# Remotion MCP Editor

An always-on, data-driven Remotion editing and rendering engine exposed through Streamable HTTP MCP. Agents edit validated timeline data; the service never exposes source-code or shell access.

## Capabilities

- Revisioned projects stored in SQLite WAL mode
- Video, image, text, and audio timeline items
- Trim, split, move, reorder, layers, transforms, fades, and transitions
- HTTPS asset imports and private streamed uploads
- Serial asynchronous H.264/AAC and PNG rendering
- Private output downloads, cancellation, retention, backups, and restart recovery
- Bearer authentication behind a loopback-only Hostinger SSH gateway

## MCP tools

`get_service_status`, `list_projects`, `create_project`, `get_project`, `archive_project`, `apply_project_edits`, `import_asset_from_url`, `list_assets`, `start_render`, `list_renders`, and `cancel_render`.

Every `apply_project_edits` call requires the current project revision. Calls are atomic: invalid operations or stale revisions leave the project unchanged.

## Local development

```powershell
npm install
npm run typecheck
npm test
npm run build
npm run bundle:remotion
```

Set `DATA_DIR`, `REMOTION_TOKEN_SHA256`, and `REMOTION_LICENSE_KEY`, then start `npm run start:api` and `npm run start:worker` in separate terminals.

## Production layout

- Repository release: `/opt/mcp-gateway/remotion-editor/releases/<commit>`
- Current release symlink: `/opt/mcp-gateway/remotion-editor/current`
- Root-readable environment: `/opt/mcp-gateway/remotion-editor/shared/.env`
- Persistent data: `/var/lib/remotion-mcp-editor`
- VPS loopback port: `127.0.0.1:18081`
- Desktop MCP URL: `http://127.0.0.1:18081/remotion/mcp/`

The VPS does not need GitHub credentials. `scripts/deploy.ps1` requires a clean Git commit, transfers a Git archive over SSH, builds a commit-tagged image, and retains the previous release for `scripts/rollback.ps1`.

## Security

The raw bearer token remains in the local `REMOTION_MCP_TOKEN` user environment variable. Only its SHA-256 verifier is stored on the VPS. Ports are bound to loopback, gateway access logs are disabled, URL imports reject non-HTTPS and private/reserved destinations, and all storage paths are containment-checked.

The default configuration is licensed as `free-license` for the approved team size of three or fewer people. Reassess the Remotion license before expanding the team or product scope.