# io.github.kelvinbiffi/ollos-mcp (npm · ollos-mcp)

Local, offline transcription, speakers, keyframes, on-screen text and review of any audio or video.

- Trust score: 59/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- npm · `ollos-mcp`: 59/100 (this document), [markdown](https://verifymcp.io/servers/kelvinbiffi-ollos-mcp/ollos-mcp.md), [page](https://verifymcp.io/servers/kelvinbiffi-ollos-mcp/ollos-mcp)

## Channel facts

- Registry: `npm`
- Package: `ollos-mcp`
- Version: `0.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 81/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - 62 of 218 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 4 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 39/100
  - 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3035 tokens (~275/item across 11 items; 10 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the io.github.kelvinbiffi/ollos-mcp server?

io.github.kelvinbiffi/ollos-mcp runs locally as an npm package, launched with npx -y ollos-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add kelvinbiffi-ollos-mcp -- npx -y ollos-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "kelvinbiffi-ollos-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ollos-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "kelvinbiffi-ollos-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ollos-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add kelvinbiffi-ollos-mcp -- npx -y ollos-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "kelvinbiffi-ollos-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "ollos-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add kelvinbiffi-ollos-mcp --command npx --arg -y --arg ollos-mcp
```

### Hermes

```yaml
mcp_servers:
  kelvinbiffi-ollos-mcp:
    command: "npx"
    args: ["-y", "ollos-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "kelvinbiffi-ollos-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "ollos-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add kelvinbiffi-ollos-mcp -t stdio -c npx -a -y ollos-mcp
```

### Other

```json
{
  "mcpServers": {
    "kelvinbiffi-ollos-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "ollos-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-17 (score 59, 0)

- [security improvement] CVE-2026-39244 no longer affects this package

### 2026-09-16 (score 59, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-15 (score 44)

First indexed and scored.

## MCP tools (10)

### `ollos_diarize` (~406 tokens)

Who spoke when (experimental)

Split a recording into speaker turns — who talked from when to when — and, if you pass the jobId of a finished ollos_transcribe, label every transcript segment with its speaker. Runs locally: pyannote segmentation, WeSpeaker voice embeddings and agglomerative clustering. For a Zoom local recording folder with one audio file per participant it uses the tracks directly and the result is exact and named. Each speaker gets an 8-second voice clip so a person can rename SPEAKER_00 by ear. Experimental: the similarity threshold (default 0.35) decides whether two voices are one person, and speech with background music (intros, jingles, outros) tends to come out as an extra speaker; pass maxSpeakers when you know the count. Example: {"source":"meeting.mp4","transcriptJobId":"j_…","maxSpeakers":3}.

Input parameters:

- `format` (string): concise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
- `from`: Start of the window to analyse: seconds as a number (90) or a string "90", "1:30", "0:01:30.5". Default: beginning.
- `maxSpeakers` (integer): Upper bound on the number of speakers. Default 8.
- `minSpeakers` (integer): Lower bound on the number of speakers. Default 1.
- `similarityThreshold` (number): Cosine similarity above which two turns are the same speaker. Default 0.35.
- `source` (string, required): Local path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.
- `to`: End of the window, same forms as from. Default: end of media.
- `transcriptJobId` (string): jobId of a completed ollos_transcribe on the same media; its segments get a speaker label.

Output parameters:

- `cached` (boolean)
- `error` (object)
- `etaSeconds` (number)
- `jobId` (string)
- `next` (string)
- `result`
- `status` (string)

### `ollos_search` (~248 tokens)

Search what was said and shown

Find moments across everything ollos has transcribed or read from screen: "what did we decide about the deadline", "when did the 401 error appear". Hybrid retrieval — BM25 for exact names, acronyms and numbers plus multilingual embeddings for meaning, fused by reciprocal rank — returning up to k passages with timestamp, speaker and source job, never whole transcripts. Scope "all" (default) searches every completed job; scope "job" with jobId searches one. The first call loads a 465 MB embedding model (a few seconds); indexes are built lazily and kept on disk. Example: {"query":"como configurar o webhook","k":5}.

