josesepulvedapino-zahoriCAUTION
Find the media stream behind any web page: browser-driven HLS/DASH/MP4 resolution with learnable site profiles
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Find the media stream behind any web page.
[](https://github.com/josesepulvedapino/zahori/actions/workflows/ci.yml) [](https://www.npmjs.com/package/zahori) [](https://nodejs.org) [](./LICENSE)
A real browser opens the page, dismisses the overlays, presses play, and watches the network until the media request appears. You get the stream URL (HLS, DASH, MP4 or audio) plus the headers needed to replay it.
$ npx zahori get https://example.org/live https://cdn.example.org/hls/live/master.m3u8
No per-site configuration. No extractor to wait for. If a browser can play it, zahori can find it.
Table of contents
- Features
- Why zahori
- Install
- CLI
- Library
- Profiles: how zahori learns a site
- Teaching zahori a site
- The oracle
- Responsible use
- API
- Documentation
- Contributing
- License
Features
- Works on any URL, out of the box. A built-in generic flow handles most pages with zero config.
- Real browser engine. Playwright drives a headless browser in the background; consent banners, play buttons and iframe players are handled automatically, in several languages.
- Replay headers included. Referer/Origin/UA/Cookie are captured from the real request, so ffmpeg and friends don't get 403'd.
- HLS-aware. Master vs media playlists, live vs VOD detection, and audio-rendition selection by language for multilingual streams.
- Learnable. Tricky sites become a small JSON profile, saved once, deterministic forever.
- **Agent-n
258b21314ed9OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add zahori -- npx -y [email protected] mcp
Exposed tools (6)
5 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
zahori_get | read | |
zahori_list_profiles | read | |
zahori_probe | read | |
zahori_save_profile | write | |
zahori_test_profile | read | |
zahori_validate | read |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (11)
dowser-0.1.0.tgz
urlExclude: '(/ads?[/.?-]|advert|analytics|beacon|thumbnail|/vast|doubleclick|googlesyndication)',
'#EXT-X-MEDIA:TYPE=AUDIO,GROUP-ID="aud",LANGUAGE="fr-FR",NAME="French",DEFAULT=NO,URI="/root/audio_fr.m3u8"',
expect(resolveUri(master, '/root/audio_fr.m3u8')).toBe('https://cdn.example.com/root/audio_fr.m3u8');import { probe, testProfile } from '../../src/discover.js';import { resolve } from '../../src/resolve.js';import { runProfile, runProfileOnPage } from '../../src/runtime.js';import { parseProfile, GENERIC_PROFILE } from '../../src/profile.js';import { launchBrowser, newBrowserContext } from '../../src/browser.js';base = `http://127.0.0.1:${(server.address() as AddressInfo).port}`;@ai-sdk/anthropic, @ai-sdk/openai, @ai-sdk/openai-compatible, @modelcontextprotocol/sdk, ai, commander, playwright, zod
Gates applied: no_behavioural_pass.
258b21314ed9full audit observations/trust-audit/mcp-server/josesepulvedapino__zahori.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 258b21314ed9 | CAUTION | B | 89 | first audit |
Questions
What is the josesepulvedapino-zahori MCP server?
Find the media stream behind any web page: browser-driven HLS/DASH/MP4 resolution with learnable site profiles
What tools does josesepulvedapino-zahori expose?
6 in total: 5 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is josesepulvedapino-zahori safe to connect to an agent?
With care. The audit graded it B (89/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does josesepulvedapino-zahori need?
It reads ANTHROPIC_API_KEY, OPENAI_API_KEY and OPENAI_COMPATIBLE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does josesepulvedapino-zahori run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as zahori at 0.1.1.
How current is this page?
The grade is for one exact copy of the source (258b21314ed9), read on 2026-10-12. The repository is watched and re-audited when it changes.