Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.kelvinbiffi/ollos-mcp

NPM · OLLOS-MCP · SCANNED SEP 20

Local, offline transcription, speakers, keyframes, on-screen text and review of any audio or video.

Available components

59 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 62 of 218 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (Apache-2.0).Pass
  • Actively maintained (last published 4 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability39
  • 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3035 tokens (~275/item across 11 items; 10 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the io.github.kelvinbiffi/ollos-mcp server?

io.github.kelvinbiffi/ollos-mcp runs locally as an npm package, launched with npx -y ollos-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · ollos-mcp

# add to Claude Code
claude mcp add kelvinbiffi-ollos-mcp -- npx -y ollos-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "kelvinbiffi-ollos-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ollos-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "kelvinbiffi-ollos-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ollos-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add kelvinbiffi-ollos-mcp -- npx -y ollos-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "kelvinbiffi-ollos-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "ollos-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add kelvinbiffi-ollos-mcp --command npx --arg -y --arg ollos-mcp
# ~/.hermes/config.yaml
mcp_servers:
  kelvinbiffi-ollos-mcp:
    command: "npx"
    args: ["-y", "ollos-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "kelvinbiffi-ollos-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "ollos-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add kelvinbiffi-ollos-mcp -t stdio -c npx -a -y ollos-mcp
// mcp.json
{
  "mcpServers": {
    "kelvinbiffi-ollos-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ollos-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 17 Sept 26 0
    • CVE-2026-39244 no longer affects this package security
  • 16 Sept 26 +15
    • Malware scan: unverified → pass security
  • 15 Sept 26 44

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/ollos-mcp@0.1.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 2 findings
ID CVE Severity Vector Fix available
GHSA-f88m-g3jw-g9cj high yes
GHSA-rgj7-g3m4-5g8c high yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 218 packages
Packages resolved 218
Stale 62
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 10 exposed · ~2,963 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
ollos_cancel ~130

Stop a queued or running ollos job by jobId — for example when the user changes their mind about a long transcription, or asked for the wrong file. The running stage is aborted (ffmpeg and model inference stop within a second) and the job is marked cancelled; partial artifacts already written stay on disk and are not reused. A job that already finished is reported with its final status and cancelled: false — not an error. Example: {"jobId":"j_a1b2c3d4e5f6"}.

NameTypeReqDescription
jobIdstringyesThe jobId to stop.
NameTypeReqDescription
cancelledbooleanyes
jobIdstringyes
statusstringyes

No examples provided.

ollos_diarize ~406

Split a recording into speaker turns — who talked from when to when — and, if you pass the jobId of a finished ollos_transcribe, label every transcript segment with its speaker. Runs locally: pyannote segmentation, WeSpeaker voice embeddings and agglomerative clustering. For a Zoom local recording folder with one audio file per participant it uses the tracks directly and the result is exact and named. Each speaker gets an 8-second voice clip so a person can rename SPEAKER_00 by ear. Experimental: the similarity threshold (default 0.35) decides whether two voices are one person, and speech with background music (intros, jingles, outros) tends to come out as an extra speaker; pass maxSpeakers when you know the count. Example: {"source":"meeting.mp4","transcriptJobId":"j_…","maxSpeakers":3}.

NameTypeReqDescription
formatstringconcise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
fromStart of the window to analyse: seconds as a number (90) or a string "90", "1:30", "0:01:30.5". Default: beginning.
maxSpeakersintegerUpper bound on the number of speakers. Default 8.
minSpeakersintegerLower bound on the number of speakers. Default 1.
similarityThresholdnumberCosine similarity above which two turns are the same speaker. Default 0.35.
sourcestringyesLocal path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.
toEnd of the window, same forms as from. Default: end of media.
transcriptJobIdstringjobId of a completed ollos_transcribe on the same media; its segments get a speaker label.
NameTypeReqDescription
cachedboolean
errorobject
etaSecondsnumber
jobIdstring
nextstring
result
statusstringyes

No examples provided.

ollos_frames ~189

Return contact sheets or individual frames from a finished ollos_keyframes or ollos_read_screen job as images you can look at. Ask for sheets first (each shows 9 timestamped frames); ask for a single frame only when you need a close-up. Default 6 images per call (maxImages, up to 12) to protect the context window. Example: {"jobId":"j_…","sheets":[1,2]} or {"jobId":"j_…","frames":[14]}.

NameTypeReqDescription
framesarraySingle frame indices to return (1-based), for close-ups.
jobIdstringyesA completed ollos_keyframes or ollos_read_screen job.
maxImagesintegerCap on images returned. Default 6.
sheetsarrayContact-sheet indices to return (1-based). Default: the first two.
NameTypeReqDescription
framesarrayyes
imagesnumberyes
jobIdstringyes
sheetsarrayyes

No examples provided.

ollos_job ~176

Get the state of a job started by ollos_transcribe, ollos_keyframes, ollos_read_screen, ollos_review or ollos_diarize: stage, percentage, and — once completed — the formatted result plus resource links, so no second call is needed. Poll every few seconds; the server keeps jobs on disk, so a jobId survives a restart (an interrupted job says so instead of hanging). Example: {"jobId":"j_a1b2c3d4e5f6"}.

