Atlas / MCP servers / jordanrendric / Video Vision

Video VisionBLOCK

mcp/jordanrendric/video-vision

Give Claude the ability to watch and understand videos — Claude Code plugin with frame extraction and multimodal audio analysis

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
6 6r · 0w · 0d
Transport
stdio
License
MIT
Stars
1,332
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Give Claude the ability to watch and understand videos.

A Claude Code plugin that extracts frames via ffmpeg and processes audio via multiple backends (Gemini API, local Whisper, or OpenAI API). Claude receives frames as images and audio transcription with timestamps — the plugin is a perception layer, not an interpretation layer.

Features

  • Multimodal perception — Claude sees video frames directly and reads audio transcriptions with timestamps
  • YouTube URL support — Pass a YouTube URL directly; the MCP server downloads it with yt-dlp, preserving source metadata and captions for context
  • Flexible backends — Choose between cloud APIs or fully local processing
  • Adaptive extraction — Claude adjusts fps, time range, and resolution based on your question
  • Auto-installation — Whisper models download automatically on first use
  • Interactive setup wizard — /setup-video-vision walks you through configuration

Quick Start

1. Install the plugin

Inside Claude Code, run these commands one at a time:

/plugin marketplace add https://github.com/jordanrendric/claude-video-vision

Then:

/plugin install claude-video-vision

The MCP server will auto-install via npx from npm on first use — no build step required.

Alternative: local development

git clone https://github.com/jordanrendric/claude-video-vision.git
claude --plugin-dir /path/to/claude-video-vision

2. Configure

Inside Claude Code, run the interactive wizard:

/claude-video-vision:setup-video-vision

It will walk you through backend selection, whisper configuration (if local), frame options, and dependency verification.

Usage

Slash command

/watch-video path/to/video.mp4
/watch-video tutorial.mp4 "what language is used in this tutoria
Read from source at commit 4a6b4931aa17OBSERVED · 2026-09-25
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add claude-video-vision --env GEMINI_API_KEY=${GEMINI_API_KEY} --env OPENAI_API_KEY=${OPENAI_API_KEY} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "claude-video-vision": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GEMINI_API_KEY": "${GEMINI_API_KEY}",
        "OPENAI_API_KEY": "${OPENAI_API_KEY}"
      }
    }
  }
}
03

Exposed tools (6)

6 read · 0 write · 0 destructive.

ToolRiskDescription
video_analyzeread
video_configurereadConfigure video perception preferences (backend, resolution, fps, whisper model, etc.)
video_detailread
video_inforeadGet metadata about a local video file or YouTube URL without processing it (duration, resolution, codec, etc.)
video_setupreadCheck dependencies for video perception (ffmpeg, whisper, gemini api, optional yt-dlp for YouTube URLs).
video_watchread
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)WARN
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (11)

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
mcp-server/src/utils/installer.ts:30
else if (platform.os === "linux") instructions.push("sudo apt install ffmpeg");
Why it matters. asks for elevated privileges
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/hero.avif
hero.avif
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMPrompt injection · scope.undeclared_system · CWE-94, CWE-1427
<declared scope>
system use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare system use in the description, or remove it
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
mcp-server/tests/backends/gemini-api.test.ts:2
import { waitForFileActive } from "../../src/backends/gemini-api.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
mcp-server/tests/backends/gemini-api.test.ts:3
import { formatHMS } from "../../src/utils/timestamps.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
mcp-server/tests/backends/gemini-api.test.ts:138
import { transcribeChunk, transcribeChunkWithRetry } from "../../src/backends/gemini-api.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
mcp-server/tests/backends/gemini-api.test.ts:139
import type { Config } from "../../src/types.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
mcp-server/tests/backends/gemini-api.test.ts:140
import { defaultConfig } from "../../src/config.js";
LOWPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
.github/workflows/ci.yml:37
run: sudo apt-get update && sudo apt-get install -y ffmpeg
Why it matters. asks for elevated privileges
LOWPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
.github/workflows/release.yml:31
run: sudo apt-get update && sudo apt-get install -y ffmpeg
Why it matters. asks for elevated privileges
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
mcp-server/package.json
@modelcontextprotocol/sdk, zod, @types/node, js-tiktoken, tsx, typescript, vitest, @google/genai
Why it matters. 9 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-09-25 · audit v0.4.1 · source sha 4a6b4931aa17full audit observations/trust-audit/mcp-server/jordanrendric__video-vision.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-09-254a6b4931aa17BLOCKD69first audit
06

Questions

What is the Video Vision MCP server?

Give Claude the ability to watch and understand videos — Claude Code plugin with frame extraction and multimodal audio analysis

What tools does Video Vision expose?

6 in total: 6 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Video Vision safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does Video Vision need?

It reads GEMINI_API_KEY and OPENAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Video Vision run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as claude-video-vision at 1.3.2.

How current is this page?

The grade is for one exact copy of the source (4a6b4931aa17), read on 2026-09-25. The repository is watched and re-audited when it changes.

Advertisement