![\"npm](\"https://img.shields.io/npm/v/tubemind-secure-mcp?style=flat-square&color=CB3837&logo=npm\")
\n ![\"downloads\"/](\"https://img.shields.io/npm/dm/tubemind-secure-mcp?style=flat-square\")
\n ![\"OWASP\"/](\"https://img.shields.io/badge/security-OWASP_Top_10-5A67D8?style=flat-square\"){kind=icon}
\n ![\"MIT](\"https://img.shields.io/npm/l/tubemind-secure-mcp?style=flat-square&color=blue\")
\n ![\"MCP](\"https://img.shields.io/badge/MCP-1.26-5A67D8?style=flat-square\"){kind=icon}
\n\n YouTube intelligence, powered by Claude. Secure by design.
\n Model Context Protocol server with 18 tools for YouTube research, analytics, benchmarking and content strategy.\n
\n
\n ๐ฆ 18 tools ยท ๐ OAuth2 + AES-256-GCM ยท ๐ก๏ธ OWASP Top 10 ยท ๐ค Claude Desktop ready\n
\n\n---\n\n## ๐ฏ Why tubemind-secure-mcp?\n\n> Turn Claude into a **YouTube growth strategist** โ without ever handing it your raw OAuth tokens.\n\n- โก **Plug-and-play with Claude Desktop** โ drop one config block, get 18 production tools.\n- ๐ **Secure by default** โ tokens encrypted at rest (AES-256-GCM), SSRF guard, rate limiting, audit log, Zod-validated inputs. **OWASP Top 10** mapped end-to-end.\n- ๐ **Real data, not scraping** โ official YouTube Data API v3 + YouTube Analytics API. Brand Accounts supported.\n- ๐ง **Beyond raw API** โ built-in heuristics for CTR, retention, keyword difficulty, content gaps, hook angles and N-day content calendars.\n- ๐ชถ **Tiny footprint** โ 3 runtime deps (`@modelcontextprotocol/sdk`, `googleapis`, `zod`). Node โฅ 20.\n\n---\n\n## โจ Overview\n\n`tubemind-secure-mcp` is a **Model Context Protocol (MCP) server** that gives Claude Desktop (and any MCP client) **18 production-grade tools** for working with YouTube:\n\n- ๐ **Search & SEO** โ trending topics, keyword stats, tag suggestions\n- ๐บ **Video & Channel** โ list videos, read/update metadata, get tags\n- ๐ **Analytics** โ channel analytics (views, watch time, retention) via YouTube Analytics API\n- ๐ **Benchmark** โ compare your channel against competitors\n- ๐ง **Heuristics** โ keyword difficulty, title patterns, content gaps, hook angles, CTR potential, retention signals, content calendar\n- ๐ต๏ธ **Competitor research** โ competitor video discovery\n\nBuilt **secure by design**: OAuth2 (Brand Account ready), AES-256-GCM token encryption at rest, SSRF guard, rate limiting, audit logging, Zod input validation โ mapped to **OWASP Top 10**.\n\n---\n\n## ๐ฆ Installation\n\n```bash\n# Global install\nnpm install -g tubemind-secure-mcp\n\n# Or run on demand\nnpx tubemind-secure-mcp\n```\n\nRequires **Node.js โฅ 20**.\n\n---\n\n## ๐ OAuth Setup (one-time)\n\nYouTube APIs need an OAuth2 token. The package ships with an auth server that walks you through it.\n\n### 1) Create OAuth credentials in Google Cloud\n\n1. Go to [Google Cloud Console โ APIs & Services โ Credentials](https://console.cloud.google.com/apis/credentials)\n2. Enable **YouTube Data API v3** and **YouTube Analytics API**\n3. Create OAuth 2.0 Client ID โ **Web application**\n4. Authorized redirect URI: `http://localhost:4000/oauth/callback`\n5. Copy the **Client ID** and **Client Secret**\n\n### 2) Configure environment\n\nCopy `.env.example` to `.env` and fill in:\n\n```bash\nYOUTUBE_CLIENT_ID=your-client-id.apps.googleusercontent.com\nYOUTUBE_CLIENT_SECRET=your-client-secret\nYOUTUBE_REDIRECT_URI=http://localhost:4000/oauth/callback\n\n# Generate with: openssl rand -hex 32\nTOKEN_ENCRYPTION_KEY=your-64-char-hex-key\n\nRATE_LIMIT_PER_MINUTE=60\nREQUEST_TIMEOUT_MS=10000\nAUDIT_LOG_PATH=./logs/audit.log\nNODE_ENV=production\n```\n\n### 3) Run the OAuth flow\n\n```bash\npnpm auth\n# or: npx tsx --env-file=.env src/auth-server.ts\n```\n\nOpen `http://localhost:4000`, sign in with the Google account that owns the channel (Brand Accounts supported), authorize, and the encrypted token is saved to `./tokens/youtube.token.json`.