magic-hour-mcpSAFE
Hosted MCP server for generating and editing video, images, and audio with the Magic Hour API.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
OpenAPI-backed MCP server for Magic Hour image, video, and audio generation.
At startup, this server reads docs/openapi.json and builds MCP tools with FastMCP.from_openapi(). The OpenAPI spec supplies endpoint coverage, while Magic Hour MCP policies add agent-facing guidance for async polling, uploads, and project downloads.
Docs:
- Magic Hour agent skills - media workflows, published examples, and recovery guidance
user.md- hosted endpoint user guideintegration-handoff.md- FastAPI mount checklistdocs/detailed-step-by-step-integration.md- full backend integration guidedocs/api-reference.md- generated API reference
Setup
pip install -e .
Run locally
python main.py
Local MCP endpoint:
http://127.0.0.1:8000/
This local dev server runs at /, not /mcp. The host app adds /mcp when it mounts the server.
By default, requests go to the production Magic Hour API:
https://api.magichour.ai
Tool discovery is public. Tool calls must include your Magic Hour API key:
Authorization: Bearer
Agents can discover the hosted server card at:
https://mcp.magichour.ai/.well-known/mcp/server-card.json
Environment variables:
MAGIC_HOUR_API_BASE_URL=https://api.magichour.ai MAGIC_HOUR_OPENAPI_PATH=docs/openapi.json MCP_OAUTH_ISSUER_URL=https://mcp.magichour.ai MCP_OAUTH_RESOURCE_URL=https://mcp.magichour.ai
Override MAGIC_HOUR_API_BASE_URL to use a mock or another API base:
MAGIC_HOUR_API_BASE_URL=https://api.sideko.dev/v1/mock/magichour/magic-hour/latest python main.py
OAuth
This server is an OAuth protected resource only. The authorization server is the Magic Hour web app (https://magichour.ai): users sign in and consent there, and it returns a Magic Hour API key as the access token, which this server passes through to the API. Production requires `MCP_
ea0fde9b46d9OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add magic-hour-mcp-app --env MCP_OAUTH_ISSUER_URL=${MCP_OAUTH_ISSUER_URL} --env MCP_OAUTH_RESOURCE_URL=${MCP_OAUTH_RESOURCE_URL} --env POSTHOG_PROJECT_TOKEN=${POSTHOG_PROJECT_TOKEN} -- npx -y magic-hour-mcp-app{
"mcpServers": {
"magic-hour-mcp-app": {
"command": "npx",
"args": [
"-y",
"magic-hour-mcp-app"
],
"env": {
"MCP_OAUTH_ISSUER_URL": "${MCP_OAUTH_ISSUER_URL}",
"MCP_OAUTH_RESOURCE_URL": "${MCP_OAUTH_RESOURCE_URL}",
"POSTHOG_PROJECT_TOKEN": "${POSTHOG_PROJECT_TOKEN}"
}
}
}
}Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (7)
"url": "http://127.0.0.1:8000/",
.mcp.json.example
http://127.0.0.1:8000/
- URL: `http://127.0.0.1:8000/`
http://127.0.0.1:8000/mcp/
- URL: `http://127.0.0.1:8000/mcp/`
Gates applied: no_behavioural_pass.
ea0fde9b46d9full audit observations/trust-audit/mcp-server/magichourhq__magic-hour-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | ea0fde9b46d9 | SAFE | B | 89 | first audit |
Questions
What is the magic-hour-mcp MCP server?
Hosted MCP server for generating and editing video, images, and audio with the Magic Hour API.
Is magic-hour-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does magic-hour-mcp need?
It reads MCP_OAUTH_ISSUER_URL, MCP_OAUTH_RESOURCE_URL and POSTHOG_PROJECT_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does magic-hour-mcp run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as magic-hour-mcp-app.
How current is this page?
The grade is for one exact copy of the source (ea0fde9b46d9), read on 2026-10-11. The repository is watched and re-audited when it changes.