# io.github.danpillay87/mcp-yoto (npm · mcp-yoto)

MCP server for Yoto: manage cards, tracks, icons and family devices from any MCP client.

- Trust score: 72/100 (medium)
- Change this week: +15
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-21

## Components

- remote · `mcp-yoto.danpillay87.workers.dev`: 32/100, [markdown](https://verifymcp.io/servers/danpillay87-mcp-yoto/mcp-yoto.md), [page](https://verifymcp.io/servers/danpillay87-mcp-yoto/mcp-yoto)
- npm · `mcp-yoto`: 72/100 (this document), [markdown](https://verifymcp.io/servers/danpillay87-mcp-yoto/mcp-yoto-2.md), [page](https://verifymcp.io/servers/danpillay87-mcp-yoto/mcp-yoto-2)

## Channel facts

- Registry: `npm`
- Package: `mcp-yoto`
- Version: `0.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-21.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 0 of 17 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 6 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 84/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1140 tokens (~71/item across 16 items; 14 tools + 2 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 88/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 58% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the io.github.danpillay87/mcp-yoto server?

io.github.danpillay87/mcp-yoto runs locally as an npm package, launched with npx -y mcp-yoto. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add danpillay87-mcp-yoto -- npx -y mcp-yoto
```

### Cursor

```json
{
  "mcpServers": {
    "danpillay87-mcp-yoto": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-yoto"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "danpillay87-mcp-yoto": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-yoto"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add danpillay87-mcp-yoto -- npx -y mcp-yoto
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "danpillay87-mcp-yoto": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mcp-yoto"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add danpillay87-mcp-yoto --command npx --arg -y --arg mcp-yoto
```

### Hermes

```yaml
mcp_servers:
  danpillay87-mcp-yoto:
    command: "npx"
    args: ["-y", "mcp-yoto"]
```

### Netclaw

```json
{
  "McpServers": {
    "danpillay87-mcp-yoto": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "mcp-yoto"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add danpillay87-mcp-yoto -t stdio -c npx -a -y mcp-yoto
```

### Other

```json
{
  "mcpServers": {
    "danpillay87-mcp-yoto": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-yoto"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-15 (score 72, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-14 (score 57)

First indexed and scored.

## MCP tools (14)

### `yoto_status` (~50 tokens)

Check Yoto sign-in status

Reports whether this connection is signed in to Yoto, which mode it's running in (cli or remote), where the credential is stored, its granted scopes, and whether the Yoto API is currently reachable.

Output parameters:

- `apiReachable` (boolean)
- `expiresAt` (number)
- `hint` (string)
- `mode` (string)
- `scopes` (array)
- `signedIn` (boolean)
- `tokenStore` (string)

### `yoto_sign_in` (~98 tokens)

Sign in to Yoto

CLI mode: launches a local PKCE sign-in flow (opens your browser to Yoto's login page and waits for the callback). Remote mode: this connector runs on a server with nothing to launch, so it returns instructions to sign in from your AI client's connector settings instead -- that flow redirects to Yoto's own login page too.

Input parameters:

- `openBrowser` (boolean): CLI only: open the sign-in URL automatically. Default true.

Output parameters:

- `message` (string)
- `url` (string)

### `yoto_sign_out` (~83 tokens)

Sign out of Yoto

CLI mode: deletes the locally stored Yoto credential (keychain or file). Remote mode: this server never stores your Yoto token at all, so it returns instructions for disconnecting from your AI client and revoking access at Yoto directly. Requires confirm: true.

Input parameters:

- `confirm` (boolean, required): Must be true -- this clears your stored Yoto credential.

Output parameters:

- `message` (string)

### `yoto_list_cards` (~79 tokens)

List your Yoto cards

Lists cards in your own MYO (Make Your Own) library, or the shared family library's groups. Family groups are collections, not individual cards -- see the returned note when source is "family".

Input parameters:

- `cursor` (string): Reserved for future pagination; currently unused.
- `limit` (integer)
- `source` (string)

Output parameters:

- `cards` (array)
- `groups` (array)
- `note` (string)
- `source` (string)

### `yoto_get_card` (~34 tokens)

Get a Yoto card's details

Fetches one MYO card's full details, including every chapter and track.

Input parameters:

- `cardId` (string, required)

Output parameters:

- `card` (object)

### `yoto_create_card` (~93 tokens)

Create a new Yoto card

Creates a new MYO card with the given title, and optionally an initial set of tracks (each a mediaRef from yoto_upload_audio, one track per chapter) and a default icon for those chapters.

Input parameters:

- `iconRef` (string): A yoto:#<mediaId> icon reference, e.g. from yoto_upload_icon.
- `title` (string, required)
- `tracks` (array)

Output parameters:

- `card` (object)

### `yoto_update_card` (~81 tokens)

Update a Yoto card

Shallow-merges patch fields (e.g. title, or a full replacement content.chapters array to rename/reorder tracks or set icons) onto an existing card, then saves it.

Input parameters:

- `cardId` (string, required)
- `patch` (object, required): Fields to merge onto the existing card, e.g. { title } or { content }.

