LeashIndex Get the report

Index / other

fcp-mcp — Final Cut Pro MCP Server

io-github-dreliq9-fcp-mcp declares 88 capabilities across 88 tools, with 2 critical issues.

99/100 exposureHigh exposure

Manifest recorded 2026-10-15 from tools/list answered by the PyPI package fcp-mcp==0.2.0 (published to PyPI as fcp-mcp, listed in the official MCP registry as io.github.dreliq9/fcp-mcp 0.2.0), run in an isolated container with no network access and placeholder credentials. The date changes only when the manifest does. Not verified by a maintainer.

Note. Installed with the MCP Python SDK held below version 2.0. With the newest SDK this version of the package stopped before it could list its tools.

Issues

These describe what this server's manifest declares. A product can provide controls that MCP has no way to express — token revocation, an admin console, audit logs — and this page cannot see them. The absence of a declaration is not evidence that a control is absent.

critical · no-revocation · All 88 tools

88 of 88 tools declare no way for the customer to switch them off once granted. This applies to every tool because MCP has no field in which to declare a revocation mechanism; the product may provide one outside MCP that a manifest cannot show.

critical · irreversible-uncapped · 3 of 88 tools

3 tools are classified as irreversible and declare no limit.

high · no-expiry · All 88 tools

88 of 88 tools declare no expiry. This applies to every tool because MCP has no field in which to declare an expiry; the product may provide one outside MCP that a manifest cannot show.

high · no-audit-trail · All 88 tools

88 of 88 tools declare no record of their actions that the customer can read. This applies to every tool because MCP has no field in which to declare an audit requirement; the product may provide one outside MCP that a manifest cannot show.

high · uncapped-write · 50 of 88 tools

50 tools can modify data and declare no limit.

low · uncapped-read · 35 of 88 tools

35 tools can read data and declare no limit.

Declared capabilities

How each tool was read. declared means the server's own annotation said so — self-reported and unverified. inferred is from the tool's name. assumed means nothing indicated either way.

ToolRead asBasis
fcpxml_parsewrite assumed
fcpxml_list_clipsread inferred
fcpxml_list_markersread inferred
fcpxml_analyze_pacingread inferred
fcpxml_detect_gapsread inferred
fcpxml_detect_flash_framesread inferred
fcpxml_detect_duplicatesread inferred
fcpxml_validateread inferred
fcpxml_list_effectsread inferred
fcpxml_list_rolesread inferred
fcpxml_timeline_statsread inferred
fcpxml_diffread inferred
fcpxml_add_markerwrite inferred
fcpxml_batch_add_markerswrite inferred
fcpxml_add_keywordwrite inferred
fcpxml_trim_clipwrite assumed
fcpxml_split_clipwrite assumed
fcpxml_delete_clipsdelete inferred
fcpxml_reorder_clipswrite assumed
fcpxml_add_transitionwrite inferred
fcpxml_change_speedwrite assumed
fcpxml_assign_rolewrite inferred
fcpxml_add_titlewrite inferred
fcpxml_add_audiowrite inferred
fcpxml_create_projectwrite inferred
fcpxml_create_timelinewrite inferred
fcpxml_auto_rough_cutwrite assumed
fcpxml_generate_montagewrite assumed
fcpxml_import_srtwrite inferred
fcpxml_import_edlread inferred
fcpxml_reformatwrite assumed
fcpxml_fix_flash_frameswrite assumed
fcpxml_fill_gapswrite assumed
fcpxml_remove_silencedelete inferred
fcpxml_batch_rename_clipswrite inferred
fcpxml_batch_assign_roleswrite inferred
fcpxml_batch_apply_transitionwrite inferred
fcpxml_qc_reportwrite assumed
fcpxml_check_media_linksread inferred
fcpxml_check_frame_ratesread inferred
fcpxml_check_audio_levelswrite assumed
fcpxml_check_safe_zonesread inferred
fcpxml_check_durationread inferred
fcp_list_motion_templatesread inferred
fcp_list_share_destinationsread inferred
fcp_discover_effectsread inferred
fcpxml_list_templatesread inferred
fcpxml_apply_templatewrite inferred
fcpxml_save_templatewrite assumed
fcp_is_runningread inferred
fcp_get_librariesread inferred
fcp_get_eventsread inferred
fcp_get_projectsread inferred
fcp_get_timeline_inforead inferred
fcp_get_app_stateread inferred
fcp_open_librarywrite assumed
fcp_import_xmlwrite assumed
fcp_export_xmlwrite assumed
fcp_playbackwrite assumed
fcp_navigatewrite assumed
fcp_select_toolwrite inferred
fcp_undowrite assumed
fcp_redowrite assumed
fcp_menu_commandwrite assumed
fcp_keyboard_shortcutsend inferred
fcp_sharewrite assumed
compressor_encodewrite assumed
compressor_list_settingsread inferred
fcpxml_export_resolvewrite assumed
fcpxml_export_fcp7write assumed
fcpxml_export_edlread inferred
media_inforead inferred
media_detect_silenceread inferred
media_detect_beatsread inferred
media_loudnessread inferred
media_extract_thumbnailwrite assumed
media_extract_thumbnailswrite assumed
media_list_streamsread inferred
media_scene_detectread inferred
media_extract_audiowrite assumed
media_audio_to_midiwrite assumed
puppet_create_rigwrite inferred
puppet_create_humanoid_rigwrite inferred
puppet_build_scenewrite assumed
puppet_animatewrite assumed
puppet_preset_motionwrite assumed
puppet_multi_scenewrite assumed
puppet_list_presetsread inferred
Answering this question about your own agent? The self-serve stack report applies the same reading to your own stack or server and gives you a dated document you can hand to a customer's security review. It is generated in your browser, with nobody to wait for. Buying one does not change this page, its score or its place in the index — see Independence.
Maintain this server? If this page misreads your manifest, or your server has changed, submit its current tools/list response and it will be re-scored and dated. Corrections are published alongside the original, not in place of it.