NameTypeReqDescription
formatstringconcise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
jobIdstringyesThe jobId a previous ollos tool returned, e.g. j_a1b2c3d4e5f6.
NameTypeReqDescription
cachedboolean
errorobject
etaSecondsnumber
jobIdstring
kindstring
nextstring
progressobject
result
statusstringyes

No examples provided.

ollos_keyframes ~440

Pick the frames of a video that carry information and pack them into 3×3 contact sheets, so you can "watch" an hour of video in a handful of images. Frames are chosen by perceptual-hash change (works on screen recordings, where scene detection sees nothing), hard cuts (window switches, modals), optional anchors, and a floor of one frame every 20 s. Each tile shows its timestamp. Returns sheet resources; use ollos_frames to view them. Set presenterRegion to ignore a webcam overlay when comparing frames. Limitations: video only; about 0.3 s per extracted frame. Example: {"source":"lesson.mp4","sensitivity":"normal","maxFrames":120}.

NameTypeReqDescription
anchorsSecarrayTimestamps that must get a frame (e.g. transcript segment starts).
formatstringconcise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
frameWidthintegerWidth of saved frames. Default 1280.
fromStart of the window to analyse: seconds as a number (90) or a string "90", "1:30", "0:01:30.5". Default: beginning.
maxFramesintegerCap; least-changed hash frames are dropped first, then floor frames; cuts and anchors are thinned last. Default 120.
presenterRegionobjectRegion to ignore when comparing frames (a webcam overlay), as fractions of the frame: {x, y, w, h} in 0–1.
sensitivitystringHow much change earns a frame: low ≈ 1 per 7 s, normal ≈ 1 per 5 s, high ≈ 1 per 3 s on a screencast (measured).
sourcestringyesLocal path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.
toEnd of the window, same forms as from. Default: end of media.
NameTypeReqDescription
cachedboolean
errorobject
etaSecondsnumber
jobIdstring
nextstring
result
statusstringyes

No examples provided.

ollos_probe ~191

Read what a file, URL or folder actually is, in under a second: kind (video/audio/image), duration, resolution, aspect ratio and which platforms it fits, codecs, fps, audio channels and track count. Use it first, before any other ollos tool, to decide what to run and to detect a Zoom recording folder with one audio track per participant. Never trusts the file extension; a .mp4 without video is reported as audio. Accepts a local path, an http(s) URL, a video-site link (needs yt-dlp), a data: URI or a Zoom local-recording folder. Example: {"source":"talk.mp4"} or {"source":"https://www.youtube.com/watch?v=…"}.

NameTypeReqDescription
sourcestringyesLocal path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.
NameTypeReqDescription
aspect
audio
audioTracksnumberyes
bitratenumber
containerstringyes
durationSecnumberyes
kindstringyes
originstringyes
sizeBytesnumberyes
video
zoomTracksarray

No examples provided.

ollos_read_screen ~405

OCR the text visible in a video or image and scan it for secrets: API keys, JWTs, bearer tokens, .env lines, private deployment URLs, local URLs, e-mails. Frames are selected as in ollos_keyframes, then read in upscaled tiles (small UI text is unreadable otherwise). Secret findings combine three signals — known patterns, high-entropy tokens, and nearby UI words like "API Key Created" — and are ALWAYS masked; the value never leaves this tool. Use it before publishing a screen recording, or to search what was on screen. Slow: roughly 1–3 s per frame depending on CPU, so a 10-minute screencast is a job of a few minutes. Example: {"source":"demo.mp4","detectSecrets":true}.

NameTypeReqDescription
detectSecretsbooleanScan the text for secrets and mask them. Default true.
formatstringconcise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
fromStart of the window to analyse: seconds as a number (90) or a string "90", "1:30", "0:01:30.5". Default: beginning.
languagesarrayTesseract language codes. Default ["por","eng"].
maxFramesintegerMost frames to read. Default 80.
presenterRegionobjectRegion to ignore when comparing frames (a webcam overlay), as fractions of the frame: {x, y, w, h} in 0–1.
sensitivitystringFrame selection sensitivity, as in ollos_keyframes. Default normal.
sourcestringyesLocal path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.
toEnd of the window, same forms as from. Default: end of media.
NameTypeReqDescription
cachedboolean
errorobject
etaSecondsnumber
jobIdstring
nextstring
result
statusstringyes

No examples provided.

ollos_review ~338

Check a video before it goes public and return a verdict (ok / warn / block) with findings: loudness vs the platform target (YouTube -14 LUFS) and true peak, silence gaps worth cutting, aspect ratio vs the platform (a 1890×1080 file gets black bars on YouTube), and secrets visible on screen. The secrets check reads frames with OCR and is the slow part; drop it from checks for an instant audio/aspect review. Findings say where (timestamp) and what to do. Example: {"source":"episode.mp4","platform":"youtube","checks":["loudness","silences","aspect","secrets"]}.

