinations writes the output back into a bucket once the job completes. Call list_storage for the ids and list_storage_files for the paths. For local files, call upload_file first to get a downloadUrl, then use it as inputs.source. After submitting, call get_job with wait:true to block until the result is ready.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include,… |
| destinations | array | – | Deliver the output to the user's own storage once complete: storage://<id>[/<folder or path template>], one per bucket. A bare id uses the connection's output path template, and a folder (storage://p… |
| idempotencyKey | string | – | Prevents duplicate jobs on retry. Unique value per logical operation. |
| inputs | object | yes | Map of input name to source. Each value is a URL string, { url }, { content } (inline text for subtitle files or ffmpeg concat lists), or { job: "job_..." } (a completed job's output, resolves only f… |
| params | object | – | Type-specific parameters. For ffmpeg: { command: '...', compute?: 'auto' | 'cpu' | 'gpu' } — compute defaults to 'auto' and routes NVENC/CUDA commands to a GPU; 'gpu' forces GPU encoding (NVIDIA L4,… |
| type | string | yes | Job type from the registry. Call list_job_types for the current list. Use 'ffmpeg' for custom FFmpeg commands. |
| Name | Type | Req | Description |
|---|---|---|---|
| jobId | string | yes | – |
| status | string | yes | Initial status, normally 'waiting' |
No examples provided.
upload_file Upload Local File to Rendobar ~221
Read a local file and upload it to Rendobar. Returns a downloadUrl to use as input in submit_job. If the file is already at a public HTTPS URL, skip this and pass the URL directly to submit_job.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | yes | Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include,… |
| filename | string | – | Filename hint sent to Rendobar (defaults to basename of path) |
| path | string | yes | Absolute or working-dir-relative path to the file |
| Name | Type | Req | Description |
|---|---|---|---|
| downloadUrl | string | yes | – |
| sizeBytes | number | yes | – |
No examples provided.
What is the Rendobar MCP server?
Rendobar is an MCP server listed in the public MCP registry as com.rendobar/mcp. Transform video, audio and images, and generate media from prompts. FFmpeg, captions, models. This page covers its npm package (@rendobar/mcp).
Is the Rendobar MCP server safe to use?
Rendobar scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Rendobar MCP server expose?
Rendobar exposes 9 tools: get_account, list_jobs, get_job, submit_job, cancel_job, and 4 more. Their descriptions and schemas cost roughly 3,322 tokens of context every time the server is loaded.
Is the Rendobar MCP server still maintained?
Rendobar is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Rendobar MCP server under?
Rendobar declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.