Input parameters:

- `jobId` (string): Required when scope is "job".
- `k` (integer): How many passages to return. Default 8.
- `kind` (string): speech = transcript segments, screen = OCR text from frames, both (default).
- `query` (string, required): Natural-language question or keywords; names, acronyms and numbers match exactly, meaning matches through embeddings.
- `scope` (string): all (default): every completed job on this machine; job: only the job given in jobId.

Output parameters:

- `hits` (array)
- `indexedJobs` (number)
- `ms` (number)
- `query` (string)
- `scope` (string)

### `ollos_probe` (~191 tokens)

Probe media

Read what a file, URL or folder actually is, in under a second: kind (video/audio/image), duration, resolution, aspect ratio and which platforms it fits, codecs, fps, audio channels and track count. Use it first, before any other ollos tool, to decide what to run and to detect a Zoom recording folder with one audio track per participant. Never trusts the file extension; a .mp4 without video is reported as audio. Accepts a local path, an http(s) URL, a video-site link (needs yt-dlp), a data: URI or a Zoom local-recording folder. Example: {"source":"talk.mp4"} or {"source":"https://www.youtube.com/watch?v=…"}.

Input parameters:

- `source` (string, required): Local path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.

Output parameters:

- `aspect`
- `audio`
- `audioTracks` (number)
- `bitrate` (number)
- `container` (string)
- `durationSec` (number)
- `kind` (string)
- `origin` (string)
- `sizeBytes` (number)
- `video`
- `zoomTracks` (array)

### `ollos_transcribe` (~440 tokens)

Transcribe speech

Transcribe the speech in audio or video, locally with Whisper, with timestamps per segment and a heuristic confidence. Silence is skipped with a voice-activity detector and known Whisper hallucinations are removed, so what you get back was actually said. Pass vocabulary with domain terms ("Claude Code", "n8n", "webhook") to fix phonetic confusions. Runs at about 1.7× real time on a 16-core CPU (≈0.6 s of compute per second of audio): an 11-minute video takes ~7 minutes and comes back as a job to poll with ollos_job; a 1-minute clip returns inline. Limitations: needs an audio stream; confidence is heuristic, not a model probability; the reported language label is guessed among pt/en/es — other languages transcribe but are labelled auto. Example: {"source":"talk.mp4","language":"pt","vocabulary":["Claude Code","MCP"]}.

Input parameters:

- `audioTrack` (integer): Which audio track, for multi-track files.
- `format` (string): concise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
- `from`: Start of the window to analyse: seconds as a number (90) or a string "90", "1:30", "0:01:30.5". Default: beginning.
- `language` (string): ISO code like "pt" or "en". Omit to auto-detect.
- `model` (string): accurate (default, whisper-large-v3-turbo) or fast (whisper-base, 3× faster, misreads technical terms).
- `source` (string, required): Local path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.
- `to`: End of the window, same forms as from. Default: end of media.
- `vadThreshold` (number): Speech probability above which audio counts as speech. Default 0.5; lower it for quiet or music-backed voices.
- `vocabulary` (array): Domain terms to correct toward.

Output parameters:

- `cached` (boolean)
- `error` (object)
- `etaSeconds` (number)
- `jobId` (string)
- `next` (string)
- `result`
- `status` (string)

### `ollos_keyframes` (~440 tokens)

Extract keyframes

Pick the frames of a video that carry information and pack them into 3×3 contact sheets, so you can "watch" an hour of video in a handful of images. Frames are chosen by perceptual-hash change (works on screen recordings, where scene detection sees nothing), hard cuts (window switches, modals), optional anchors, and a floor of one frame every 20 s. Each tile shows its timestamp. Returns sheet resources; use ollos_frames to view them. Set presenterRegion to ignore a webcam overlay when comparing frames. Limitations: video only; about 0.3 s per extracted frame. Example: {"source":"lesson.mp4","sensitivity":"normal","maxFrames":120}.

