Kinocut MCP Server

Findings (33)

• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @xmldom/xmldom@0.9.10: 13 known vulnerabilities

  GHSA-27p8-2357-5qqv, GHSA-3px3-54cx-rmw9, GHSA-4w3w-2rp5-g8jm, GHSA-6gmq-8vp8-gcm6, GHSA-6h8r-xr42-gp59 +8 more

  kinocut/revideo_template/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  basic-ftp@5.3.1: 1 known vulnerability

  GHSA-c475-qrg2-pj4r

  kinocut/revideo_template/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  extract-zip@2.0.1: 2 known vulnerabilities

  GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv

  kinocut/revideo_template/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  follow-redirects@1.16.0: 3 known vulnerabilities

  GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8

  kinocut/revideo_template/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  kinocut/revideo_template/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  uuid@10.0.0: 1 known vulnerability

  GHSA-w5hq-g745-h8pq

  kinocut/revideo_template/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  uuid@9.0.1: 1 known vulnerability

  GHSA-w5hq-g745-h8pq

  kinocut/revideo_template/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@4.5.2: 21 known vulnerabilities

  GHSA-356w-63v5-8wf4, GHSA-4r4m-qw57-chr8, GHSA-4w7w-66w2-5vf9, GHSA-587h-7wmj-h5pm, GHSA-64vr-g452-qvp3 +16 more

  kinocut/revideo_template/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.23.8: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  kinocut/revideo_template/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  node-forge@1.4.0: 12 known vulnerabilities

  GHSA-4487-j8r4-4g2f, GHSA-4642-5mcj-2rqw, GHSA-525v-9gp9-w22h, GHSA-5cwg-6vw7-rj6p, GHSA-5x38-2vff-x55p +7 more

  tools/mcpb-validator/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  tmp@0.0.33: 2 known vulnerabilities

  GHSA-52f5-9888-hmc6, GHSA-ph9p-34f9-6g65

  tools/mcpb-validator/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  tools/mcpb-validator/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  filelock@3.25.2: 9 known vulnerabilities

  GHSA-567q-5qvw-pf92, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9vhv-jxww-xfm5, GHSA-cwqr-hh33-gh44 +4 more

  uv.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fsspec@2026.3.0: 1 known vulnerability

  PYSEC-2026-4217

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  8 matches in this file

  docs/research/ultraqa/2026-09-30/full-gate-attempt-3/frozen-source.json:241
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  8 matches in this file

  docs/research/ultraqa/2026-09-30/full-gate-attempt-1/frozen-source.json:241
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  8 matches in this file

  docs/research/ultraqa/2026-09-30/full-gate-attempt-5/frozen-source.json:241
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  8 matches in this file

  docs/research/ultraqa/2026-09-30/parallel-preflight/frozen-source.json:241
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  8 matches in this file

  docs/research/ultraqa/2026-09-30/full-gate-attempt-2/frozen-source.json:241
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  8 matches in this file

  docs/research/ultraqa/2026-09-30/full-gate-attempt-4/frozen-source.json:241
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/test_kinocut_sound_receipt.py:279
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/test_product_models.py:125
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: github-pat

  3 matches in this file

  tests/test_secret_scan.py:32
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/test_secret_scan.py:45
• lowLow. Minor, or common in normal tools. Shown for information.
  esbuild@0.18.20: 1 known vulnerability

  GHSA-67mh-4wv8-2f99

  kinocut/revideo_template/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ip-address@10.7.0: 3 known vulnerabilities

  GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rxp7-6hxx-x8q5

  kinocut/revideo_template/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  basicsr@1.4.2: 1 known vulnerability

  PYSEC-2026-1215

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  setuptools@84.0.0: 1 known vulnerability

  GHSA-xmj3-9gf7-h52w

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  werkzeug@3.1.8: 1 known vulnerability

  PYSEC-2026-4312

  uv.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  GITHUB_OUTPUT, KINOCUT_MCPB_RUNTIME_CHILD, KINOCUT_MCPB_OWNER_KIND, OWNER_KIND_ENV, OWNER_READY_ENV, OWNER_TOKEN_ENV, OWNER_NAME_ENV, KINOCUT_FFMPEG_EXECUTABLE, KINOCUT_FFPROBE_EXECUTABLE, MCP_VIDEO_CRUSH_PATH, _SUPERVISED_ENV, _MARKER_ENV, _TOKEN_ENV, _OWNER_READY_ENV, KINOCUT_C2PATOOL

Network activity

Tools exposed (30)

• video_info

  Probe a video file for metadata. Returns JSON {success, info:{duration, resolution, codec, fps, size, ...}}. Use before any edit to learn the source's dimensions and length. Pass input_path as the absolute path to the existing video. Set exact=true to also get the decoded frame_count and the raw r_f

• video_trim

  Trim a video clip by start time and duration. Returns JSON {success, output_path} pointing at the rendered clip. Use to cut a segment out of a longer video. Pass input_path as the absolute path to the source video (e.g. from video_info), start as a timestamp, and duration or end to define the segmen

• video_merge

  Concatenate two or more existing video clips into one rendered output file. Returns JSON {success, output_path}. Use to join ordered clips into a single video. Pass clips as an ordered list of absolute paths (at least two); output is auto-named or written to output_path.

