kevinwatt/yt-dlp-mcp v0.10.1

on GitHub

Security

• Block SSRF via user-supplied URLs. Tools now accept only http/https URLs and reject hosts that resolve to loopback, private, link-local (including cloud metadata 169.254.169.254), CGNAT, multicast, or reserved addresses before yt-dlp is invoked.
• New YTDLP_ALLOW_PRIVATE_URLS=true opt-out for fetching media from your local network.

Upgrade notes

If you use this server to fetch media from localhost or a LAN host, set YTDLP_ALLOW_PRIVATE_URLS=true.

Thanks to @stunninghacker for reporting this (#33).

Install / upgrade:

npx @kevinwatt/yt-dlp-mcp@0.10.1