Video Extract
NPM · @YANLINGLABS/VIDEO-EXTRACT-MCP · SCANNED SEP 24
Download any video from a URL, or get its transcript and key frames. All local, no API keys.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 44 of 170 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability60
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1542 tokens (~514/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Video Extract MCP server?
Video Extract runs locally as an npm package, launched with npx -y @yanlinglabs/video-extract-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @yanlinglabs/video-extract-mcp
claude mcp add com-yanlinglabs-video-extract-mcp -- npx -y @yanlinglabs/video-extract-mcp
{
"mcpServers": {
"com-yanlinglabs-video-extract-mcp": {
"command": "npx",
"args": [
"-y",
"@yanlinglabs/video-extract-mcp"
]
}
}
} {
"servers": {
"com-yanlinglabs-video-extract-mcp": {
"command": "npx",
"args": [
"-y",
"@yanlinglabs/video-extract-mcp"
]
}
}
} codex mcp add com-yanlinglabs-video-extract-mcp -- npx -y @yanlinglabs/video-extract-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-yanlinglabs-video-extract-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@yanlinglabs/video-extract-mcp"
],
"enabled": true
}
}
} openclaw mcp add com-yanlinglabs-video-extract-mcp --command npx --arg -y --arg @yanlinglabs/video-extract-mcp
mcp_servers:
com-yanlinglabs-video-extract-mcp:
command: "npx"
args: ["-y", "@yanlinglabs/video-extract-mcp"] {
"McpServers": {
"com-yanlinglabs-video-extract-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@yanlinglabs/video-extract-mcp"
]
}
}
} assistant mcp add com-yanlinglabs-video-extract-mcp -t stdio -c npx -a -y @yanlinglabs/video-extract-mcp
{
"mcpServers": {
"com-yanlinglabs-video-extract-mcp": {
"command": "npx",
"args": [
"-y",
"@yanlinglabs/video-extract-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 23 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- Known CVEs: pass → unverified ▼ security
- Stability: 0.80 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Schema quality: 353 → 514 ▼ functional
- Schema quality: 353 → 500 ▼ functional
- Dependency health: 0.90 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.13.0 → 0.16.2 functional
- Package version: 0.13.0 → 0.16.1 functional
- Package version: 0.13.0 → 0.16.0 functional
- Package version: 0.13.0 → 0.15.0 functional
- Package version: 0.13.0 → 0.14.0 functional
- 21 Sept 26 −3
- Stability: pass → 0.77 functional
- 19 Sept 26 +1
- Stability: 0.97 → pass security
- 17 Sept 26 +26
- GHSA-rgj7-g3m4-5g8c no longer affects this package ▲ security
- CVE-2026-39244 no longer affects this package ▲ security
- GHSA-f88m-g3jw-g9cj no longer affects this package ▲ security
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.90 ▲ functional
- 16 Sept 26 −22
- Stability: 0.87 → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Known CVEs: fail → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: 0.90 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.12.7 → 0.13.0 functional
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Analysed npm/@yanlinglabs/video-extract-mcp@0.16.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 170 packages
| Packages resolved | 170 |
|---|---|
| Stale | 44 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
analyze_video Analyze video ~684
Read a video: returns its transcript and a small set of important, deduplicated keyframes rather than every frame. Output is written to destinationPath -- read the returned paths; only a short transcript comes back inline. Each item returns { status, title, duration, frameCount, framePaths, manifestPath, transcriptPath?, transcript?, videoPath?, warnings, cookies }. Pass several items in videos to batch them; results come back one per item in order, and one failing does not fail the others. A single item writes into destinationPath, several into video-1/, video-2/. Pass start and end for part of a video. For one exact frame use the same second for both with frames: "even", maxFrames: 1, transcript: false. For a transcript alone use frames: "none" -- on a captioned video that skips the download entirely and takes seconds. Check every item's status. "rate_limited" is temporary: wait, retry, and space out repeats for the same video. Every item reports cookies: "none", "browser:<name>", "cookies_file" or "wechat_cookie" -- what was sent, never a value. When an item fails as auth_required, auth_expired or rate_limited and its reason suggests userCookies, ASK THE USER before retrying with userCookies: true. Read warnings, and transcript.source, to tell a failed stage from a video that simply has no speech; when source is "asr", transcript.asrReason says whether the video had no captions ("no_captions") or had captions that could not be retrieved ("captions_failed"). Pass videoPath back in to inspect another moment without downloading again. For anything long, call this as a background task: your environment notifies you with the result when it finishes, so there is no need to poll for it. To watch progress or check it is still alive meanwhile, GET the returned statusUrl. Reach for get_status ONLY if your environment TIMED OUT the call -- the work finishes either way. Handles YouTube, TikTok, Instagram, X, Facebook, Twitch, Vimeo, Reddit, WeChat Channels, direct .mp4/.m3u…
| Name | Type | Req | Description |
|---|---|---|---|
| destinationPath | string | yes | Directory to write manifests, transcripts and frames into. Created if missing. |
| userCookies | boolean | – | Use the user's own browser session for this call only. NEVER set it on your own: ask the user first, every time -- it reads their browser's cookies, and nothing carries over to later calls. Cookies c… |
| videos | array | yes | One entry per video to analyze. One item = single video, flat layout; several = video-N subdirectories. |
No output schema declared.