Input parameters:

- `anchorsSec` (array): Timestamps that must get a frame (e.g. transcript segment starts).
- `format` (string): concise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
- `frameWidth` (integer): Width of saved frames. Default 1280.
- `from`: Start of the window to analyse: seconds as a number (90) or a string "90", "1:30", "0:01:30.5". Default: beginning.
- `maxFrames` (integer): Cap; least-changed hash frames are dropped first, then floor frames; cuts and anchors are thinned last. Default 120.
- `presenterRegion` (object): Region to ignore when comparing frames (a webcam overlay), as fractions of the frame: {x, y, w, h} in 0–1.
- `sensitivity` (string): How much change earns a frame: low ≈ 1 per 7 s, normal ≈ 1 per 5 s, high ≈ 1 per 3 s on a screencast (measured).
- `source` (string, required): Local path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.
- `to`: End of the window, same forms as from. Default: end of media.

Output parameters:

- `cached` (boolean)
- `error` (object)
- `etaSeconds` (number)
- `jobId` (string)
- `next` (string)
- `result`
- `status` (string)

### `ollos_read_screen` (~405 tokens)

Read on-screen text

OCR the text visible in a video or image and scan it for secrets: API keys, JWTs, bearer tokens, .env lines, private deployment URLs, local URLs, e-mails. Frames are selected as in ollos_keyframes, then read in upscaled tiles (small UI text is unreadable otherwise). Secret findings combine three signals — known patterns, high-entropy tokens, and nearby UI words like "API Key Created" — and are ALWAYS masked; the value never leaves this tool. Use it before publishing a screen recording, or to search what was on screen. Slow: roughly 1–3 s per frame depending on CPU, so a 10-minute screencast is a job of a few minutes. Example: {"source":"demo.mp4","detectSecrets":true}.

Input parameters:

- `detectSecrets` (boolean): Scan the text for secrets and mask them. Default true.
- `format` (string): concise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
- `from`: Start of the window to analyse: seconds as a number (90) or a string "90", "1:30", "0:01:30.5". Default: beginning.
- `languages` (array): Tesseract language codes. Default ["por","eng"].
- `maxFrames` (integer): Most frames to read. Default 80.
- `presenterRegion` (object): Region to ignore when comparing frames (a webcam overlay), as fractions of the frame: {x, y, w, h} in 0–1.
- `sensitivity` (string): Frame selection sensitivity, as in ollos_keyframes. Default normal.
- `source` (string, required): Local path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.
- `to`: End of the window, same forms as from. Default: end of media.

Output parameters:

- `cached` (boolean)
- `error` (object)
- `etaSeconds` (number)
- `jobId` (string)
- `next` (string)
- `result`
- `status` (string)

### `ollos_review` (~338 tokens)

Pre-publish review

Check a video before it goes public and return a verdict (ok / warn / block) with findings: loudness vs the platform target (YouTube -14 LUFS) and true peak, silence gaps worth cutting, aspect ratio vs the platform (a 1890×1080 file gets black bars on YouTube), and secrets visible on screen. The secrets check reads frames with OCR and is the slow part; drop it from checks for an instant audio/aspect review. Findings say where (timestamp) and what to do. Example: {"source":"episode.mp4","platform":"youtube","checks":["loudness","silences","aspect","secrets"]}.

Input parameters:

- `checks` (array): Which checks to run. Default: all four.
- `format` (string): concise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
- `from`: Start of the window to analyse: seconds as a number (90) or a string "90", "1:30", "0:01:30.5". Default: beginning.
- `platform` (string): Target preset for loudness and aspect. Default youtube.
- `presenterRegion` (object): Region to ignore when comparing frames (a webcam overlay), as fractions of the frame: {x, y, w, h} in 0–1.
- `source` (string, required): Local path, Zoom local-recording folder, http(s) URL, video-site URL (yt-dlp), or data: URI.
- `to`: End of the window, same forms as from. Default: end of media.

