Back to Browse

Vivideo Toolchain MCP Server

Developer ToolsModerate5.2MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

AI video generation via the Vivideo API: auto or manual mode, avatars, voices, brand kits.

About

AI video generation via the Vivideo API: auto or manual mode, avatars, voices, brand kits.

Remote endpoints: streamable-http: https://api.vivideo.ai/mcp

Security Report

5.2
Moderate5.2Moderate Risk

Well-designed MCP server with strong security fundamentals. Authentication is properly required and enforced, credentials are handled securely with comprehensive redaction, and the codebase demonstrates good input validation through Zod schemas. Minor code quality observations around error handling breadth and logging do not materially impact security. Supply chain analysis found 2 known vulnerabilities in dependencies (2 critical, 0 high severity). Package verification found 1 issue (1 critical, 0 high severity).

7 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

HTTP Network Access

Connects to external APIs or services over the internet.

process_spawn

Check that this permission is expected for this type of plugin.

Unverified package source

We couldn't verify that the installable package matches the reviewed source code. Proceed with caution.

What You'll Need

Set these up before or after installing:

Your Vivideo API key (vv_live_...), created in the app under Settings > More > API Keys.Required

Environment variable: VIVIDEO_API_KEY

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

Vivideo Toolchain

The developer + agent integration layer for the Vivideo API — a shared client, an MCP server, a CLI, and Skills. Agents are a primary user, not an afterthought.

Everything sits on top of the public API (the source of truth). No backend business logic is duplicated here — the toolchain only adds client-side ergonomics and guardrails.

vivideo-toolchain/            npm workspaces monorepo (TypeScript)
├── packages/core   @vivideo/core   one typed API client + guardrails (shared)
├── packages/mcp    @vivideo/mcp    MCP server (stdio) — 13 agent tools
├── packages/cli    @vivideo/cli    `vivideo` CLI — humans, scripts, CI, agents
├── skills/                          reusable agent Skills (SKILL.md)
└── docs/                            installation, configuration, workflows

Architecture

One client, one set of types, derived from packages/core/openapi.yaml. The MCP server and CLI both call @vivideo/core — there is exactly one representation of each request/response, so the tools, CLI, docs and OpenAPI stay consistent.

@vivideo/core adds only client-side concerns, never business logic:

GuardrailWhat it does
Rate limitingToken-bucket cap on request rate (default 8/s) — the client can't become a request flood.
Concurrency capSemaphore limits in-flight requests (default 4).
Bounded retriesRetries only retryable failures, with full-jitter backoff, capped attempts.
Honors Retry-AfterOn 429 it waits the API-specified delay before retrying.
IdempotencyEvery video-create sends an Idempotency-Key; retries reuse it → no duplicate charges.
TimeoutsPer-request AbortController timeout (default 30s).
Safe waitingwaitForVideo polls at the API's suggested interval, with a hard timeout — never a while(true).
Secret redactionAPI keys / signing secrets are stripped from every log, error, and output.

These complement — and never bypass — the API's own auth, rate limits, idempotency, credit checks, premium gates, ownership and error model.

Quick start

# from the repo (until packages are published to npm)
npm install
npm run build

# authenticate (stored 0600 in ~/.vivideo/config.json), or use VIVIDEO_API_KEY
export VIVIDEO_API_KEY="vv_live_..."   # from https://app.vivideo.ai/account/api-keys

# CLI
node packages/cli/dist/index.js account
node packages/cli/dist/index.js create auto --prompt "A 20s product teaser" --wait

# MCP server (stdio) — point an MCP client at this command
node packages/mcp/dist/index.js

Once published: npm i -g @vivideo/cli (gives vivideo), and npx @vivideo/mcp for the server.

Docs

Authentication & security

  • Keys are read from (in order): explicit option → VIVIDEO_API_KEY env → ~/.vivideo/config.json (written owner-only 0600).
  • The key is never printed — all output passes through secret redaction; configure stores it without echoing it.
  • Keys are account-scoped secrets. Keep them server-side; one per integration so a leak is revocable in isolation.

Not included (honest scope)

  • Cancellation — the public API has no cancel endpoint, so no cancel tool/command is offered. Failed/stuck renders are auto-refunded by the API.
  • Agent/chat mode — not exposed by the public API, so not in the toolchain.
  • Nothing here publishes to npm, provisions DNS, or deploys — those are external steps (see the final section of docs/mcp.md).

Development

npm run build       # build all three packages (tsc -b)
npm run typecheck   # type-check the whole workspace
npm test            # vitest

Requires Node ≥ 18.17.

Reviews

No reviews yet

Be the first to review this server!