# io.github.luke-fairbanks/broll (npm · broll-mcp)

Content studio MCP for coding agents: BYO keys, deterministic video rendering, draft-first posting

- Trust score: 65/100 (medium)
- Change this week: +41
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `broll-mcp`: 65/100 (this document), [markdown](https://verifymcp.io/servers/luke-fairbanks-broll/broll-mcp.md), [page](https://verifymcp.io/servers/luke-fairbanks-broll/broll-mcp)

## Channel facts

- Registry: `npm`
- Package: `broll-mcp`
- Version: `0.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (143 of 147), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (143 of 147), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 21 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 967 tokens (~69/item across 14 items; 14 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 78/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 33% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add luke-fairbanks-broll -- npx -y broll-mcp
```

### Codex

```bash
codex mcp add luke-fairbanks-broll -- npx -y broll-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "luke-fairbanks-broll": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "broll-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add luke-fairbanks-broll --command npx --arg -y --arg broll-mcp
```

### Hermes

```yaml
mcp_servers:
  luke-fairbanks-broll:
    command: "npx"
    args: ["-y", "broll-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "luke-fairbanks-broll": {
      "command": "npx",
      "args": [
        "-y",
        "broll-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 65, +4)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 61, +42)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-07-31 (score 19, −6)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 25, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-28 (score 43, +19)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 33
- [functional] First check of Schema quality: pass
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 24)

First indexed and scored.

## MCP tools (14)

### `broll_status` (~73 tokens)

broll status

Report workspace location, ffmpeg availability, configured generation providers, and social platform readiness. Call this first to see what is possible. Pass probe: true to live-verify social credentials (makes real authenticated API calls, posts nothing).

Input parameters:

- `probe` (boolean): Live-verify social platform credentials (no posts are made)

### `generate_image` (~113 tokens)

Generate image

Generate image(s) with the user’s own API keys (BYO-key: OpenAI or Gemini; falls back to a labelled mock when no keys are set). Returns workspace asset ids usable in render_video, render_carousel, and post drafts.

Input parameters:

- `aspect` (string)
- `label` (string): Human-readable label stored on the asset
- `n` (integer)
- `prompt` (string, required)
- `provider` (string): Force a provider by name: openai | gemini | mock

### `generate_video` (~88 tokens)

Generate video

Generate a short video clip with the user’s own API keys (Gemini Veo when configured; labelled mock otherwise). Expensive with real keys — only call when the user’s workflow needs generated footage.

Input parameters:

- `aspect` (string)
- `durationSec` (integer)
- `prompt` (string, required)
- `provider` (string): Force a provider by name: gemini | mock

### `import_asset` (~49 tokens)

Import asset

Copy a local file (image/video/audio) into the broll workspace and get an asset id for it.

Input parameters:

- `label` (string)
- `path` (string, required): Absolute path to the file

### `list_assets` (~31 tokens)

List assets

List workspace assets (generated, imported, and rendered), optionally filtered by kind.

Input parameters:

- `kind` (string)

### `probe_asset` (~37 tokens)

Probe asset

Inspect a media file: duration, dimensions, codecs, streams. Accepts an asset id or absolute path.

Input parameters:

- `asset` (string, required)

### `render_video` (~72 tokens)

Render video

Compile a declarative RenderPlan into an mp4 via ffmpeg — deterministic, brand-aware, no generation keys needed. Clips (video/image/color) are concatenated in order; overlays and captions are burned in; optional music is mixed under clip audio. Returns the rendered asset id.

Input parameters:

- `plan` (object, required)

### `render_carousel` (~60 tokens)

Render carousel

Render branded carousel slides (the Instagram/LinkedIn format). Layout, fonts, accent bar, page numbers, and watermark are deterministic code; backgrounds can be plain color or any image asset. Returns one asset per slide.

Input parameters:

- `spec` (object, required)

### `extract_frame` (~43 tokens)

Extract frame

Extract a single PNG frame from a video at a timestamp — use it to visually QA a render.

Input parameters:

- `asset` (string, required)
- `atSec` (number)

### `create_post_draft` (~87 tokens)

Create post draft

Create a reviewable post draft (text + media + target platforms). Validates against per-platform rules (char limits, media counts/sizes) and reports violations. Nothing is published — drafts are files the user can inspect; use publish_post to send.

Input parameters:

- `media` (array): Asset ids or absolute paths
- `platforms` (array, required)
- `text` (string, required)

### `create_thread_draft` (~82 tokens)

Create thread draft

Create a multi-post thread draft. On publish, posts chain as replies under the first one (Bluesky reply refs, X in_reply_to). Each post has its own text and up to 4 images, validated per platform. Nothing is published until publish_post with confirm: true.

Input parameters:

- `platforms` (array, required)
- `posts` (array, required)

### `set_profile` (~98 tokens)

Set profile

Update the Bluesky profile (display name, bio, avatar image) — merges with the existing profile, never clobbers other fields. Requires confirm: true because it changes the public account.

Input parameters:

- `avatarAsset` (string): Asset id or absolute path of an image
- `bio` (string)
- `confirm` (boolean, required): Must be true. Confirms the user explicitly approved this profile change.
- `displayName` (string)

### `list_drafts` (~22 tokens)

List drafts

List post drafts in the outbox with status and publish results.

### `publish_post` (~112 tokens)

Publish post

Publish a draft to its target platforms. Requires confirm: true — never call this without the user’s explicit go-ahead in the conversation. Platforms without credentials fail independently with setup instructions; "export" always succeeds and writes a ready-to-post bundle.

Input parameters:

- `confirm` (boolean, required): Must be true. Confirms the user explicitly approved publishing this draft now.
- `draftId` (string, required)
- `platforms` (array): Publish to only this subset of the draft’s platforms (e.g. test one network first).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/luke-fairbanks-broll/broll-mcp#diagnostics

## Score history

- 2026-08-03: 65
- 2026-08-02: 61
- 2026-08-01: 19
- 2026-07-31: 19
- 2026-07-30: 25
- 2026-07-28: 43
- 2026-07-27: 24

## Links

- npm package: https://www.npmjs.com/package/broll-mcp
- Socket report: https://socket.dev/npm/package/broll-mcp
- Repository: https://github.com/luke-fairbanks/broll
- Changelog RSS feed: https://verifymcp.io/servers/luke-fairbanks-broll/broll-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/luke-fairbanks-broll/broll-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/luke-fairbanks-broll/broll-mcp