No examples provided.
get_status Get status ~159
Use this ONLY if your environment TIMED OUT an earlier analyze_video or resolve_video call -- the work carries on regardless and the result is still here. As a background task your environment notifies you with the result on its own, and to watch a call in flight you poll its statusUrl, so neither of those needs this tool. Pass the same video URLs or file paths you passed then, several at once if you like; a finished one returns exactly the result you would have received, one still running returns the stages it has reached. Treat "unknown" as no answer, not a failure, and read the files at your destinationPath.
| Name | Type | Req | Description |
|---|---|---|---|
| videos | array | yes | The same video URLs or file paths you passed to analyze_video or resolve_video. |
No output schema declared.
No examples provided.
resolve_video Resolve video (metadata, optionally the file) ~627
Find out what a video IS before spending time on it: downloads nothing by default and returns title, creator, duration, chapters, a description preview and the path to full metadata. On a long video call this first, read the chapters, then analyze only the section that matters. Each item returns { status, platform, title, creator, duration, chapters, descriptionPreview, commentCount, metadataPath, cookies, videoPath?, clipStart?, clipEnd?, nextSteps }. Pass several items in videos to batch them; results come back one per item in order, and one failing does not fail the others. A single item writes into destinationPath, several into video-1/, video-2/. Set returnVideo: true to download the file too -- that takes real time. With it, pass start and end together for one section; the clip STARTS AT 0, so use the returned offset when mapping times back. Leave comments off unless needed: slow on popular videos, and written to the metadata file rather than inline. Every item reports cookies: "none", "browser:<name>", "cookies_file" or "wechat_cookie" -- what was sent, never a value. When an item fails as auth_required, auth_expired or rate_limited and its reason suggests userCookies, ASK THE USER before retrying with userCookies: true. For anything long, call this as a background task: your environment notifies you with the result when it finishes, so there is no need to poll for it. To watch progress or check it is still alive meanwhile, GET the returned statusUrl. Reach for get_status ONLY if your environment TIMED OUT the call -- the work finishes either way. Handles YouTube, TikTok, Instagram, X, Facebook, Twitch, Vimeo, Reddit, WeChat Channels, direct .mp4/.m3u8 URLs and many other sites; unsupported ones return a failure status.
| Name | Type | Req | Description |
|---|---|---|---|
| destinationPath | string | yes | Directory to write metadata (and the video, if requested) into. Created if missing. Re-running the same call overwrites in place. |
| userCookies | boolean | – | Use the user's own browser session for this call only. NEVER set it on your own: ask the user first, every time -- it reads their browser's cookies, and nothing carries over to later calls. Cookies c… |
| videos | array | yes | One entry per video to resolve. One item = single video, flat layout; several = video-N subdirectories. |
No output schema declared.
No examples provided.
What is the Video Extract MCP server?
Video Extract is an MCP server listed in the public MCP registry as com.yanlinglabs/video-extract-mcp. Download any video from a URL, or get its transcript and key frames. All local, no API keys. This page covers its npm package (@yanlinglabs/video-extract-mcp).
Is the Video Extract MCP server safe to use?
Video Extract scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Video Extract MCP server expose?
Video Extract exposes 3 tools: get_status, analyze_video, resolve_video. Their descriptions and schemas cost roughly 1,470 tokens of context every time the server is loaded.
Is the Video Extract MCP server still maintained?
Video Extract is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Video Extract MCP server under?
Video Extract declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.