Skip to main content
Glama
Sign In
tubemind-secure-mcp

tubemind-secure-mcp

by dewtech-technologies
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

🎯 Why tubemind-secure-mcp?

Turn Claude into a YouTube growth strategist — without ever handing it your raw OAuth tokens.

  • ⚡ Plug-and-play with Claude Desktop — drop one config block, get 18 production tools.

  • 🔐 Secure by default — tokens encrypted at rest (AES-256-GCM), SSRF guard, rate limiting, audit log, Zod-validated inputs. OWASP Top 10 mapped end-to-end.

  • 📊 Real data, not scraping — official YouTube Data API v3 + YouTube Analytics API. Brand Accounts supported.

  • 🧠 Beyond raw API — built-in heuristics for CTR, retention, keyword difficulty, content gaps, hook angles and N-day content calendars.

  • đŸȘ¶ Tiny footprint — 3 runtime deps (@modelcontextprotocol/sdk, googleapis, zod). Node ≄ 20.

Related MCP server: MCP YouTube Intelligence

✹ Overview

tubemind-secure-mcp is a Model Context Protocol (MCP) server that gives Claude Desktop (and any MCP client) 18 production-grade tools for working with YouTube:

  • 🔍 Search & SEO — trending topics, keyword stats, tag suggestions

  • đŸ“ș Video & Channel — list videos, read/update metadata, get tags

  • 📊 Analytics — channel analytics (views, watch time, retention) via YouTube Analytics API

  • 🏆 Benchmark — compare your channel against competitors

  • 🧠 Heuristics — keyword difficulty, title patterns, content gaps, hook angles, CTR potential, retention signals, content calendar

  • đŸ•”ïž Competitor research — competitor video discovery

Built secure by design: OAuth2 (Brand Account ready), AES-256-GCM token encryption at rest, SSRF guard, rate limiting, audit logging, Zod input validation — mapped to OWASP Top 10.

📩 Installation

# Global install
npm install -g tubemind-secure-mcp

# Or run on demand
npx tubemind-secure-mcp

Requires Node.js ≄ 20.

🔐 OAuth Setup (one-time)

YouTube APIs need an OAuth2 token. The package ships with an auth server that walks you through it.

1) Create OAuth credentials in Google Cloud

  1. Go to Google Cloud Console → APIs & Services → Credentials

  2. Enable YouTube Data API v3 and YouTube Analytics API

  3. Create OAuth 2.0 Client ID → Web application

  4. Authorized redirect URI: http://localhost:4000/oauth/callback

  5. Copy the Client ID and Client Secret

2) Configure environment

Copy .env.example to .env and fill in:

YOUTUBE_CLIENT_ID=your-client-id.apps.googleusercontent.com
YOUTUBE_CLIENT_SECRET=your-client-secret
YOUTUBE_REDIRECT_URI=http://localhost:4000/oauth/callback

# Generate with: openssl rand -hex 32
TOKEN_ENCRYPTION_KEY=your-64-char-hex-key

RATE_LIMIT_PER_MINUTE=60
REQUEST_TIMEOUT_MS=10000
AUDIT_LOG_PATH=./logs/audit.log
NODE_ENV=production

3) Run the OAuth flow

pnpm auth
# or: npx tsx --env-file=.env src/auth-server.ts

Open http://localhost:4000, sign in with the Google account that owns the channel (Brand Accounts supported), authorize, and the encrypted token is saved to ./tokens/youtube.token.json.

đŸ€– Use with Claude Desktop

Add to claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "tubemind": {
      "command": "npx",
      "args": ["-y", "tubemind-secure-mcp"],
      "env": {
        "YOUTUBE_CLIENT_ID": "your-client-id.apps.googleusercontent.com",
        "YOUTUBE_CLIENT_SECRET": "your-client-secret",
        "YOUTUBE_REDIRECT_URI": "http://localhost:4000/oauth/callback",
        "TOKEN_ENCRYPTION_KEY": "your-64-char-hex-key",
        "RATE_LIMIT_PER_MINUTE": "60",
        "REQUEST_TIMEOUT_MS": "10000",
        "AUDIT_LOG_PATH": "./logs/audit.log",
        "NODE_ENV": "production"
      }
    }
  }
}

Restart Claude Desktop. The 18 tools will appear automatically.

