critical

ai.smithery/ctaylor86-mcp-video-download-server

v1.0.0

Connect your video workflows to cloud storage. Organize and access video assets across projects wi…

MCP RegistrysmitheryFirst seen Feb 24, 2026Source

47

Total

19

Critical

10

High

18

Medium

Findings

unknown

criticalOB-004ObfuscationMedium ConfidenceLine 0

Zero-width character detected (potential hidden content)

Detected by automated pattern matching (rule OB-004) with medium confidence. May be a false positive.

    99: - **Processing**: Included in Smithery hosting
    100: 
>>> 101: ## 🏃‍♂️ Local Development
    102: 
    103: If you want to run locally for development:

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    23:             const childProcess = spawn('yt-dlp', args, {
    24:                 stdio: ['pipe', 'pipe', 'pipe'],
>>> 25:                 env: { ...process.env }
    26:             });
    27:             let stdout = '';

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    13:     ];
    14:     for (const envVar of requiredEnvVars) {
>>> 15:         if (!process.env[envVar]) {
    16:             throw new Error(`Missing required environment variable: ${envVar}`);
    17:         }

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    18:     }
    19:     return {
>>> 20:         endpoint: process.env.S3_ENDPOINT,
    21:         region: process.env.S3_REGION,
    22:         accessKeyId: process.env.S3_ACCESS_KEY_ID,

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    19:     return {
    20:         endpoint: process.env.S3_ENDPOINT,
>>> 21:         region: process.env.S3_REGION,
    22:         accessKeyId: process.env.S3_ACCESS_KEY_ID,
    23:         secretAccessKey: process.env.S3_SECRET_ACCESS_KEY,

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    20:         endpoint: process.env.S3_ENDPOINT,
    21:         region: process.env.S3_REGION,
>>> 22:         accessKeyId: process.env.S3_ACCESS_KEY_ID,
    23:         secretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
    24:         bucketName: process.env.S3_BUCKET_NAME,

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    21:         region: process.env.S3_REGION,
    22:         accessKeyId: process.env.S3_ACCESS_KEY_ID,
>>> 23:         secretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
    24:         bucketName: process.env.S3_BUCKET_NAME,
    25:         publicUrlBase: process.env.S3_PUBLIC_URL_BASE,

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    22:         accessKeyId: process.env.S3_ACCESS_KEY_ID,
    23:         secretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
>>> 24:         bucketName: process.env.S3_BUCKET_NAME,
    25:         publicUrlBase: process.env.S3_PUBLIC_URL_BASE,
    26:     };

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    23:         secretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
    24:         bucketName: process.env.S3_BUCKET_NAME,
>>> 25:         publicUrlBase: process.env.S3_PUBLIC_URL_BASE,
    26:     };
    27: };

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    218: });
    219: // Start server
>>> 220: const port = process.env.PORT ? parseInt(process.env.PORT) : 3000;
    221: server.listen(port, '0.0.0.0', () => {
    222:     console.error(`MCP Video Cloud Server running on HTTP port ${port}`);

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    247:     // Get configuration from environment variables
    248:     const config = {
>>> 249:         s3Endpoint: process.env.S3_ENDPOINT,
    250:         s3Region: process.env.S3_REGION,
    251:         s3AccessKeyId: process.env.S3_ACCESS_KEY_ID,

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    248:     const config = {
    249:         s3Endpoint: process.env.S3_ENDPOINT,
>>> 250:         s3Region: process.env.S3_REGION,
    251:         s3AccessKeyId: process.env.S3_ACCESS_KEY_ID,
    252:         s3SecretAccessKey: process.env.S3_SECRET_ACCESS_KEY,

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    249:         s3Endpoint: process.env.S3_ENDPOINT,
    250:         s3Region: process.env.S3_REGION,
>>> 251:         s3AccessKeyId: process.env.S3_ACCESS_KEY_ID,
    252:         s3SecretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
    253:         s3BucketName: process.env.S3_BUCKET_NAME,

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    250:         s3Region: process.env.S3_REGION,
    251:         s3AccessKeyId: process.env.S3_ACCESS_KEY_ID,
>>> 252:         s3SecretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
    253:         s3BucketName: process.env.S3_BUCKET_NAME,
    254:         s3PublicUrlBase: process.env.S3_PUBLIC_URL_BASE,

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    251:         s3AccessKeyId: process.env.S3_ACCESS_KEY_ID,
    252:         s3SecretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
>>> 253:         s3BucketName: process.env.S3_BUCKET_NAME,
    254:         s3PublicUrlBase: process.env.S3_PUBLIC_URL_BASE,
    255:     };

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    252:         s3SecretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
    253:         s3BucketName: process.env.S3_BUCKET_NAME,
>>> 254:         s3PublicUrlBase: process.env.S3_PUBLIC_URL_BASE,
    255:     };
    256:     // Validate required environment variables

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    263:     ];
    264:     for (const envVar of requiredEnvVars) {
>>> 265:         if (!process.env[envVar]) {
    266:             console.error(`Missing required environment variable: ${envVar}`);
    267:             process.exit(1);

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    4: import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
    5: // Get server URL from environment
>>> 6: const SERVER_URL = process.env.MCP_SERVER_URL || 'http://localhost:3000';
    7: // Define available tools
    8: const tools = [

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    11: 
    12: const app = express();
>>> 13: const PORT = process.env.PORT || 8081;
    14: 
    15: // CORS configuration for browser-based MCP clients

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: v�'��Z+a"{-j ژjڦ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��^��kj{�*m

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'��ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'��ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

highSC-005Suspicious CommandsMedium ConfidenceLine 0

Node.js child process spawning

Detected by automated pattern matching (rule SC-005) with medium confidence. May be a false positive.

>>> 1: import { spawn } from 'child_process';
    2: import { promises as fs } from 'fs';
    3: import { join } from 'path';

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'��ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

highSC-005Suspicious CommandsMedium ConfidenceLine 0

Node.js child process spawning

Detected by automated pattern matching (rule SC-005) with medium confidence. May be a false positive.

>>> 1: import { spawn } from 'child_process';
    2: import { promises as fs } from 'fs';
    3: import path from 'path';

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'��ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: v�'��Z+a"{-j ژjڦ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: v�'��Z+a"{-j ژjڦ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    90: // HTTP request helper
    91: async function makeRequest(endpoint, data) {
>>> 92:     const response = await fetch(`${SERVER_URL}${endpoint}`, {
    93:         method: 'POST',
    94:         headers: {

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.1 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    115: 
    116:       // Make GraphQL request
>>> 117:       const response = await fetch(graphqlUrl.toString(), {
    118:         method: 'POST',
    119:         headers: {

Report false positive

mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    148:       const filePath = path.join(this.tempDir, filename);
    149: 
>>> 150:       const mediaResponse = await fetch(downloadUrl, {
    151:         headers: { 'User-Agent': userAgent }
    152:       });

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.1 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.1 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.1 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

Scan History

Date	Risk	Findings	Files	Duration
Feb 26, 2026	critical	47	35	0.00s
Feb 24, 2026	critical	47	35	0.00s