Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

premiere-pro-mcp

by leancoderkavy/premiere-pro-mcpMIT licenceAudited 6 Oct 2026 · source 4fd92dcb605b

npm premiere-pro-mcp 1.19.1stdiostreamable-http★ 325
✕BLOCKGrade D · 60/100 · 6 Oct 2026 · 4fd92dc
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade D (60/100). It exposes 7 tools: 5 read, 2 write and 0 destructive. The audit recorded 28 findings (0 critical, 1 high, 5 medium, 22 low). Maintainer's description: Adobe Premiere Pro MCP — independent, local-first server for supported workflows. Connect Claude, Codex, or Cursor through a local CEP bridge.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “premiere-pro-mcp (leancoderkavy/premiere-pro-mcp)”. Retrieved 6 Oct 2026. https://modelsatlas.com/mcp/leancoderkavy/premiere-pro-mcp

Why this is BLOCK. The audit found 0 critical and 1 high findings; the most severe is Code injection at src/context/project-context-store.ts:207. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 6 Oct 2026

Trust score60/100✕BLOCK D
0 critical1 high5 medium22 low0 info

28 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemNone observedNothing seen in the source
  • NetworkDeclared6 observations
  • ShellDeclared2 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsFoundSee the findings

Findings (28)

Sorted by severity · the 25 most severe of 28 are listed

HIGHCode injectioncode.eval_exec · src/context/project-context-store.ts:207
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(sql: string): void;
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
MEDIUMObfuscation / stealthobf.zero_width · src/tools/mogrt-bake.ts:275
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const definition = JSON.parse(definitionEntry.data.toString("utf8").replace(/^/, "")) as Record<string, any>;
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · src/tools/mogrt-bake.ts:342
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
if (entry.name === "definition.json") output.push({ name: entry.name, data: Buffer.from("" + JSON.stringify(definition), "utf8") });
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · tests/bridge/bridge-edge-coverage.test.ts:195
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · tests/bridge/uxp-symlink-guard.test.ts:12
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · tests/uxp/transport.test.ts:9
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .bk.yaml
F-13 Inventory / provenanceCWE-1104Layer L0
.bk.yaml
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .clinerules
F-13 Inventory / provenanceCWE-1104Layer L0
.clinerules
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .windsurfrules
F-13 Inventory / provenanceCWE-1104Layer L0
.windsurfrules
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · cep-plugin/.debug
F-13 Inventory / provenanceCWE-1104Layer L0
.debug
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWCode injectioncode.eval_exec · tests/bridge/file-bridge.test.ts:751
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
it("rejects scripts containing eval()", async () => {
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · tests/bridge/file-bridge.test.ts:757
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
it("rejects scripts containing new Function()", async () => {
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · tests/bridge/file-bridge.test.ts:759
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
sendCommand('new Function("code")', { tempDir: "/tmp/test-bridge" })
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · tests/bridge/file-bridge.test.ts:821
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
it("allows eval() in raw commands", async () => {
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWInsecure cryptocrypto.weak_hash · src/bridge/after-effects-script-builder.ts:34
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
export const AFTER_EFFECTS_HELPERS_VERSION = createHash("md5")
Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · src/bridge/script-builder.ts:2559
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
export const HELPERS_VERSION = createHash("md5").update(HELPERS).digest("hex").slice(0, 12);
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · tests/ai/beat-montage.test.ts:2
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { buildBeatSlots, normalizeBeatMontageOptions, orderMontageClips, planBeatMontage } from "../../src/ai/beat-montage.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · tests/ai/caption-authoring.test.ts:12
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
} from "../../src/ai/caption-authoring.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · tests/ai/chapter-segmentation.test.ts:2
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { DEFAULT_STOP_WORDS, cosineSimilarity, formatYoutubeTimestamp, planChapterMarkers } from "../../src/ai/chapter-segmentation.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · tests/ai/client-notes.test.ts:8
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
} from "../../src/ai/client-notes.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · tests/ai/edl-export.test.ts:2
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { buildCmx3600Edl, framesToTimecode, resolveTimecodeRate } from "../../src/ai/edl-export.js";
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · docs/posthog-events.md:120
F-04 Network egressCWE-200 · CWE-319Layer L1
- Local Playwright at `http://127.0.0.1:3160/`, 1440×1000: homepage rendered,
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · tests/mcp-2026-protocol.test.ts:37
F-04 Network egressCWE-200 · CWE-319Layer L1
new URL(`http://127.0.0.1:${address.port}/mcp`),
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · tests/oauth-resource-server.test.ts:80
F-04 Network egressCWE-200 · CWE-319Layer L1
jwksUri: `http://127.0.0.1:${address.port}/jwks.json`,
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.zero_width · tests/tools/stock-titles.test.ts:83
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
return "" + JSON.stringify({ capsuleName: "x", clientControls: controls });
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

