Tubemind Secure MCP

Name: Tubemind Secure MCP
Author: dewtech-technologies

by dewtech-technologiesversion 0.1.3i★ –iRuns on your computer

Registry nameio.github.dewtech-technologies/tubemind-secure-mcp

Install

Overview

Description from the maker (original English)

Secure MCP server for YouTube intelligence — 18 tools, OAuth2, OWASP Top 10 controls.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiVery new↓ 51/wk · ★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Marketing & social media
You need to fill in: YOUTUBE_CLIENT_ID, YOUTUBE_CLIENT_SECRET, TOKEN_ENCRYPTION_KEY

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: YOUTUBE_CLIENT_ID, YOUTUBE_CLIENT_SECRET, YOUTUBE_REDIRECT_URI, TOKEN_ENCRYPTION_KEY, RATE_LIMIT_PER_MINUTE, REQUEST_TIMEOUT_MS, AUDIT_LOG_PATH, NODE_ENV

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "tubemind-secure": {
      "command": "npx",
      "args": [
        "-y",
        "tubemind-secure-mcp"
      ],
      "env": {
        "YOUTUBE_CLIENT_ID": "your-value",
        "YOUTUBE_CLIENT_SECRET": "your-value",
        "YOUTUBE_REDIRECT_URI": "your-value",
        "TOKEN_ENCRYPTION_KEY": "your-value",
        "RATE_LIMIT_PER_MINUTE": "your-value",
        "REQUEST_TIMEOUT_MS": "your-value",
        "AUDIT_LOG_PATH": "your-value",
        "NODE_ENV": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add tubemind-secure --env YOUTUBE_CLIENT_ID=your-value --env YOUTUBE_CLIENT_SECRET=your-value --env YOUTUBE_REDIRECT_URI=your-value --env TOKEN_ENCRYPTION_KEY=your-value --env RATE_LIMIT_PER_MINUTE=your-value --env REQUEST_TIMEOUT_MS=your-value --env AUDIT_LOG_PATH=your-value --env NODE_ENV=your-value -- npx -y tubemind-secure-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "tubemind-secure": {
      "command": "npx",
      "args": [
        "-y",
        "tubemind-secure-mcp"
      ],
      "env": {
        "YOUTUBE_CLIENT_ID": "your-value",
        "YOUTUBE_CLIENT_SECRET": "your-value",
        "YOUTUBE_REDIRECT_URI": "your-value",
        "TOKEN_ENCRYPTION_KEY": "your-value",
        "RATE_LIMIT_PER_MINUTE": "your-value",
        "REQUEST_TIMEOUT_MS": "your-value",
        "AUDIT_LOG_PATH": "your-value",
        "NODE_ENV": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "tubemind-secure": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "tubemind-secure-mcp"
      ],
      "env": {
        "YOUTUBE_CLIENT_ID": "your-value",
        "YOUTUBE_CLIENT_SECRET": "your-value",
        "YOUTUBE_REDIRECT_URI": "your-value",
        "TOKEN_ENCRYPTION_KEY": "your-value",
        "RATE_LIMIT_PER_MINUTE": "your-value",
        "REQUEST_TIMEOUT_MS": "your-value",
        "AUDIT_LOG_PATH": "your-value",
        "NODE_ENV": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

YOUTUBE_CLIENT_ID required env
Google OAuth2 Client ID for YouTube Data API v3 + Analytics API
YOUTUBE_CLIENT_SECRET secret required env
Google OAuth2 Client Secret
YOUTUBE_REDIRECT_URI env
OAuth2 redirect URI (must match Google Cloud Console)
TOKEN_ENCRYPTION_KEY secret required env
64-char hex key for AES-256-GCM token encryption at rest. Generate with: openssl rand -hex 32
RATE_LIMIT_PER_MINUTE env
Max tool invocations per minute
REQUEST_TIMEOUT_MS env
HTTP request timeout (ms)
AUDIT_LOG_PATH env
Path to the audit log file
NODE_ENV env
production | development

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 9, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account dewtech-technologies, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Marketing & social mediai

