SupadataCAUTION
Official Supadata MCP Server - Adds powerful video & web scraping to Cursor, Claude and any other LLM clients.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://glama.ai/mcp/servers/@supadata-ai/mcp)
A Model Context Protocol (MCP) server that integrates with Supadata for video transcript extraction, web scraping, crawling, and site discovery.
Features
- Video transcript extraction from YouTube, TikTok, Instagram, Twitter, and file URLs
- Web scraping, crawling, and URL discovery
- Media metadata retrieval from YouTube, TikTok, Instagram, and Twitter
- AI-powered structured data extraction from video content
Installation
For setup instructions for Claude, ChatGPT, Cursor, Windsurf, VS Code, and other clients, see the integration guide.
Running
Stdio (default)
Running the package starts an MCP server on stdio. This is what MCP clients (Claude Desktop, Cursor, VS Code, Windsurf, ...) use when they spawn the server:
SUPADATA_API_KEY=your-api-key npx -y @supadata/mcp
Example client configuration:
{
"mcpServers": {
"supadata": {
"command": "npx",
"args": ["-y", "@supadata/mcp"],
"env": { "SUPADATA_API_KEY": "your-api-key" }
}
}
}Streamable HTTP (hosted)
The same tools are served over Streamable HTTP by the Cloudflare Worker in src/worker.ts, deployed at https://api.supadata.ai/mcp with OAuth 2.1. Run it locally with npm run dev (wrangler). Direct x-api-key header authentication is also accepted on /mcp.
Configuration
Environment Variables
SUPADATA_API_KEY: Your Supadata API key (required for the stdio server). Get one at dash.supadata.aiDEBUG: set totruefor verbose loggingRUN_STDIO: set totrueto force the stdio server to start when the module is imported rather than executed directly
How to Choose a Tool
Select the right tool based on your needs:
- Transcript: Extract vide
1ada410b6111OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp --env SUPADATA_API_KEY=${SUPADATA_API_KEY} -- npx -y @supadata/[email protected]{
"mcpServers": {
"mcp": {
"command": "npx",
"args": [
"-y",
"@supadata/[email protected]"
],
"env": {
"SUPADATA_API_KEY": "${SUPADATA_API_KEY}"
}
}
}
}Exposed tools (9)
8 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
supadata_check_crawl_status | read | Check crawl job status and retrieve results. Returns status: |
supadata_check_extract_status | read | Check extract job status and retrieve results. Returns status: |
supadata_check_transcript_status | read | Check transcript job status and retrieve results. Returns status: |
supadata_crawl | write | Create a crawl job to extract content from all pages on a website. Returns a jobId - use supadata_check_crawl_status with that jobId to poll for results. |
supadata_extract | read | Extract structured data from a video URL using AI. Provide a prompt for what to extract, a JSON Schema for the output format, or both. Returns a jobId for async processing - use supadata_check_extract_status with that jobId to poll for results. |
supadata_map | read | List the URLs found on a website without fetching their content. Use this to discover a site\ |
supadata_metadata | read | Fetch metadata from a media URL (YouTube, TikTok, Instagram, Twitter/X, Facebook). Returns platform info, title, description, author details, engagement stats, media details, tags, and creation date. Use this for details about a video or post; use supadata_transcript for what is said in it. |
supadata_scrape | read | Fetch a single web page and return its main content as Markdown, along with the page title, description and the links it contains. Use this to read or summarize a specific URL. To find which pages exist on a site, use supadata_map; to fetch many pages at once, use supadata_crawl. Costs 1 credit. |
supadata_transcript | read | Extract transcript from a video or file URL. For large files, returns a jobId instead of the transcript directly - use supadata_check_transcript_status with that jobId to poll for results. |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
console.log(`[MCP] Calling Supadata: ${method} ${path}, Key length: ${apiKey?.length ?? 0}`);console.log(`Received API Key via header (length: ${apiKey.length})`);console.log(`[OAuth] Stripping resource param from token exchange: ${params.get('resource')}`);@cloudflare/workers-oauth-provider, @modelcontextprotocol/sdk, @supadata/js, dotenv, hono, jose, zod, @cloudflare/workers-types
Gates applied: no_behavioural_pass.
1ada410b6111full audit observations/trust-audit/mcp-server/supadata-ai__supadata.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 1ada410b6111 | CAUTION | B | 89 | first audit |
Questions
What is the Supadata MCP server?
Official Supadata MCP Server - Adds powerful video & web scraping to Cursor, Claude and any other LLM clients.
What tools does Supadata expose?
9 in total: 8 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Supadata safe to connect to an agent?
With care. The audit graded it B (89/100) and found 4 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does Supadata need?
It reads SUPADATA_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Supadata run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @supadata/mcp at 1.3.1.
How current is this page?
The grade is for one exact copy of the source (1ada410b6111), read on 2026-10-07. The repository is watched and re-audited when it changes.