Output parameters:

- `cached` (boolean)
- `error` (object)
- `etaSeconds` (number)
- `jobId` (string)
- `next` (string)
- `result`
- `status` (string)

### `ollos_job` (~176 tokens)

Job status and result

Get the state of a job started by ollos_transcribe, ollos_keyframes, ollos_read_screen, ollos_review or ollos_diarize: stage, percentage, and — once completed — the formatted result plus resource links, so no second call is needed. Poll every few seconds; the server keeps jobs on disk, so a jobId survives a restart (an interrupted job says so instead of hanging). Example: {"jobId":"j_a1b2c3d4e5f6"}.

Input parameters:

- `format` (string): concise (default) keeps the response small and points to resources; detailed returns everything within the token budget.
- `jobId` (string, required): The jobId a previous ollos tool returned, e.g. j_a1b2c3d4e5f6.

Output parameters:

- `cached` (boolean)
- `error` (object)
- `etaSeconds` (number)
- `jobId` (string)
- `kind` (string)
- `next` (string)
- `progress` (object)
- `result`
- `status` (string)

### `ollos_cancel` (~130 tokens)

Cancel a job

Stop a queued or running ollos job by jobId — for example when the user changes their mind about a long transcription, or asked for the wrong file. The running stage is aborted (ffmpeg and model inference stop within a second) and the job is marked cancelled; partial artifacts already written stay on disk and are not reused. A job that already finished is reported with its final status and cancelled: false — not an error. Example: {"jobId":"j_a1b2c3d4e5f6"}.

Input parameters:

- `jobId` (string, required): The jobId to stop.

Output parameters:

- `cancelled` (boolean)
- `jobId` (string)
- `status` (string)

### `ollos_frames` (~189 tokens)

View frames

Return contact sheets or individual frames from a finished ollos_keyframes or ollos_read_screen job as images you can look at. Ask for sheets first (each shows 9 timestamped frames); ask for a single frame only when you need a close-up. Default 6 images per call (maxImages, up to 12) to protect the context window. Example: {"jobId":"j_…","sheets":[1,2]} or {"jobId":"j_…","frames":[14]}.

Input parameters:

- `frames` (array): Single frame indices to return (1-based), for close-ups.
- `jobId` (string, required): A completed ollos_keyframes or ollos_read_screen job.
- `maxImages` (integer): Cap on images returned. Default 6.
- `sheets` (array): Contact-sheet indices to return (1-based). Default: the first two.

Output parameters:

- `frames` (array)
- `images` (number)
- `jobId` (string)
- `sheets` (array)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/kelvinbiffi-ollos-mcp/ollos-mcp#diagnostics

## Score history

- 2026-09-20: 59
- 2026-09-19: 59
- 2026-09-18: 59
- 2026-09-17: 59
- 2026-09-16: 59
- 2026-09-15: 44

## Common questions

### What is the io.github.kelvinbiffi/ollos-mcp server?

io.github.kelvinbiffi/ollos-mcp is listed in the public MCP registry as io.github.kelvinbiffi/ollos-mcp. Local, offline transcription, speakers, keyframes, on-screen text and review of any audio or video. This page covers its npm package (ollos-mcp).

### Is the io.github.kelvinbiffi/ollos-mcp server safe to use?

io.github.kelvinbiffi/ollos-mcp scores 59 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.kelvinbiffi/ollos-mcp server expose?

io.github.kelvinbiffi/ollos-mcp exposes 10 tools: ollos_diarize, ollos_search, ollos_probe, ollos_transcribe, ollos_keyframes, and 5 more. Their descriptions and schemas cost roughly 2,963 tokens of context every time the server is loaded.

### Is the io.github.kelvinbiffi/ollos-mcp server still maintained?

io.github.kelvinbiffi/ollos-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.kelvinbiffi/ollos-mcp server under?

io.github.kelvinbiffi/ollos-mcp declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/ollos-mcp
- Socket report: https://socket.dev/npm/package/ollos-mcp
- Repository: https://github.com/kelvinbiffi/ollos-mcp
- Changelog RSS feed: https://verifymcp.io/servers/kelvinbiffi-ollos-mcp/ollos-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/kelvinbiffi-ollos-mcp/ollos-mcp.json
- HTML version of this page: https://verifymcp.io/servers/kelvinbiffi-ollos-mcp/ollos-mcp