# ffpipe — video conversion, probe & frames (remote · ffpipe.dev)

Convert, probe, and split video into frames — real FFmpeg, paid per job with x402 on Base.

- Trust score: 64/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-20

## Components

- remote · `ffpipe.dev`: 64/100 (this document), [markdown](https://verifymcp.io/servers/dev-ffpipe-ffpipe/ffpipe.md), [page](https://verifymcp.io/servers/dev-ffpipe-ffpipe/ffpipe)

## Channel facts

- Endpoint: `https://ffpipe.dev/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.2.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-20.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 406, which proves neither a plaintext path nor enforcement.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 63/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2831 tokens (~471/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 10/100
  - Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http dev-ffpipe-ffpipe https://ffpipe.dev/mcp
```

### Codex

```toml
[mcp_servers.dev-ffpipe-ffpipe]
url = "https://ffpipe.dev/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-ffpipe-ffpipe": {
      "type": "remote",
      "url": "https://ffpipe.dev/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dev-ffpipe-ffpipe --url https://ffpipe.dev/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  dev-ffpipe-ffpipe:
    url: "https://ffpipe.dev/mcp"
```

### Other

```json
{
  "mcpServers": {
    "dev-ffpipe-ffpipe": {
      "type": "http",
      "url": "https://ffpipe.dev/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-19 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-18 (score 63, +7)

- [security improvement] Authorization: unverified → partial
- [security] The server rewrote its instructions, which are the text every model session reads
- [security] The server changed its declared name: ffpipe-x402-gateway → ffpipe-gateway
- [security] Tool “get_job_status” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 338 → 471
- [functional regression] Schema quality: 1015 → 1265
- [functional improvement] Stability: unverified → 0.03
- [functional] New tool “extract_frames”
- [functional] New tool “probe_media”
- [functional] New tool “get_balance”

### 2026-08-17 (score 56)

First indexed and scored.

## MCP tools (6)

### `convert_video` (~360 tokens)

Queue an asynchronous video conversion: fetches sourceUrl (or, with upload: true, waits for you to PUT the bytes to the returned uploadUrl), converts to MP4 scaled to fit maxWidth x maxHeight (defaults 1920x1080, cap 4096). Returns { jobId, status: "queued" | "awaiting_upload", statusUrl, uploadUrl?, uploadExpiresAt? } - poll with get_job_status (jobId + the t token from statusUrl) until finished/error. Download results within 24 hours. Paid: $0.05 USDC via x402 (base mainnet), or a convert-kind retryVoucher.

Input parameters:

- `maxHeight` (integer): Max output height, default 1080
- `maxWidth` (integer): Max output width, default 1920
- `retryVoucher` (string): Retry-voucher credential (`uuid.hmac`) from a failed paid job's status - pays for this call instead of x402. Single use, kind-matched.
- `sourceUrl` (string): https URL of the input media (<= 100 MiB). Fetched from datacenter IP ranges - prefer a presigned URL from storage you control; no IP literals, no localhost/.internal/.local. Provide EXACTLY ONE of s…
- `upload` (boolean): Set true to upload the bytes yourself instead of giving a sourceUrl (exactly one of the two). The paid result then returns status awaiting_upload plus uploadUrl and uploadExpiresAt: HTTP PUT the raw…

### `probe_media` (~713 tokens)

Queue an asynchronous media inspection: fetches sourceUrl (or, with upload: true, waits for you to PUT the bytes to the returned uploadUrl) and returns its technical metadata as a downloadable file. In the default json format the result is the full raw analysis plus one added top-level "ffpipe_summary" object: container, duration_s, size_bytes, has_video, has_audio, video_codec, audio_codec, coded_width/height, display_width/height, rotation, fps, is_hdr, audio_channels, audio_sample_rate. USE display_width/display_height as the size the picture actually is - phones store portrait video as a landscape frame plus a rotation flag. A file that cannot be decoded is still a SUCCESS whose result carries the diagnosis. Returns { jobId, status, statusUrl, ... } - poll with get_job_status until finished/error, then download resultUrl within 24 hours. Paid: $0.01 USDC via x402 (base mainnet), or a probe-kind retryVoucher.