đŸ› ïž Tools

Category

Tool

Description

Search

search_trending_topics

Discover trending topics by region/category

get_keyword_stats

Search volume signals for keywords

suggest_tags

Tag recommendations from a seed

Video

get_video_tags

Read tags from a video

update_video_metadata

Update title/description/tags (write scope)

list_channel_videos

Paginate channel uploads

Analytics

get_channel_analytics

Views, watch time, retention (Analytics API)

score_best_publish_window

Best day/hour heatmap to publish

Benchmark

benchmark_channel

Compare channel vs. peers

Heuristics

estimate_keyword_difficulty

Difficulty score 0–100

analyze_title_patterns

Common patterns in top videos

detect_content_gaps

Topics competitors cover that you don't

Heuristics+

estimate_ctr_potential

CTR estimate from title/thumbnail signals

suggest_hook_angles

Hook angles for a topic

find_trending_keywords

Rising-momentum keywords

analyze_retention_signals

Retention-shaping factors

generate_content_calendar

N-day content plan

Competitor

get_competitor_videos

Top videos from a competitor channel

All inputs are validated with Zod. All errors return safe messages (stack traces only when NODE_ENV=development).

🔒 Security

tubemind-secure-mcp is built secure-by-default. See SECURITY.md for the full posture mapped to OWASP Top 10.

Control

Implementation

A01 — Broken Access Control

OAuth2 scopes least-privilege, audit log per call

A02 — Cryptographic Failures

AES-256-GCM at rest for tokens, secrets via env only

A03 — Injection

Zod schemas on every tool input

A04 — Insecure Design

Rate limit, request timeout, SSRF guard (host whitelist)

A05 — Misconfiguration

.env.example template, no defaults that leak

A07 — AuthN Failures

OAuth2 PKCE-style flow, encrypted token storage

A08 — Software/Data Integrity

Pinned deps, pnpm audit in CI, dependabot

A09 — Logging Failures

Audit log of every tool call (timestamp, tool, success)

A10 — SSRF

Outbound calls restricted to googleapis.com family

Found a vulnerability? Email wleandro.oliveira@gmail.com — 72h response.

🧰 Local development

pnpm install
pnpm dev          # tsx watch on src/index.ts
pnpm build        # tsc → dist/
pnpm typecheck
pnpm test
pnpm audit:security

📜 License

MIT © Wanderson Leandro de Oliveira / Dewtech

Available Tools

18 tools
analyze_retention_signalsA

Analisa proxies de retenção (engagement rate, amplification, duração, capítulos) dos top vídeos do nicho. Identifica padrÔes estruturais dos vídeos com alta retenção e gera recomendaçÔes de roteiro.

Inputs: niche (required), minViews, regionCode, videoCount.

analyze_title_patternsA

Analisa os padrĂ”es estruturais dos tĂ­tulos dos vĂ­deos mais bem-sucedidos em um nicho. Identifica fĂłrmulas recorrentes (nĂșmero, pergunta, como-fazer, contraste, urgĂȘncia) e retorna os templates que dominam o nicho.

Inputs: niche (required), regionCode, videoCount.

benchmark_channelA

Compara seu canal autenticado com 1 a 3 canais concorrentes. Retorna tabela comparativa com inscritos, views totais, views mĂ©dias por vĂ­deo, engagement rate e views/inscritos. Mostra onde vocĂȘ estĂĄ Ă  frente e onde estĂĄ atrĂĄs.

Inputs: competitorChannelIds (required).

detect_content_gapsA

Identifica subtĂłpicos do nicho que estĂŁo sendo buscados mas pouco explorados pelos criadores. Classifica cada subtĂłpico como Gap Real (entre agora), Oportunidade ou Saturado. Equivalente ao "Content Gaps" do VidIQ.

Inputs: niche (required), regionCode, yourChannelId.

estimate_ctr_potentialA

Estima o CTR potencial de atĂ© 5 tĂ­tulos candidatos usando heurĂ­sticas de copywriting. Pontua cada tĂ­tulo de 0–100 e classifica como Alto, MĂ©dio ou Baixo potencial. Lista pontos positivos e melhorias por tĂ­tulo.

Inputs: niche (required), titles (required), regionCode.

estimate_keyword_difficultyA

Calcula um score de dificuldade (0–100) para ranquear um vídeo em uma keyword no YouTube. Analisa views/dia, tamanho dos canais concorrentes e idade dos vídeos ranqueados. Substitui o "Competition Score" do VidIQ sem dados proprietários.

Inputs: keyword (required), maxVideos, regionCode.

find_trending_keywordsA

Detecta keywords emergentes no nicho analisando padrÔes de vídeos recentes, views e tamanho dos canais. Classifica cada keyword como Emergente, Crescendo ou Eståvel.

Inputs: niche (required), regionCode, maxKeywords.

generate_content_calendarA

Gera um calendĂĄrio de conteĂșdo de 14 a 30 dias para o nicho. Identifica gaps e keywords emergentes, sugere tĂ­tulos usando padrĂ”es dos top vĂ­deos e organiza por semana com dias e horĂĄrios ideais.