\n\n---\n\n## ๐ค Use with Claude Desktop\n\nAdd to `claude_desktop_config.json`:\n\n**macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`\n**Windows:** `%APPDATA%\\Claude\\claude_desktop_config.json`\n\n```json\n{\n \"mcpServers\": {\n \"tubemind\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"tubemind-secure-mcp\"],\n \"env\": {\n \"YOUTUBE_CLIENT_ID\": \"your-client-id.apps.googleusercontent.com\",\n \"YOUTUBE_CLIENT_SECRET\": \"your-client-secret\",\n \"YOUTUBE_REDIRECT_URI\": \"http://localhost:4000/oauth/callback\",\n \"TOKEN_ENCRYPTION_KEY\": \"your-64-char-hex-key\",\n \"RATE_LIMIT_PER_MINUTE\": \"60\",\n \"REQUEST_TIMEOUT_MS\": \"10000\",\n \"AUDIT_LOG_PATH\": \"./logs/audit.log\",\n \"NODE_ENV\": \"production\"\n }\n }\n }\n}\n```\n\nRestart Claude Desktop. The 18 tools will appear automatically.\n\n---\n\n## ๐ ๏ธ Tools\n\n| Category | Tool | Description |\n|----------|------|-------------|\n| **Search** | `search_trending_topics` | Discover trending topics by region/category |\n| | `get_keyword_stats` | Search volume signals for keywords |\n| | `suggest_tags` | Tag recommendations from a seed |\n| **Video** | `get_video_tags` | Read tags from a video |\n| | `update_video_metadata` | Update title/description/tags (write scope) |\n| | `list_channel_videos` | Paginate channel uploads |\n| **Analytics** | `get_channel_analytics` | Views, watch time, retention (Analytics API) |\n| | `score_best_publish_window` | Best day/hour heatmap to publish |\n| **Benchmark** | `benchmark_channel` | Compare channel vs. peers |\n| **Heuristics** | `estimate_keyword_difficulty` | Difficulty score 0โ100 |\n| | `analyze_title_patterns` | Common patterns in top videos |\n| | `detect_content_gaps` | Topics competitors cover that you don't |\n| **Heuristics+** | `estimate_ctr_potential` | CTR estimate from title/thumbnail signals |\n| | `suggest_hook_angles` | Hook angles for a topic |\n| | `find_trending_keywords` | Rising-momentum keywords |\n| | `analyze_retention_signals` | Retention-shaping factors |\n| | `generate_content_calendar` | N-day content plan |\n| **Competitor** | `get_competitor_videos` | Top videos from a competitor channel |\n\nAll inputs are validated with **Zod**. All errors return safe messages (stack traces only when `NODE_ENV=development`).\n\n---\n\n## ๐ Security\n\n`tubemind-secure-mcp` is built secure-by-default. See [SECURITY.md](./SECURITY.md) for the full posture mapped to OWASP Top 10.\n\n| Control | Implementation |\n|---------|----------------|\n| **A01 โ Broken Access Control** | OAuth2 scopes least-privilege, audit log per call |\n| **A02 โ Cryptographic Failures** | AES-256-GCM at rest for tokens, secrets via env only |\n| **A03 โ Injection** | Zod schemas on every tool input |\n| **A04 โ Insecure Design** | Rate limit, request timeout, SSRF guard (host whitelist) |\n| **A05 โ Misconfiguration** | `.env.example` template, no defaults that leak |\n| **A07 โ AuthN Failures** | OAuth2 PKCE-style flow, encrypted token storage |\n| **A08 โ Software/Data Integrity** | Pinned deps, `pnpm audit` in CI, dependabot |\n| **A09 โ Logging Failures** | Audit log of every tool call (timestamp, tool, success) |\n| **A10 โ SSRF** | Outbound calls restricted to `googleapis.com` family |\n\n**Found a vulnerability?** Email **wleandro.oliveira@gmail.com** โ 72h response.\n\n---\n\n## ๐งฐ Local development\n\n```bash\npnpm install\npnpm dev # tsx watch on src/index.ts\npnpm build # tsc โ dist/\npnpm typecheck\npnpm test\npnpm audit:security\n```\n\n---\n\n## ๐ License\n\nMIT ยฉ [Wanderson Leandro de Oliveira](https://github.com/wleandrooliveira) / [Dewtech](https://github.com/dewtech-technologies)\n", "bytes": 7977, "sha": "a7c48110fc9ff495dbb40148c19573973339998a7ebc706ae15a96744150aa21", "repo_slug": "dewtech-technologies/tubemind-secure-mcp", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_dewtech_technologies_tubemind__d744db3d/readme" }