ffpipe — video conversion, probe & frames
by ffpipe.dev · remote · no sign-in to list tools · v0.2.0 · published by dev.ffpipe
Convert, probe, and split video into frames — real FFmpeg, paid per job with x402 on Base.
6 tools: 4 change things and 2 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things4Claude Code: ask: see these tools
- Only reads2Claude Code: allow: see these tools
5 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http ffpipe https://ffpipe.dev/mcpFindings
Matches of fixed checks, with the text they matched.
- Infoconvert_video
The input schema at properties.retryVoucher.description mentions "credential".
What this check looks forMatched text
inputSchema.properties.retryVoucher.description: "Retry-voucher credential (`uuid.hmac`) from a failed paid job's..."
- Infoprobe_media
The input schema at properties.retryVoucher.description mentions "credential".
What this check looks forMatched text
inputSchema.properties.retryVoucher.description: "Retry-voucher credential (`uuid.hmac`) from a failed paid job's..."
- Infoextract_frames
The input schema at properties.retryVoucher.description mentions "credential".
What this check looks forMatched text
inputSchema.properties.retryVoucher.description: "Retry-voucher credential (`uuid.hmac`) from a failed paid job's..."
- Infoget_job_status
The description mentions "credential".
What this check looks forMatched text
description: "...ExpiresAt but NEVER the uploadUrl (that credential is handed out exactly once, in the acce..."
- Infoget_balance
The description mentions "credential".
What this check looks forMatched text
description: "...input: it reads the account behind the credential your client already connected with. If..."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
6 tools
Changes things 4Claude Code: ask
convert_videoQueue an asynchronous video conversion: fetches sourceUrl (or, with upload: true, waits for you to PUT the bytes to the returned uploadUrl), converts to MP4 scaled to fit maxWidth …1 finding
Why it is in this group
- The name "convert_video" says "convert": a word for a change.
Findings
- Info
The input schema at properties.retryVoucher.description mentions "credential".
What this check looks forMatched text
inputSchema.properties.retryVoucher.description: "Retry-voucher credential (`uuid.hmac`) from a failed paid job's..."
Description, as the server wrote it Queue an asynchronous video conversion: fetches sourceUrl (or, with upload: true, waits for you to PUT the bytes to the returned uploadUrl), converts to MP4 scaled to fit maxWidth x maxHeight (defaults 1920x1080, cap 4096). Returns { jobId, status: "queued" | "awaiting_upload", statusUrl, uploadUrl?, uploadExpiresAt? } - poll with get_job_status (jobId + the t token from statusUrl) until finished/error. Download results within 24 hours. Paid: $0.02 USDC via x402 (base mainnet), or a convert-kind retryVoucher.
Annotations the server declares
- title: Convert video ($0.02)
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
extract_framesQueue an asynchronous frame extraction - the tool to reach for when you need to SEE a video: fetches sourceUrl (or, with upload: true, waits for you to PUT the bytes to the returne…1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
The input schema at properties.retryVoucher.description mentions "credential".
What this check looks forMatched text
inputSchema.properties.retryVoucher.description: "Retry-voucher credential (`uuid.hmac`) from a failed paid job's..."
Description, as the server wrote it Queue an asynchronous frame extraction - the tool to reach for when you need to SEE a video: fetches sourceUrl (or, with upload: true, waits for you to PUT the bytes to the returned uploadUrl) and extracts still frames as jpeg, webp or png. mode is REQUIRED and picks the sampling (all, every_nth, interval, keyframes, evenly_spaced, timestamps); there is no default because every candidate implies a rate you did not ask for. A finished job's resultUrl is a JSON MANIFEST: source display dimensions, fps, rotation, an echo of your parameters, frame_count, and one entry per frame with index, pts_time (seconds in the source) and its own download url on this gateway - fetch the manifest, then the frames you want. Need just ONE frame at a moment - a thumbnail, poster frame or screenshot at a given second? Use mode "timestamps" with a single value, e.g. timestamps=[5], format=jpeg; the result is still a one-entry manifest pointing at that image (if you would rather have the image bytes returned directly instead of via a manifest, tell us with leave_feedback - demand decides whether we add it). Up to 1000 frames per job; "all"/"interval" on a long source can exceed that and fail fast, so prefer interval, evenly_spaced or timestamps. Unreadable input, audio-only files and still images FAIL here (probe_media diagnoses those). Download within 24 hours. Paid: $0.01 USDC via x402 (base mainnet), or a frames-kind retryVoucher.
