critical

zubeid-youtube-mcp-server

v1.0.0

YouTube MCP Server Implementation

npmzubeidhendricksFirst seen Feb 22, 2026

102

Total

Critical

High

Medium

Findings

unknown

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    216:    npm install
    217:    ```
>>> 218: 3. Copy `.env.example` to `.env`:
    219:    ```bash
    220:    cp .env.example .env

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    218: 3. Copy `.env.example` to `.env`:
    219:    ```bash
>>> 220:    cp .env.example .env
    221:    ```
    222: 4. Edit `.env` and add your YouTube API key

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    220:    cp .env.example .env
    221:    ```
>>> 222: 4. Edit `.env` and add your YouTube API key
    223: 5. Start the server:
    224:    ```bash

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    4: const server_1 = require("./server");
    5: // Check for required environment variables
>>> 6: if (!process.env.YOUTUBE_API_KEY) {
    7:     console.error('Error: YOUTUBE_API_KEY environment variable is required.');
    8:     console.error('Please set it before running this server.');

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    36:         this.youtube = google.youtube({
    37:             version: 'v3',
>>> 38:             auth: process.env.YOUTUBE_API_KEY
    39:         });
    40:         this.languageClient = new google.cloud.LanguageServiceClient();

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    35:         this.youtube = google.youtube({
    36:             version: 'v3',
>>> 37:             auth: process.env.YOUTUBE_API_KEY
    38:         });
    39:     }

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    26: class ChannelManagement {
    27:     constructor() {
>>> 28:         const apiKey = process.env.YOUTUBE_API_KEY;
    29:         if (!apiKey) {
    30:             throw new Error('YOUTUBE_API_KEY environment variable is not set.');

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    35:         this.youtube = google.youtube({
    36:             version: 'v3',
>>> 37:             auth: process.env.YOUTUBE_API_KEY
    38:         });
    39:     }

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    35:         this.youtube = google.youtube({
    36:             version: 'v3',
>>> 37:             auth: process.env.YOUTUBE_API_KEY
    38:         });
    39:     }

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    75:         this.youtube = google.youtube({
    76:             version: 'v3',
>>> 77:             auth: process.env.YOUTUBE_API_KEY
    78:         });
    79:     }

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    71:         this.youtube = google.youtube({
    72:             version: 'v3',
>>> 73:             auth: process.env.YOUTUBE_API_KEY
    74:         });
    75:     }

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    19:     }
    20:     // @ts-ignore - We know the SDK exists
>>> 21:     async getTranscript({ videoId, language = process.env.YOUTUBE_TRANSCRIPT_LANG || 'en' }) {
    22:         try {
    23:             // @ts-ignore - Library may not match types exactly

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    34:     }
    35:     // @ts-ignore - We know the SDK exists
>>> 36:     async searchTranscript({ videoId, query, language = process.env.YOUTUBE_TRANSCRIPT_LANG || 'en' }) {
    37:         try {
    38:             // @ts-ignore - Library may not match types exactly

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    23:         this.youtube = google.youtube({
    24:             version: "v3",
>>> 25:             auth: process.env.YOUTUBE_API_KEY
    26:         });
    27:         this.translate = new v2_1.Translate({

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    26:         });
    27:         this.translate = new v2_1.Translate({
>>> 28:             projectId: process.env.GOOGLE_PROJECT_ID,
    29:             key: process.env.GOOGLE_TRANSLATE_API_KEY
    30:         });

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    27:         this.translate = new v2_1.Translate({
    28:             projectId: process.env.GOOGLE_PROJECT_ID,
>>> 29:             key: process.env.GOOGLE_TRANSLATE_API_KEY
    30:         });
    31:     }

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    22: class PlaylistManagement {
    23:     constructor() {
>>> 24:         const apiKey = process.env.YOUTUBE_API_KEY;
    25:         if (!apiKey) {
    26:             throw new Error('YOUTUBE_API_KEY environment variable is not set.');

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    21: class VideoManagement {
    22:     constructor() {
>>> 23:         const apiKey = process.env.YOUTUBE_API_KEY;
    24:         if (!apiKey) {
    25:             throw new Error('YOUTUBE_API_KEY environment variable is not set. Please set it before running the application.');

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3: const server_1 = require("./server");
    4: // Check for required environment variables
>>> 5: if (!process.env.YOUTUBE_API_KEY) {
    6:     console.error('Error: YOUTUBE_API_KEY environment variable is required.');
    7:     console.error('Please set it before running this server.');

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    154:     // Log the server info
    155:     console.log(`Starting YouTube MCP Server v1.0.0`);
>>> 156:     console.log(`Environment: API Key ${process.env.YOUTUBE_API_KEY ? 'configured' : 'missing'}`);
    157:     // Start the server
    158:     await server.listen();

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    8: class ChannelService {
    9:     constructor() {
>>> 10:         const apiKey = process.env.YOUTUBE_API_KEY;
    11:         if (!apiKey) {
    12:             throw new Error('YOUTUBE_API_KEY environment variable is not set.');

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    8: class PlaylistService {
    9:     constructor() {
>>> 10:         const apiKey = process.env.YOUTUBE_API_KEY;
    11:         if (!apiKey) {
    12:             throw new Error('YOUTUBE_API_KEY environment variable is not set.');

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    13:      * Get the transcript of a YouTube video
    14:      */
>>> 15:     async getTranscript({ videoId, language = process.env.YOUTUBE_TRANSCRIPT_LANG || 'en' }) {
    16:         try {
    17:             // YoutubeTranscript.fetchTranscript only accepts videoId

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    30:      * Search within a transcript
    31:      */
>>> 32:     async searchTranscript({ videoId, query, language = process.env.YOUTUBE_TRANSCRIPT_LANG || 'en' }) {
    33:         try {
    34:             const transcript = await youtube_transcript_1.YoutubeTranscript.fetchTranscript(videoId);

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    49:      * Get transcript with timestamps
    50:      */
>>> 51:     async getTimestampedTranscript({ videoId, language = process.env.YOUTUBE_TRANSCRIPT_LANG || 'en' }) {
    52:         try {
    53:             const transcript = await youtube_transcript_1.YoutubeTranscript.fetchTranscript(videoId);

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    8: class VideoService {
    9:     constructor() {
>>> 10:         const apiKey = process.env.YOUTUBE_API_KEY;
    11:         if (!apiKey) {
    12:             throw new Error('YOUTUBE_API_KEY environment variable is not set.');

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��^��'��m��-��%��d