kleo-mcpBLOCK
Kleo: remote MCP server that turns a brief into a narrated 4K 60 fps film, realistic or animation, from Claude, ChatGPT, Cursor or any MCP client
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Kleo is a remote Model Context Protocol server that renders YouTube videos and Shorts. A user connects one URL to Claude, ChatGPT, Grok, Claude Code, Cursor, VS Code, OpenCode or Gemini CLI, presses one button to get in (no email, no password, no invite code) and asks for a video in plain language. The render runs on a GPU machine rented for that job only (Vast.ai) with the Keou motion-design engine; the result comes back as signed download links (MP4, .srt subtitles, thumbnail) that last 7 days.
The server runs entirely on Cloudflare (Workers + KV + D1 + R2 + Workers AI + Cron), free plan. Production address: https://mcp.kleooai.com/mcp (Streamable HTTP, OAuth 2.1; the Worker itself answers at https://kleo-mcp.plural-juice.workers.dev/mcp). The public site (../kleo-site) reads that address from its config.json.
Models
Connect
One button signs you in (no email, no password); 7 credits arrive with the a
65c28093b05dOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add keou-production --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ANTHROPIC_AUTH=${ANTHROPIC_AUTH} --env CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN} --env CONTAINER_API_KEY=${CONTAINER_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"keou-production": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"ANTHROPIC_AUTH": "${ANTHROPIC_AUTH}",
"CLOUDFLARE_API_TOKEN": "${CLOUDFLARE_API_TOKEN}",
"CONTAINER_API_KEY": "${CONTAINER_API_KEY}"
}
}
}
}Exposed tools (15)
13 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Kleo | read | Remote MCP server that renders YouTube videos and Shorts. |
Mara | read | |
kleo_account | read | |
kleo_adapt_prompt | read | |
kleo_cancel_job | read | |
kleo_create_video | write | |
kleo_generate_thumbnail | read | |
kleo_get_job | read | |
kleo_get_result | read | |
kleo_list_templates | read | |
kleo_redeem | read | |
kleo_storyboard_guide | read | |
kleo_upload_link | write | |
kleo_wait_for_video | read | |
mara | read | a photo of a woman with short blonde hair |
Trust audit
BLOCKgrade F · trust 49/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (12 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
return new Function(`return ${SRC.slice(from, to)}`)();new Function("window", "document", "globalThis_", SRC.replace("const ART = {};", "const ART = {}; globalThis_.__ART = ART;"))(win, win.document, box);KEY = os.path.expanduser("~/.ssh/id_ed25519_keou")onstart = ("mkdir -p /root/.ssh && echo %r >> /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys; "config={"ssh_key":"~/.ssh/id_ed25519_keou","protected_instance_ids":[]}~/.ssh ... urllib.request
print("SCARICATO", snapshot_download(model, max_workers=8, token=os.environ.get("HF_TOKEN") or None, ignore_patterns=skip), flush=True)log("helper up on http://127.0.0.1:8977")os.environ.setdefault("KLEO_API", "http://127.0.0.1:9")export const TINY_MP4_B64 = "AAAAIGZ0eXBpc29tAAACAGlzb21pc28yYXZjMW1wNDEAAAixbW9vdgAAAGxtdmhkAAAAAAAAAAAAAAAAAAAD6AAAA+gAAQAAAQAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAA
.vast.lock
.keou-layout-preview
const { backdropPlan, backdropSeed, BACKDROP_ZOOM } = new Function(pureBlock() + "\nreturn { backdropPlan, backdropSeed, BACKDROP_ZOOM };")();new Function("document", "window", "Image", "fetch", "console", filmSource)(document, win, FakeImage, fetchStub, consoleStub);const P = new Function(pureBlock() + `
return len(data) == size and hashlib.sha1(b"blob %d\0" % len(data) + data).hexdigest() == blob
const hash = createHash("sha1").update(`${judgeModel}\n${repeat}\n${judgeThinking}\n${prompt}`).digest("hex");const key = createHash("sha1").update(judgeModel + judgeThinking + JUDGE_VERSION).update(JSON.stringify(qs)).update(bytes).digest("hex");const key = createHash("sha1").update(judgeModel + judgeThinking + JUDGE_VERSION).update(`identity ${g.text}`).update(a).update(b).digest("hex");sb["scenes"][0]["image"] = "../../etc/passwd"
sb["scenes"][0]["shots"][0]["image"] = "../../etc/shadow"
const beacon = await m.handleBeacon(new Request("http://kleo.test/b", { method: "POST", headers: { "content-type": "text/plain" }, body: "p=/&l=en" }), env);assert.equal(beacon.status, 204);
assert.throws(() => checkRefUrl("https://192.168.1.4/a.png"), RefError);const inside = routes({ "https://a.example/q": redirectTo("https://127.0.0.1/x.jpg"), "https://127.0.0.1/x.jpg": imageAnswer(jpeg(43)) });Gates applied: no_behavioural_pass.
65c28093b05dfull audit observations/trust-audit/mcp-server/tonnooooo__kleo-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 65c28093b05d | BLOCK | F | 49 | first audit |
Questions
What is the kleo-mcp MCP server?
Kleo: remote MCP server that turns a brief into a narrated 4K 60 fps film, realistic or animation, from Claude, ChatGPT, Cursor or any MCP client
What tools does kleo-mcp expose?
15 in total: 13 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is kleo-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (49/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does kleo-mcp need?
It reads ANTHROPIC_API_KEY, ANTHROPIC_AUTH, CLOUDFLARE_API_TOKEN, CONTAINER_API_KEY, HF_TOKEN, IMAGE_API_KEY, INTERNAL_SECRET, KIE_API_KEY, KLEO_SECRET and PLAN_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does kleo-mcp run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as keou-production at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (65c28093b05d), read on 2026-10-11. The repository is watched and re-audited when it changes.