7 declared in source · 0 destructive

5 read2 write0 destructive
ToolWhat it doesRisk
assistant-editTranscript-locked dialogue analysis, preview, derivative assembly, captions, reframing, and structural review.write
essentialConnection, project and sequence inspection, safe edit-plan preview, save, delivery validation, export, and local delivery verification.write
captionsCaption-track creation, supported caption readback, sequence structure, and review-frame evidence.read
deliveryExport preflight, rendering, interchange export, review-frame export, queue state, and post-export local verification.read
get_notesRead transcript review notesread
inspectionRead-only project, sequence, timeline, review, render-queue, and clip-metadata inspection before an editorial or delivery handoff.read
intakeSession-scoped watched-folder monitoring, path-redacted proposals, deliberate import, and project inspection.read

Safer alternatives

All design tools servers →
Magic✓SAFE

21st-dev/magic-mcp

It's like v0, but in your Cursor / Claude Code / Windsurf: search 10,000+ React/Tailwind components, generate new UI with AI, and publish your own — right from your editor. Magic MCP is now the 21st MCP; this package keeps old configs working. Setup: 21st.dev/mcp

Grade B
Figma MCP Bridge✓SAFE

gethopp/figma-mcp-bridge

Figma Plugin & MCP server to bypass API limits

3 destructiveGrade B
Figma Pilot✓SAFE

youware-labs/figma-pilot

MCP that let AI agents control Figma through code execution

1 destructiveGrade B

Audit history

  1. ✕BLOCK D 60 / 100

    Score 65 -> 60 · 4fd92dcb605b

  2. ✕BLOCK D 65 / 100

    First audit · 0ac5cfad9f54

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about premiere-pro-mcp

What is the premiere-pro-mcp MCP server?
Adobe Premiere Pro MCP — independent, local-first server for supported workflows. Connect Claude, Codex, or Cursor through a local CEP bridge.
What tools does premiere-pro-mcp expose?
7 in total: 5 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is premiere-pro-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (60/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does premiere-pro-mcp need?
It reads ALLOW_UNAUTHENTICATED, GITHUB_TOKEN, MCP_AUTH_TOKEN, MCP_OAUTH_ALLOWED_SUBJECTS, MCP_OAUTH_AUDIENCE, MCP_OAUTH_ISSUER, MCP_OAUTH_JWKS_URI, MCP_OAUTH_REQUIRED_SCOPES, NODE_AUTH_TOKEN, NPM_TOKEN, POSTHOG_API_KEY and PREMIERE_UXP_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does premiere-pro-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as premiere-pro-mcp at 1.19.1.
How current is this page?
The grade is for one exact copy of the source (4fd92dcb605b), read on 2026-10-06. The repository is watched and re-audited when it changes.
I already installed premiere-pro-mcp. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • leancoderkavy/premiere-pro-mcp on GitHub — the source we read, its licence, stars and activityObserved · 6 Oct 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit 4fd92dcb605bObserved · 6 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.