TraktSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol (MCP) server that creates a bridge between AI language models and the Trakt.tv API, allowing LLMs to access real-time entertainment data and personal Trakt viewing history. Built with a domain-focused architecture using FastMCP, providing clean separation of concerns across authentication, shows, seasons, episodes, movies, people, user data, comments, search, and check-in functionality.
🖥️ An AI Experiment
Other than this paragraph, everything here has been generated by AI, including the code. I had a goal to learn more about MCP and have been playing a lot with Cursor, so it seemed like a natural next move to bring these together. The result was this project. All changes moving forward will also be done by AI.
📚 About MCP & Trakt
Model Context Protocol (MCP) enables AI models to interact with external systems through standardized tools and resources. Trakt.tv is a comprehensive platform for tracking TV shows and movies with 14+ million users and extensive APIs for developers.
🚀 Quick Start
Docker Quickstart
docker run -d --rm --name trakt_mcpserver \ -e TRAKT_CLIENT_ID=your_client_id \ -e TRAKT_CLIENT_SECRET=your_client_secret \ -v trakt_auth:/data \ -p 8080:8080 \ ghcr.io/wwiens/trakt_mcpserver:latest
Run with uvx (no clone, no install)
Requires uv installed.
uvx --from git+https://github.com/wwiens/trakt_mcpserver trakt-mcp
Pin to a release tag for reproducibility:
uvx --from git+https://github.com/wwiens/[email protected]
3342d198d325OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add trakt-mcp --env TRAKT_AUTH_TOKEN_PATH=${TRAKT_AUTH_TOKEN_PATH} --env TRAKT_CLIENT_SECRET=${TRAKT_CLIENT_SECRET} -- uvx trakt-mcp{
"mcpServers": {
"trakt-mcp": {
"command": "uvx",
"args": [
"trakt-mcp"
],
"env": {
"TRAKT_AUTH_TOKEN_PATH": "${TRAKT_AUTH_TOKEN_PATH}",
"TRAKT_CLIENT_SECRET": "${TRAKT_CLIENT_SECRET}"
}
}
}
}Exposed tools (5)
3 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
check_auth_status | read | return await check_auth_status() |
clear_auth | destructive | return await clear_auth() |
fetch_movie_ratings | read | # Validate parameters with Pydantic |
fetch_show_ratings | read | # Validate parameters with Pydantic |
start_device_auth | write | return await start_device_auth() |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (7)
clear_auth
.pre-commit-config.yaml
"../../users/settings",
"../../../admin",
"rank/../../../secrets",
"rank/../../etc/passwd",
pytest-asyncio, pip-audit, types-requests, types-setuptools
Gates applied: no_behavioural_pass.
3342d198d325full audit observations/trust-audit/mcp-server/wwiens__trakt.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 3342d198d325 | SAFE | B | 89 | first audit |
Questions
What tools does Trakt expose?
5 in total: 3 read-only, 1 that write, and 1 that can delete or overwrite (clear_auth). Every one is listed on this page with its risk.
Is Trakt safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Trakt need?
It reads TRAKT_AUTH_TOKEN_PATH and TRAKT_CLIENT_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (3342d198d325), read on 2026-10-08. The repository is watched and re-audited when it changes.