Annotations the server declares
- title: Extract video frames ($0.01)
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
leave_feedbackTell us what you needed.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Tell us what you needed. If ffpipe does not offer the operation you came for - another output format, extracting a frame, a different transformation entirely - say so here: these requests are aggregated and they drive directly what gets built next, so a one-line "I wanted X" is genuinely useful to us. Also the place for bug reports and any other feedback. Free, unauthenticated, and one-way: nothing is returned but an acknowledgement, and no job is created. Include jobId if a specific job prompted this (context only - it is not checked and is not required), and contact if you want a reply. Message limit 2000 characters.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
probe_mediaQueue an asynchronous media inspection: fetches sourceUrl (or, with upload: true, waits for you to PUT the bytes to the returned uploadUrl) and returns its technical metadata as a …1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
The input schema at properties.retryVoucher.description mentions "credential".
What this check looks forMatched text
inputSchema.properties.retryVoucher.description: "Retry-voucher credential (`uuid.hmac`) from a failed paid job's..."
Description, as the server wrote it Queue an asynchronous media inspection: fetches sourceUrl (or, with upload: true, waits for you to PUT the bytes to the returned uploadUrl) and returns its technical metadata as a downloadable file. In the default json format the result is the full raw analysis plus one added top-level "ffpipe_summary" object: container, duration_s, size_bytes, has_video, has_audio, video_codec, audio_codec, coded_width/height, display_width/height, rotation, fps, is_hdr, audio_channels, audio_sample_rate. USE display_width/display_height as the size the picture actually is - phones store portrait video as a landscape frame plus a rotation flag. A file that cannot be decoded is still a SUCCESS whose result carries the diagnosis. Returns { jobId, status, statusUrl, ... } - poll with get_job_status until finished/error, then download resultUrl within 24 hours. Paid: $0.01 USDC via x402 (base mainnet), or a probe-kind retryVoucher.
Annotations the server declares
- title: Inspect media ($0.01)
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
Only reads 2Claude Code: allow
get_balanceFree.1 finding
Why it is in this group
- The name "get_balance" says "get": a word for reading.
Findings
- Info
The description mentions "credential".
What this check looks forMatched text
description: "...input: it reads the account behind the credential your client already connected with. If..."
Description, as the server wrote it Free. Reports the credit balance of the account this client is connected to, plus what one credit is worth, what each operation costs in credits, the monthly free allowance and whether a card is on file to unlock it. Takes no input: it reads the account behind the credential your client already connected with. If you have a connected account, paid tools are funded from this balance and never present a payment challenge - so call this to find out how much work you can still queue, and top up at the account page named in the answer. Anonymous callers (x402 buyers, who pay per call instead) have no balance and get an unauthorized error; either way nothing here is charged.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_job_statusFree status lookup for a job accepted by convert_video / probe_media / extract_frames.1 finding
Why it is in this group
- The name "get_job_status" says "get": a word for reading.
Findings
- Info
The description mentions "credential".
What this check looks forMatched text
description: "...ExpiresAt but NEVER the uploadUrl (that credential is handed out exactly once, in the acce..."
Description, as the server wrote it Free status lookup for a job accepted by convert_video / probe_media / extract_frames. Requires the job's ownership token - the `t` query parameter of the statusUrl returned at acceptance (store the whole statusUrl; it cannot be regenerated). Status goes [awaiting_upload ->] queued -> finished | error; awaiting_upload jobs report uploadExpiresAt but NEVER the uploadUrl (that credential is handed out exactly once, in the acceptance result); finished jobs carry resultUrl/thumbnailUrl/durationMs (always served by this gateway, never a redirect; free to re-download within 24 hours of completion); a failed charged job (including one that could not be queued after payment) carries retryVoucher. A bad token and an unknown jobId both answer not_found, deliberately.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.2.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http ffpipe https://ffpipe.dev/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__ffpipe__get_job_status",
"mcp__ffpipe__get_balance"
],
"ask": [
"mcp__ffpipe__convert_video",
"mcp__ffpipe__probe_media",
"mcp__ffpipe__extract_frames",
"mcp__ffpipe__leave_feedback"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as ffpipe. Review it before you use it.