# com.mux/mcp

> The official MCP Server for the Mux API

- name: com.mux/mcp
- version: 12.8.0
- connection class: R2 (oauth_consent_once)
- trust: 76/100
- quality: 69/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.mux%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/com.mux%2Fmcp/tools

**An agent can connect after a one-time OAuth consent by a human.** Remote endpoint behind OAuth 2. Tokens stay with the agent; the registry only exposes the authorization metadata.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "mux": {
      "type": "http",
      "url": "https://mcp.mux.com",
      "headers": {
        "Authorization": "Basic ${MUX_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${MUX_TOKEN}`.

## Trust

- hygiene: 100
- liveness: 100
- freshness: 25
- provenance: 70
- drivers: +repository +dns-namespace -thin-description +reachable +uptime-100% -stale-397d
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 69/100 (needs work)

### protocol: n/a (weight 25)

- n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only)

### authorization: 83 (weight 15)

- pass `auth.prm`: Protected Resource Metadata (RFC 9728) published
- pass `auth.as_metadata`: authorization server metadata reachable
- warn `auth.cimd`: only Dynamic Client Registration, deprecated in 2026-07-28 in favour of CIMD
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- warn `tools.annotations`: only 1 of 2 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: execute (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); search_docs (destructiveHint, idempotentHint, openWorldHint)
- pass `tools.token_cost`: about 500 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history not recorded yet

### dependencies: 50 (weight 15)

- pass `deps.known_vulns`: no known advisory in 142 resolved packages
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later
- warn `deps.resolvable`: the dependency graph of @mux/mcp@12.8.0 resolved with errors, so advisories may be missing

- tools: 2, about 500 tokens to load them all
- badge: [![protogrid quality](https://protogrid.dev/badge/com.mux/mcp.svg)](https://protogrid.dev/servers/com.mux/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm @mux/mcp@12.8.0: incomplete, 141 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://mcp.mux.com (streamable-http, auth oauth2, reachable true, uptime30d 1)

## Packages

- npm @mux/mcp@12.8.0 secrets: MUX_TOKEN_ID, MUX_TOKEN_SECRET, MUX_SIGNING_KEY, MUX_PRIVATE_KEY

## Tools (2)

- `execute`: Runs JavaScript code to interact with the Mux API.

You are a skilled TypeScript programmer writing code to interface with the service.
Define an async function named "run" that takes a single parameter of an initialized SDK client and it will be run.
For example:

```
async function run(client) {
  const asset = await client.video.assets.create({ inputs: [{ url: 'https://storage.googleapis.com/muxdemofiles/mux-video-intro.mp4' }], playback_policies: ['public'] });

  console.log(asset.id);
}
```

You will be returned anything that your function returns, plus the results of any console.log statements.
Do not add try-catch blocks for single API calls. The tool will handle errors for you.
Do not add comments unless necessary for generating better code.
Code will run in a container, and cannot interact with the network outside of the given SDK client.
Variables will not persist between calls, so make sure to return or log any data you might need later.
Remember that you are writing TypeScript code, so you need to be careful with your types.
Always type dynamic key-value stores explicitly as Record<string, YourValueType> instead of {}.
- `search_docs`: Search SDK documentation to find methods, parameters, and usage examples for interacting with the API. Use this before writing code when you need to discover the right approach.