Output parameters:

- `card` (object)

### `yoto_delete_card` (~53 tokens)

Delete a Yoto card

Permanently deletes a MYO card from the parent's Yoto library. Requires confirm: true.

Input parameters:

- `cardId` (string, required)
- `confirm` (boolean, required): Must be true -- this permanently deletes the card.

Output parameters:

- `cardId` (string)
- `deleted` (boolean)

### `yoto_upload_audio` (~106 tokens)

Upload audio to Yoto

Uploads an audio file to Yoto and waits for it to finish transcoding, returning a yoto:#<sha256> mediaRef usable as a track when creating or updating a card. Runs locally, so it takes a file path.

Input parameters:

- `audioFilePath` (string, required): Absolute path to a local audio file (MP3, M4A/AAC, WAV, or OGG).
- `loudnorm` (boolean): Apply loudness normalisation. Default false.

Output parameters:

- `duration` (number)
- `fileSize` (number)
- `format` (string)
- `mediaRef` (string)

### `yoto_add_track` (~116 tokens)

Add a track to a Yoto card

Uploads an audio file and appends it as a new chapter/track on an existing MYO card. Runs locally, so it takes a file path.

Input parameters:

- `audioFilePath` (string, required): Absolute path to a local audio file (MP3, M4A/AAC, WAV, or OGG).
- `cardId` (string, required)
- `iconRef` (string): A yoto:#<mediaId> icon reference, e.g. from yoto_upload_icon.
- `trackTitle` (string)

Output parameters:

- `card` (object)

### `yoto_search_icons` (~87 tokens)

Search Yoto's icon catalogue

Searches Yoto's public catalogue of 16x16 pixel-art icons by title or tag, for use as a chapter/track icon (iconRef) when creating or updating a card.

Input parameters:

- `limit` (integer)
- `query` (string): Free-text match against the icon's title and tags.
- `tags` (array): Icon must carry every one of these tags.

Output parameters:

- `icons` (array)

### `yoto_upload_icon` (~117 tokens)

Upload a custom Yoto icon

Uploads a custom 16x16 pixel-art icon to your Yoto account, returning a mediaId usable as an iconRef on cards and tracks. Runs locally, so it takes a file path.

Input parameters:

- `autoConvert` (boolean): Let Yoto auto-convert the image to its 16x16 icon format. Default false.
- `imagePath` (string, required): Absolute path to a local image file (PNG, JPEG, or SVG).
- `title` (string, required): Sent to Yoto as the uploaded file's name.

Output parameters:

- `mediaId` (string)
- `url` (string)

### `yoto_list_devices` (~29 tokens)

List your Yoto devices

Lists the family's Yoto players -- name, online status, and device type. View-only.

Output parameters:

- `devices` (array)

### `yoto_get_device_config` (~73 tokens)

Get a Yoto device's configuration

Fetches one player's device configuration (clock face, volume limits, right-hand-button shortcuts, etc). This is a beta Yoto endpoint that needs a device-management scope this server intentionally never requests, so expect a FORBIDDEN_SCOPE result with a hint rather than data.

Input parameters:

- `deviceId` (string, required)

Output parameters:

- `config` (object)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/danpillay87-mcp-yoto/mcp-yoto-2#diagnostics

## Score history

- 2026-09-21: 72
- 2026-09-20: 72
- 2026-09-19: 72
- 2026-09-18: 72
- 2026-09-17: 72
- 2026-09-16: 72
- 2026-09-15: 72
- 2026-09-14: 57

## Common questions

### What is the io.github.danpillay87/mcp-yoto server?

io.github.danpillay87/mcp-yoto is listed in the public MCP registry as io.github.danpillay87/mcp-yoto. MCP server for Yoto: manage cards, tracks, icons and family devices from any MCP client. This page covers its npm package (mcp-yoto).

### Is the io.github.danpillay87/mcp-yoto server safe to use?

io.github.danpillay87/mcp-yoto scores 72 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.danpillay87/mcp-yoto server expose?

io.github.danpillay87/mcp-yoto exposes 14 tools: yoto_status, yoto_sign_in, yoto_sign_out, yoto_list_cards, yoto_get_card, and 9 more. Their descriptions and schemas cost roughly 1,099 tokens of context every time the server is loaded.

### Is the io.github.danpillay87/mcp-yoto server still maintained?

io.github.danpillay87/mcp-yoto is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.danpillay87/mcp-yoto server under?

io.github.danpillay87/mcp-yoto declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/mcp-yoto
- Socket report: https://socket.dev/npm/package/mcp-yoto
- Repository: https://github.com/danpillay87/mcp-yoto
- Changelog RSS feed: https://verifymcp.io/servers/danpillay87-mcp-yoto/mcp-yoto-2.xml
- Changelog JSON feed: https://verifymcp.io/servers/danpillay87-mcp-yoto/mcp-yoto-2.json
- HTML version of this page: https://verifymcp.io/servers/danpillay87-mcp-yoto/mcp-yoto-2