FFmpeg MCP servers and skills: what exists and which are safe to run

What is an FFmpeg MCP server?

FFmpeg is the free command line tool behind most video conversion. An MCP server wraps some of it as tools an AI client can call. FFmpeg itself must be installed on your computer. The server decides how much of FFmpeg the model can reach, and that is the useful way to sort them. We read each repository's README and, in two cases, its code on October 20, 2026. We did not install or run any of them, so this lists what they document, not how well they work. A skill, by contrast, is instructions Claude reads; the skills guide covers the difference.

• Raw command tools. The model writes the FFmpeg arguments, the server runs them and returns the output. Maximum flexibility, minimum guard rails.
• Fixed typed tools. The server offers named tools such as clip, resize or extract audio, with set parameters, and builds the command itself.
• Hosted APIs. A vendor runs FFmpeg in the cloud and the server submits jobs. Your footage leaves your computer.

For every other kind of video MCP server, such as desktop timelines, Resolve or Premiere, see the video editing MCP servers directory.

Which FFmpeg MCP servers exist?

The table covers the servers that rank for these searches, plus the most used. It is not complete: roughly ten more small or unlicensed repos turned up and are left out. Licence, stars and tool counts are as GitHub and each project's own README state them. Where GitHub detects no licence file, we say so.

Two things stand out. First, staleness: video-audio-mcp and egoist's ffmpeg-mcp last changed about 17 and 19 months before our check, while kinocut and ffmpeg-skill moved that week. Second, the only raw-command server we confirmed is tiny, with zero stars. Most public servers take the typed route. Hosted is the third kind: FFmpeg Micro runs a remote MCP server with OAuth, and its pricing page lists a free tier of 200 tokens, about 33 minutes of video, with paid plans by month. Footage goes to the vendor.

Counts are not quality. A server with 203 tools asks the model to pick the right one from a long list, and a server with two tools asks it to do almost everything itself through arguments. We have not tested whether either choice changes how often the model gets it right, so read the tool list against the jobs you actually do before you decide.

How to choose, in order: first the licence, because a repo with no licence file gives you no stated right to reuse it. Then the last commit, because FFmpeg flags and client behaviour both move and an untouched repo may not start. Then the kind: if you only need to convert, trim or pull audio, a handful of typed tools is plenty. If you want the model to chain many operations, a larger typed server such as kinocut, which says its operations are an allowlist and media paths are confined to a workspace, is closer to what you need. Both are the projects' own descriptions, which we did not verify.

What about an FFmpeg skill?

Two public repos use the word. ffmpeg-skill packages typed FFmpeg tools as scripts and also runs as an MCP server. Its README says nothing runs through a shell and no filter graph is accepted from the caller; that is its own claim, and its eval results are self-reported. The other, claude-ffmpeg-skill, is recipes only, and its README notes that Claude already knows ffmpeg and can handle common video and audio tasks without it. For skill basics and the other video skills, see the Claude video editing skills guide.

Is it safe to let an AI run FFmpeg?

It is as safe as the server's limits. A raw command tool lets the model choose every argument, and FFmpeg can read and write any path your user account can. If text hidden in a file or web page steers the model, the server is the only thing standing in the way.

Two public details show what that looks like. In one developer's May 2026 write-up of a raw run_ffmpeg prototype, the server's guard was that “only accepting commands that started with ffmpeg”. That is a prefix check, and it is the whole guard. And in video-creator/ffmpeg-mcp, the top-ranked repo for the search, the latest commit on May 20, 2026 is titled as a fix for an FFmpeg argument injection vulnerability (CWE-88). We read that commit and did not test it. We do not know whether the fix is complete or whether the flaw was ever exploited. Of video-audio-mcp, we only checked that its source calls subprocess.run seven times and never sets shell=True. We audited no other server, so their safety notes are their own claims.

The MCP specification says servers must validate all tool inputs and that there should always be a human able to deny tool calls. Practical rules that follow from it:

• Prefer typed tools over a raw command tool.
• Run on a copy of your footage, in a working folder.
• Read the server's code before you install it, especially how it builds commands.
• Never connect a tool that gives the model a shell across your whole disk.
• Keep your client set to ask before each tool call; see AI agent permissions.

None of this makes FFmpeg tools reckless. Typed tools with fixed parameters are a narrow door, and a narrow door is what you want when the caller is a model that can be misled. The risk grows with the freedom you hand over, so ask of every server the same three questions: does it run a shell, can the model pass a filter graph or free-form arguments, and where can it write? The READMEs of the maintained typed servers answer some of these, and reading the command-building code answers the rest.

To test a server on your own clips, the evaluation checklist gives a short plan.

A hosted server changes the question. With FFmpeg Micro you are not trusting a local program with your disk, but you are trusting a vendor with your footage and paying by usage. For private or client footage that trade usually decides it, and it is the same local-versus-cloud question covered in local vs cloud AI video editing.

Do you need a server at all?

Often not. Claude Code can run ffmpeg in your shell if it is installed. The write-up above is one person, one weekend and one test file, so treat it as an anecdote, but its finding was that Claude produced zero hallucinated FFmpeg flags across four sessions. The failures were wrong assumptions about where files were. That fits the README note quoted above: a server buys structure and guard rails, not FFmpeg knowledge. For how to ask Claude Code to run FFmpeg and what it costs, see the five ways to edit video with Claude Code.

When is FFmpeg through an agent enough?

It is enough when the job is defined up front and you can judge it by watching one finished file. It stops being enough when the edit is a judgement call.

One technical reason is frame accuracy. FFmpeg's documentation says that for input seeking, in most formats it is not possible to seek exactly, so it seeks to the closest point before the position, and with stream copy the extra segment is kept. A fast cut can start a little early. Re-encoding fixes that, at the cost of time.

When do you want a timeline instead?

We make Rushilo, so weigh this section accordingly. Rushilo is a local editor for Mac and Windows with an MCP server inside it, which your own Claude Code, Codex, Claude Desktop or Cursor drives. Every change is a named command in one undo history shared by you and the agent, the agent can read frames and transcripts, and per the 1.3.0 release notes it can run a preflight check before export. It is not built on FFmpeg. The app must stay open while the agent works, and your AI usage is billed by your provider. It costs from $19 once: Buy Rushilo, or follow the setup guide.

The verdict: for defined jobs, FFmpeg through an agent is enough, and a maintained typed server is the safer way to give it. For edits you need to see, fix and undo, use a timeline. Other agent-driven editors are compared in the Can Claude edit videos guide.

Patel, O. (2026, October 20). FFmpeg MCP servers and skills: what exists and which are safe to run. Rushilo. https://rushilo.com/blog/ffmpeg-mcp

About the author

Om Patel

Founder, Rushilo

Om Patel is the founder of Rushilo, a desktop video editor driven by the user's own AI, and of BigIdeasDB, a research platform that reads real complaints and reviews to help founders validate products. He writes Rushilo's research articles with the same method: primary sources, dated numbers and the words real users write.

• X (Twitter)
• BigIdeasDB