NameTypeReqDescription
checksarrayWhich checks to run. Default: all four.
formatstringconcise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
fromStart of the window to analyse: seconds as a number (90) or a string "90", "1:30", "0:01:30.5". Default: beginning.
platformstringTarget preset for loudness and aspect. Default youtube.
presenterRegionobjectRegion to ignore when comparing frames (a webcam overlay), as fractions of the frame: {x, y, w, h} in 0–1.
sourcestringyesLocal path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.
toEnd of the window, same forms as from. Default: end of media.
NameTypeReqDescription
cachedboolean
errorobject
etaSecondsnumber
jobIdstring
nextstring
result
statusstringyes

No examples provided.

ollos_search ~248

Find moments across everything ollos has transcribed or read from screen: "what did we decide about the deadline", "when did the 401 error appear". Hybrid retrieval — BM25 for exact names, acronyms and numbers plus multilingual embeddings for meaning, fused by reciprocal rank — returning up to k passages with timestamp, speaker and source job, never whole transcripts. Scope "all" (default) searches every completed job; scope "job" with jobId searches one. The first call loads a 465 MB embedding model (a few seconds); indexes are built lazily and kept on disk. Example: {"query":"como configurar o webhook","k":5}.

NameTypeReqDescription
jobIdstringRequired when scope is "job".
kintegerHow many passages to return. Default 8.
kindstringspeech = transcript segments, screen = OCR text from frames, both (default).
querystringyesNatural-language question or keywords; names, acronyms and numbers match exactly, meaning matches through embeddings.
scopestringall (default): every completed job on this machine; job: only the job given in jobId.
NameTypeReqDescription
hitsarrayyes
indexedJobsnumberyes
msnumberyes
querystringyes
scopestringyes

No examples provided.

ollos_transcribe ~440

Transcribe the speech in audio or video, locally with Whisper, with timestamps per segment and a heuristic confidence. Silence is skipped with a voice-activity detector and known Whisper hallucinations are removed, so what you get back was actually said. Pass vocabulary with domain terms ("Claude Code", "n8n", "webhook") to fix phonetic confusions. Runs at about 1.7× real time on a 16-core CPU (≈0.6 s of compute per second of audio): an 11-minute video takes ~7 minutes and comes back as a job to poll with ollos_job; a 1-minute clip returns inline. Limitations: needs an audio stream; confidence is heuristic, not a model probability; the reported language label is guessed among pt/en/es — other languages transcribe but are labelled auto. Example: {"source":"talk.mp4","language":"pt","vocabulary":["Claude Code","MCP"]}.

NameTypeReqDescription
audioTrackintegerWhich audio track, for multi-track files.
formatstringconcise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
fromStart of the window to analyse: seconds as a number (90) or a string "90", "1:30", "0:01:30.5". Default: beginning.
languagestringISO code like "pt" or "en". Omit to auto-detect.
modelstringaccurate (default, whisper-large-v3-turbo) or fast (whisper-base, 3× faster, misreads technical terms).
sourcestringyesLocal path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.
toEnd of the window, same forms as from. Default: end of media.
vadThresholdnumberSpeech probability above which audio counts as speech. Default 0.5; lower it for quiet or music-backed voices.
vocabularyarrayDomain terms to correct toward.
NameTypeReqDescription
cachedboolean
errorobject
etaSecondsnumber
jobIdstring
nextstring
result
statusstringyes

No examples provided.

Common questions

What is the io.github.kelvinbiffi/ollos-mcp server?

io.github.kelvinbiffi/ollos-mcp is listed in the public MCP registry as io.github.kelvinbiffi/ollos-mcp. Local, offline transcription, speakers, keyframes, on-screen text and review of any audio or video. This page covers its npm package (ollos-mcp).

Is the io.github.kelvinbiffi/ollos-mcp server safe to use?

io.github.kelvinbiffi/ollos-mcp scores 59 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.kelvinbiffi/ollos-mcp server expose?

io.github.kelvinbiffi/ollos-mcp exposes 10 tools: ollos_diarize, ollos_search, ollos_probe, ollos_transcribe, ollos_keyframes, and 5 more. Their descriptions and schemas cost roughly 2,963 tokens of context every time the server is loaded.

Is the io.github.kelvinbiffi/ollos-mcp server still maintained?

io.github.kelvinbiffi/ollos-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.kelvinbiffi/ollos-mcp server under?

io.github.kelvinbiffi/ollos-mcp declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.