• video_add_text

  Overlay text on a video (titles, captions, watermarks). Returns JSON {success, output_path}. Use to burn a single text element into a video. Pass input_path as the source video, text with the string to draw, and position/size/color to style it; output_path is auto-named when omitted. Args:

• video_add_texts

  Overlay multiple text elements on a video in a single FFmpeg pass. Returns JSON {success, output_path}. Use when one video needs several captions at once. Pass input_path as the source video and texts as a list of overlay dicts (text plus optional position/size/color/timing). Args:

• video_add_audio

  Add, replace, or mix an audio track into an existing video and render a new output file. Returns JSON {success, output_path}. Use to score or re-voice a video; source video and audio are read only. Pass video_path as the source video and audio_path as the audio file; set mix to combine or false to r

• video_resize

  Resize a video or change its aspect ratio. Returns JSON {success, output_path}. Use to fit a video to target dimensions or a preset ratio. Pass input_path as the source video (e.g. from video_info) and either width/height or aspect_ratio to define the target. Args: input_path: Absolute

• video_convert

  Transcode a video into a different container or codec (mp4, webm, gif, mov, ...). Returns JSON {success, output_path}. Use for format conversion; prefer video_export for delivery presets. Pass input_path as the source video and format as the target container; long renders stream MCP progress.

• video_speed

  Render a new video with playback speed changed; the source video is left unchanged. Returns JSON {success, output_path}. Use for slow-motion or fast-forward effects. Pass input_path as the source video and factor as the multiplier (below 1.0 slows, above 1.0 speeds up).

• search_tools

  Find registered MCP tools by name, keyword, or a supported task phrase. Returns JSON {success, query, count, tools:[{name, description, required_params}]}. Use to find the right tool for a task without reading every description. Pass query with a term such as blur, resize, subtitle, aud

• video_quality_check

  Run visual quality checks on a video. Analyzes brightness, contrast, saturation, audio levels, and color balance. Returns quality scores and recommendations. Args: input_path: Absolute path to video file fail_on_warning: If True, treat warnings as failures

• video_project_create

  Scaffold a cinematic video project with style, storyboard, and refs folders. Args: slug: Project slug using lowercase letters, numbers, hyphens, or underscores. output_dir: Base directory for the projects/ folder. Defaults to the current working directory.

• video_doctor

  Return a read-only JSON readiness verdict for the next video job.

• video_validate_text_layout

  Validate a set of text overlays for visual failure modes before rendering. Checks for: text overlap, low contrast, unsafe positioning, excessive sequential overlays, and missing shadows. Args: overlays: List of overlay specs with keys: text, position, size, color,

• video_extract_frame

  Extract a frame using the same sampling as CLI and Python frame extraction. Omitted timestamps use smart thumbnail selection when available, falling back to 10% of the clip duration. Pass 0 explicitly to extract the first frame. Args: input_path: Absolute path to the video.

• hyperframes_doctor

  Run Hyperframes environment diagnostics.

• video_review_package

  Assemble a review package and publish-gate verdict for a candidate artifact.

• video_rescue_inspect

  Inspect a rescue plan or receipt and re-check artifact integrity.

• video_shorts

  Trim, caption, make vertical, and export selected segments in one call.

• video_workflow_inspect

  Summarize any receipt this project emits, with a read-only integrity check. Reads a workflow render receipt, a dry-run ``workflow_plan`` artifact, or a ``layer_plan`` receipt (v1 legacy with NO ``receipt_kind`` field, or v2) at ``receipt_path`` and returns a NORMALIZED inspection: the k

• list_operations

  Enumerate compact-surface operations on demand: families with member counts, and each operation's family, verb, required parameters and declared side-effect annotations. Optional family or query filters. Complements search_tools; use describe_operation for one operation's full inputSchema.

• describe_operation

  Retrieve one operation's full inputSchema on demand — optional arguments, types, defaults and nested definitions, exactly as the direct tool declares them — with the family tool that dispatches it and its verified kino CLI route when one exists.

• video_edit_ops

  Run one edit operation. operation is one of this family's names (see list_operations); params holds that operation's exact arguments. Registry modules: server_tools_basic, server_tools_advanced, server_tools_media. Use list_operations to enumerate members; describe_operation returns one operation's

• video_effects_ops

  Run one effect operation. operation is one of this family's names (see list_operations); params holds that operation's exact arguments. Registry modules: server_tools_effects, server_tools_glitch, server_tools_glitch_shader. Use list_operations to enumerate members; describe_operation returns one op

• audio_ops

  Run one audio operation. operation is one of this family's names (see list_operations); params holds that operation's exact arguments. Registry modules: server_tools_audio, server_tools_sound. Use list_operations to enumerate members; describe_operation returns one operation's full inputSchema.

• video_ai_ops

  Run one AI operation. operation is one of this family's names (see list_operations); params holds that operation's exact arguments. Registry modules: server_tools_ai, server_tools_aivideo. Use list_operations to enumerate members; describe_operation returns one operation's full inputSchema.

• image_ops

  Run one image/still operation. operation is one of this family's names (see list_operations); params holds that operation's exact arguments. Registry modules: server_tools_image. Use list_operations to enumerate members; describe_operation returns one operation's full inputSchema.

• video_qc_ops

  Run one inspection/release operation. operation is one of this family's names (see list_operations); params holds that operation's exact arguments. Registry modules: server_tools_inspection, server_tools_doctor, server_tools_guardrails, server_tools_motion_acceptance, server_tools_release. Use list_

• video_plan_ops

  Run one planning operation. operation is one of this family's names (see list_operations); params holds that operation's exact arguments. Registry modules: server_tools_intent, server_tools_creation, server_tools_postrescue, server_tools_repurpose, server_tools_rescue, server_tools_workflow. Use lis

• platform_ops

  Run one platform operation. operation is one of this family's names (see list_operations); params holds that operation's exact arguments. Registry modules: server_tools_hyperframes, server_tools_revideo, server_tools_shorts. Use list_operations to enumerate members; describe_operation returns one op