More stars than 0% of the other 3631 servers in this category
Published to the registry more recently than 8% of the other 3631 servers in this category
Basic checks equal to or better than 100% of the other 3631 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Tubemind Secure MCP safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: YOUTUBE_CLIENT_ID, YOUTUBE_CLIENT_SECRET, TOKEN_ENCRYPTION_KEY

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.1.3) reached the registry 6 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: MCP YouTube Transcript, Google Analytics MCP, BibiGPT YouTube Video Summarizer

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

MCP YouTube Transcript

An MCP server retrieving transcripts of YouTube videos

by jkawamotoGrowing★ 495Updated 12 days ago

Runs on your computer

Install

Google Analytics MCP

GA4 MCP server for AI agents: schema discovery, server-side aggregation, analysis-ready defaults.

by surendranbGrowing↓ 1.1K/wk★ 244Updated 12 days ago

Runs on your computer

Install

BibiGPT YouTube Video Summarizer

AI video summarizer: summarize and transcribe YouTube, Bilibili, TikTok and podcast videos.

by JimmyLvGrowing★ 137Updated 12 days ago

Runs in the cloud✓ bibigpt.co

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

tubemind-secure-mcp

YouTube intelligence, powered by Claude. Secure by design.

Model Context Protocol server with 18 tools for YouTube research, analytics, benchmarking and content strategy.

📦 18 tools · 🔐 OAuth2 + AES-256-GCM · 🛡️ OWASP Top 10 · 🤖 Claude Desktop ready

🎯 Why tubemind-secure-mcp?

Turn Claude into a YouTube growth strategist — without ever handing it your raw OAuth tokens.

⚡ Plug-and-play with Claude Desktop — drop one config block, get 18 production tools.
🔐 Secure by default — tokens encrypted at rest (AES-256-GCM), SSRF guard, rate limiting, audit log, Zod-validated inputs. OWASP Top 10 mapped end-to-end.
📊 Real data, not scraping — official YouTube Data API v3 + YouTube Analytics API. Brand Accounts supported.
🧠 Beyond raw API — built-in heuristics for CTR, retention, keyword difficulty, content gaps, hook angles and N-day content calendars.
🪶 Tiny footprint — 3 runtime deps (@modelcontextprotocol/sdk, googleapis, zod). Node ≥ 20.

✨ Overview

tubemind-secure-mcp is a Model Context Protocol (MCP) server that gives Claude Desktop (and any MCP client) 18 production-grade tools for working with YouTube:

🔍 Search & SEO — trending topics, keyword stats, tag suggestions
📺 Video & Channel — list videos, read/update metadata, get tags
📊 Analytics — channel analytics (views, watch time, retention) via YouTube Analytics API
🏆 Benchmark — compare your channel against competitors
🧠 Heuristics — keyword difficulty, title patterns, content gaps, hook angles, CTR potential, retention signals, content calendar
🕵️ Competitor research — competitor video discovery

Built secure by design: OAuth2 (Brand Account ready), AES-256-GCM token encryption at rest, SSRF guard, rate limiting, audit logging, Zod input validation — mapped to OWASP Top 10.

📦 Installation

# Global install

npm install -g tubemind-secure-mcp

Or run on demand

npx tubemind-secure-mcp

Requires Node.js ≥ 20.

🔐 OAuth Setup (one-time)

YouTube APIs need an OAuth2 token. The package ships with an auth server that walks you through it.

1) Create OAuth credentials in Google Cloud

Go to Google Cloud Console → APIs & Services → Credentials
Enable YouTube Data API v3 and YouTube Analytics API
Create OAuth 2.0 Client ID → Web application
Authorized redirect URI: http://localhost:4000/oauth/callback
Copy the Client ID and Client Secret

2) Configure environment

Copy .env.example to .env and fill in:

YOUTUBE_CLIENT_ID=your-client-id.apps.googleusercontent.com

YOUTUBE_CLIENT_SECRET=your-client-secret YOUTUBE_REDIRECT_URI=http://localhost:4000/oauth/callback

Generate with: openssl rand -hex 32

TOKEN_ENCRYPTION_KEY=your-64-char-hex-key

RATE_LIMIT_PER_MINUTE=60 REQUEST_TIMEOUT_MS=10000 AUDIT_LOG_PATH=./logs/audit.log NODE_ENV=production

3) Run the OAuth flow

pnpm auth

or: npx tsx --env-file=.env src/auth-server.ts

Open http://localhost:4000, sign in with the Google account that owns the channel (Brand Accounts supported), authorize, and the encrypted token is saved to ./tokens/youtube.token.json.