Input parameters:

- `countFrames` (boolean): Count frames exactly. Requires decoding the whole file - slow on long sources.
- `countPackets` (boolean): Count packets exactly. Same cost caveat as countFrames.
- `outputFormat` (string): Format of the delivered analysis, default json. Only json carries the ffpipe_summary block; the rest are raw. flat is delivered as .txt.
- `readIntervals` (string): Limit the analysis to a window, e.g. "%+60" (first 60 seconds), "30%+10" (10 seconds from 0:30), "%+#500" (first 500 packets).
- `retryVoucher` (string): Retry-voucher credential (`uuid.hmac`) from a failed paid job's status - pays for this call instead of x402. Single use, kind-matched.
- `sections` (array): Which sections to report. Default: format, streams, chapters.
- `selectStreams` (string): Restrict the analysis to matching streams, e.g. "v:0" (first video stream) or "a" (all audio).
- `showEntries` (string): Keep only the named fields, e.g. "frame=pict_type,pts_time,key_frame" or "format=duration". Section and field names only.
- `showFrames` (boolean): Report per-FRAME detail. Large: a bounded window is applied for you unless you send readIntervals. Pair with showEntries to keep only the fields you need.
- `showPackets` (boolean): Report per-PACKET detail. Same bounded-window treatment as showFrames.
- `sourceUrl` (string): https URL of the input media (<= 100 MiB). Fetched from datacenter IP ranges - prefer a presigned URL from storage you control; no IP literals, no localhost/.internal/.local. Provide EXACTLY ONE of s…
- `summary` (boolean): Keep the normalized ffpipe_summary block (json only). Default true; send false for byte-exact raw output.
- `upload` (boolean): Set true to upload the bytes yourself instead of giving a sourceUrl (exactly one of the two). The paid result then returns status awaiting_upload plus uploadUrl and uploadExpiresAt: HTTP PUT the raw…

### `extract_frames` (~810 tokens)

Queue an asynchronous frame extraction - the tool to reach for when you need to SEE a video: fetches sourceUrl (or, with upload: true, waits for you to PUT the bytes to the returned uploadUrl) and extracts still frames as jpeg, webp or png. mode is REQUIRED and picks the sampling (all, every_nth, interval, keyframes, evenly_spaced, timestamps); there is no default because every candidate implies a rate you did not ask for. A finished job's resultUrl is a JSON MANIFEST: source display dimensions, fps, rotation, an echo of your parameters, frame_count, and one entry per frame with index, pts_time (seconds in the source) and its own download url on this gateway - fetch the manifest, then the frames you want. Up to 1000 frames per job; "all"/"interval" on a long source can exceed that and fail fast, so prefer interval, evenly_spaced or timestamps. Unreadable input, audio-only files and still images FAIL here (probe_media diagnoses those). Download within 24 hours. Paid: $0.03 USDC via x402 (base mainnet), or a frames-kind retryVoucher.

Input parameters:

- `count` (integer): evenly_spaced only: how many frames to spread across the window.
- `endTime` (number): Window end in seconds (0 or omitted = to the end); must exceed startTime.
- `format` (string): Image format of each frame, default jpeg (small and accepted by every vision API). png is lossless.
- `fps` (number): interval only: frames per second, may be below 1 (0.5 = one frame every two seconds).
- `maxFrames` (integer): Ceiling on frames produced, default and hard limit 1000. A request whose sampling would exceed it fails before any decoding.
- `maxOutputHeight` (integer): Fit box height, same rules as maxOutputWidth.
- `maxOutputWidth` (integer): Fit box width applied to the source's DISPLAY dimensions: aspect preserved, never upscaled, oriented to the input. 0 = no limit on this axis.
- `mode` (string, required): How to pick frames (required): "all" every frame; "every_nth" every Nth decoded frame (needs n); "interval" a fixed rate in seconds (needs fps, may be below 1); "keyframes" keyframes only, cheap on l…
- `n` (integer): every_nth only: keep every Nth DECODED frame (a frame index, not a time).
- `quality` (integer): Encoder quality for jpeg/webp, default 85; ignored for png.
- `retryVoucher` (string): Retry-voucher credential (`uuid.hmac`) from a failed paid job's status - pays for this call instead of x402. Single use, kind-matched.
- `sourceUrl` (string): https URL of the input media (<= 100 MiB). Fetched from datacenter IP ranges - prefer a presigned URL from storage you control; no IP literals, no localhost/.internal/.local. Provide EXACTLY ONE of s…
- `startTime` (number): Window start in seconds (default 0).
- `timestamps` (array): timestamps only: seconds into the source, one accurate frame each. Sorted for you.
- `upload` (boolean): Set true to upload the bytes yourself instead of giving a sourceUrl (exactly one of the two). The paid result then returns status awaiting_upload plus uploadUrl and uploadExpiresAt: HTTP PUT the raw…