Inputs: niche (required), periodDays, regionCode, postsPerWeek, +1 more.

get_channel_analyticsB

Retorna métricas reais do canal autenticado via YouTube Analytics API: views, likes, comentårios, inscritos ganhos, minutos assistidos e duração média. Agrupa por dia no período informado.

Inputs: endDate (required), startDate (required), metrics.

get_competitor_videosA

Lista os vĂ­deos de um canal concorrente com tĂ­tulo, views, likes, duração e data. Útil para analisar estratĂ©gia de conteĂșdo de competidores. Requer o Channel ID (começa com UC).

Inputs: channelId (required), order, maxResults.

get_keyword_statsA

Analisa uma keyword no YouTube: retorna os top vĂ­deos ranqueados, estimativa de dificuldade baseada em tamanho dos canais e idade dos vĂ­deos, e sugestĂ”es de Ăąngulos com menor concorrĂȘncia.

Inputs: keyword (required), maxVideos, regionCode.

get_video_tagsA

Extrai as tags de qualquer vĂ­deo pĂșblico do YouTube pelo ID do vĂ­deo.

Inputs: videoId (required).

list_channel_videosA

Lista os vídeos de um canal YouTube com título, views, likes e data de publicação. Use channelId para Brand Accounts (ex: canal @dewtech = UC_x33Gz4LvnOZuC_4v7Qucg). Sem channelId usa o canal da conta autenticada.

Inputs: order, channelId, maxResults.

score_best_publish_windowA

Analisa os vĂ­deos do canal autenticado e retorna o melhor dia e horĂĄrio para publicar novos vĂ­deos, baseado em views/dia dos vĂ­deos jĂĄ publicados. Agrupa por dia da semana + faixa horĂĄria e retorna top 3 melhores e 2 piores slots.

Inputs: videoCount.

search_trending_topicsA

Busca vĂ­deos em alta no YouTube para um tema ou keyword. Retorna tĂ­tulo, canal, views e link de cada vĂ­deo encontrado.

Inputs: query (required), order, maxResults, regionCode.

suggest_hook_anglesA

Gera 5 ùngulos de gancho (hook) para a abertura de um vídeo. Usa padrÔes detectados nos vídeos mais populares do tópico para priorizar o gancho mais eficaz no nicho.

Inputs: niche (required), videoTopic (required), regionCode, targetAudience.

suggest_tagsA

Sugere tags estratégicas para um vídeo analisando os top vídeos que ranqueiam para uma keyword. Extrai padrÔes de tags e agrupa por relevùncia.

Inputs: keyword (required), regionCode, videoCount.

update_video_metadataA

Aplica título, descrição e tags otimizados em um vídeo jå publicado no canal autenticado.

Inputs: tags (required), title (required), videoId (required), description (required), +1 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog


    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.7/5.0

    Scored across 18 tools

    Disambiguation3/5

    Most tools have distinct purposes, but list_channel_videos and get_competitor_videos are nearly identical (both list videos for a channel), and the trend/keyword research tools (search_trending_topics, find_trending_keywords, get_keyword_stats) overlap in functionality, which could cause misselection.

    Naming Consistency5/5

    All tool names follow a consistent verb_noun snake_case pattern (e.g., get_keyword_stats, analyze_title_patterns, generate_content_calendar), making them predictable and easy to distinguish.

    Tool Count3/5

    At 18 tools, the server is on the heavier side for a niche tool, but each tool serves a specific function within YouTube content optimization, so the count is still understandable.

    Completeness4/5

    The server covers most key aspects of YouTube SEO research, optimization, and publishing, but lacks video-level analytics and direct video retrieval, which are minor gaps given the tool's focus.

    Maintenance

    ActivityNo data
    ResponsivenessOutdated data

    Resources

    Related MCP Connectors

    Related MCP Servers

    • yt-fetch

      smith-nathanh
      F
      license
      Not graded
      quality
      D
      maintenance
      An MCP server that enables interaction with the YouTube Data API, allowing users to search videos, get video and channel details, analyze trends, and fetch video transcripts.
      -

    • MCP YouTube Intelligence

      JangHyuckYun
      A
      license
      A
      quality
      C
      maintenance
      An MCP server for intelligent YouTube video analysis that provides token-optimized summaries, sentiment analysis, and entity extraction from transcripts. It enables AI assistants to perform video reporting, channel monitoring, and comprehensive YouTube searches through structured data tools.
      10
      53
      Apache 2.0