mcp-video

The server relies heavily on `ffmpeg` and `ffprobe` binaries, invoked via `child_process.spawn`. While path validation (`normalizePath`, `validateVideoPath`) is implemented to mitigate directory traversal in tool inputs, the inherent risk of spawning external processes exists. The web server's file upload (`src/web/server.ts`, `parseMultipart`) lacks explicit size limits, posing a potential denial-of-service vulnerability by allowing large file uploads to fill disk space. No apparent hardcoded secrets or obfuscation were found. The `OPENAI_API_KEY` is expected to be an environment variable for future transcription features.