### `get_job_status` (~186 tokens)

Get job status (free)

Free status lookup for a job accepted by convert_video / probe_media / extract_frames. Requires the job's ownership token - the `t` query parameter of the statusUrl returned at acceptance (store the whole statusUrl; it cannot be regenerated). Status goes [awaiting_upload ->] queued -> finished | error; awaiting_upload jobs report uploadExpiresAt but NEVER the uploadUrl (that credential is handed out exactly once, in the acceptance result); finished jobs carry resultUrl/thumbnailUrl/durationMs (served by this gateway, free to re-download within 24 hours of completion; GET them following redirects); a failed charged job carries retryVoucher. A bad token and an unknown jobId both answer not_found, deliberately.

Input parameters:

- `jobId` (string, required): Job id from the acceptance
- `token` (string, required): Ownership token - the `t` query parameter of statusUrl

### `get_balance` (~145 tokens)

Check your credit balance (free)

Free. Reports the credit balance of the account this client is connected to, plus what one credit is worth, what each operation costs in credits, the monthly free allowance and whether a card is on file to unlock it. Takes no input: it reads the account behind the credential your client already connected with. If you have a connected account, paid tools are funded from this balance and never present a payment challenge - so call this to find out how much work you can still queue, and top up at the account page named in the answer. Anonymous callers (x402 buyers, who pay per call instead) have no balance and get an unauthorized error; either way nothing here is charged.

### `leave_feedback` (~299 tokens)

Request a capability / report a problem (free)

Tell us what you needed. If ffpipe does not offer the operation you came for - another output format, extracting a frame, a different transformation entirely - say so here: these requests are aggregated and they drive directly what gets built next, so a one-line "I wanted X" is genuinely useful to us. Also the place for bug reports and any other feedback. Free, unauthenticated, and one-way: nothing is returned but an acknowledgement, and no job is created. Include jobId if a specific job prompted this (context only - it is not checked and is not required), and contact if you want a reply. Message limit 2000 characters.

Input parameters:

- `contact` (string): Optional. An email or handle to reply at, up to 200 characters. Omit it and the submission stays anonymous.
- `jobId` (string): Optional job id this relates to. Context only - ownership is NOT checked and no token is needed.
- `message` (string, required): What you wanted, what went wrong, or what you think. Plain text, 1 to 2000 characters. Be concrete: "needed a single frame as a jpeg at a given timestamp" is worth more to us than "more features".
- `type` (string): What this is: "feature_request" for a capability ffpipe does not offer yet, "bug" for something broken, "feedback" for anything else. Defaults to "feedback".

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/dev-ffpipe-ffpipe/ffpipe#diagnostics

## Score history

- 2026-08-20: 64
- 2026-08-19: 64
- 2026-08-18: 63
- 2026-08-17: 56

## Links

- Remote endpoint: https://ffpipe.dev/mcp
- Website: https://ffpipe.dev/
- Changelog RSS feed: https://verifymcp.io/servers/dev-ffpipe-ffpipe/ffpipe.xml
- Changelog JSON feed: https://verifymcp.io/servers/dev-ffpipe-ffpipe/ffpipe.json
- HTML version of this page: https://verifymcp.io/servers/dev-ffpipe-ffpipe/ffpipe