🤖 Use with Claude Desktop

Add to claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

"mcpServers": { "tubemind": { "command": "npx", "args": ["-y", "tubemind-secure-mcp"], "env": { "YOUTUBE_CLIENT_ID": "your-client-id.apps.googleusercontent.com", "YOUTUBE_CLIENT_SECRET": "your-client-secret", "YOUTUBE_REDIRECT_URI": "http://localhost:4000/oauth/callback", "TOKEN_ENCRYPTION_KEY": "your-64-char-hex-key", "RATE_LIMIT_PER_MINUTE": "60", "REQUEST_TIMEOUT_MS": "10000", "AUDIT_LOG_PATH": "./logs/audit.log", "NODE_ENV": "production" } } } }

Restart Claude Desktop. The 18 tools will appear automatically.

🛠️ Tools

Category	Tool	Description
Search	`search_trending_topics`	Discover trending topics by region/category
	`get_keyword_stats`	Search volume signals for keywords
	`suggest_tags`	Tag recommendations from a seed
Video	`get_video_tags`	Read tags from a video
	`update_video_metadata`	Update title/description/tags (write scope)
	`list_channel_videos`	Paginate channel uploads
Analytics	`get_channel_analytics`	Views, watch time, retention (Analytics API)
	`score_best_publish_window`	Best day/hour heatmap to publish
Benchmark	`benchmark_channel`	Compare channel vs. peers
Heuristics	`estimate_keyword_difficulty`	Difficulty score 0–100
	`analyze_title_patterns`	Common patterns in top videos
	`detect_content_gaps`	Topics competitors cover that you don't
Heuristics+	`estimate_ctr_potential`	CTR estimate from title/thumbnail signals
	`suggest_hook_angles`	Hook angles for a topic
	`find_trending_keywords`	Rising-momentum keywords
	`analyze_retention_signals`	Retention-shaping factors
	`generate_content_calendar`	N-day content plan
Competitor	`get_competitor_videos`	Top videos from a competitor channel

All inputs are validated with Zod. All errors return safe messages (stack traces only when NODE_ENV=development).

🔒 Security

tubemind-secure-mcp is built secure-by-default. See SECURITY.md for the full posture mapped to OWASP Top 10.

Control	Implementation
A01 — Broken Access Control	OAuth2 scopes least-privilege, audit log per call
A02 — Cryptographic Failures	AES-256-GCM at rest for tokens, secrets via env only
A03 — Injection	Zod schemas on every tool input
A04 — Insecure Design	Rate limit, request timeout, SSRF guard (host whitelist)
A05 — Misconfiguration	`.env.example` template, no defaults that leak
A07 — AuthN Failures	OAuth2 PKCE-style flow, encrypted token storage
A08 — Software/Data Integrity	Pinned deps, `pnpm audit` in CI, dependabot
A09 — Logging Failures	Audit log of every tool call (timestamp, tool, success)
A10 — SSRF	Outbound calls restricted to `googleapis.com` family

Found a vulnerability? Email wleandro.oliveira@gmail.com — 72h response.

🧰 Local development

pnpm install

pnpm dev # tsx watch on src/index.ts pnpm build # tsc → dist/ pnpm typecheck pnpm test pnpm audit:security

Tubemind Secure MCP

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Marketing & social mediai

Common questions

Alternatives

MCP YouTube Transcript

Google Analytics MCP

BibiGPT YouTube Video Summarizer

README from the maker

🎯 Why tubemind-secure-mcp?

✨ Overview

📦 Installation

Or run on demand

🔐 OAuth Setup (one-time)

1) Create OAuth credentials in Google Cloud

2) Configure environment

Generate with: openssl rand -hex 32

3) Run the OAuth flow

or: npx tsx --env-file=.env src/auth-server.ts

🤖 Use with Claude Desktop

🛠️ Tools

🔒 Security

🧰 Local development

📜 License