mcp-bunny-pro

MCP server for bunny.net Stream — import, upload, and fully manage videos, collections, captions, AI transcription, playback URLs and statistics from any MCP client (Claude Code, Claude Desktop, Cursor, …).

The headline operation is importing a video from a URL (import_video): Bunny pulls the file server-side, transcodes it and hosts it — you never move the bytes yourself.

Internal Strat tool — distributed as a plugin via the strat-skills marketplace after curation.

All tools carry MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) so clients can auto-confirm destructive ops (deletes, resolution cleanup) and fast-path read-only ones.

Tools (28)

Videos

| Tool | What it does | |------|--------------| | import_video | ⭐ Import a video by fetching it from a remote URL (server-side pull) | | create_video | Create an empty video object (step 1 of direct upload) | | upload_video | Upload bytes of a local file to a video object (step 2) | | list_videos | List videos with pagination / search / collection filter / ordering | | get_video | Full video details + encode status (poll to track transcoding) | | update_video | Update title, description, collection, chapters, moments or meta tags | | delete_video | Permanently delete a video | | delete_videos | Batch-delete many videos; reports per-id success/failure | | get_video_resolutions | Available/configured/storage resolutions (read before cleanup) | | set_thumbnail | Set the thumbnail from an image URL | | reencode_video | Trigger a full re-encode | | repackage_video | Regenerate streaming playlists/DRM without re-encoding | | cleanup_resolutions | Delete stored resolutions/originals to reclaim storage | | get_video_heatmap | Engagement heatmap (watch/rewatch/skip) | | get_video_statistics | Views, watch time and country breakdown over a date range | | transcribe_video | AI transcription → captions (optionally title/description) | | add_caption | Attach a caption track from a local .vtt/.srt or inline text | | delete_caption | Remove a caption track by language code |

Playback

| Tool | What it does | |------|--------------| | get_play_url | Build embed/iframe + direct-play URLs locally; optionally token-signed & expiring | | get_video_play_data | Full playback payload (HLS/MP4 URLs, captions, thumbnail), token-aware | | get_oembed | oEmbed metadata + ready-to-paste embed HTML for a video |

Collections

| Tool | What it does | |------|--------------| | list_collections | List collections (pagination / search / ordering) | | get_collection | Get a collection's details | | create_collection | Create a collection | | update_collection | Rename a collection | | delete_collection | Delete a collection (videos inside are kept) |

Libraries (account API)

| Tool | What it does | |------|--------------| | list_libraries | Discover the Video Libraries on your account + their ids | | get_library | Get one library's settings / resolutions / pull zone |

Installation

npx -y mcp-bunny-pro

Or, to hack on it from the workbench:

cd projects/mcp-bunny-pro
npm install
npm run build

Configuration

bunny.net uses two kinds of API key. Most tools only need the first.

| Env var | Required for | Where to find it | |---------|--------------|------------------| | BUNNY_STREAM_API_KEY | all video/collection/caption/stats tools | Dashboard → Stream → your library → API → API Key | | BUNNY_STREAM_LIBRARY_ID | default library (optional but recommended) | the numeric id of your library | | BUNNY_STREAM_TOKEN_KEY | only signing URLs (get_play_url/get_video_play_data) | Stream → library → Security → Token Authentication Key | | BUNNY_API_KEY | only list_libraries / get_library | Account Settings → API |

Copy .env.example → .env and fill it in (the .env is git-ignored). When BUNNY_STREAM_LIBRARY_ID is set you can omit libraryId on every call.

Run the test suite

npm test   # builds, then runs node:test (security guards, token signing, registry/annotations)

Test locally with the MCP inspector

BUNNY_STREAM_API_KEY=... BUNNY_STREAM_LIBRARY_ID=... \
  npx @modelcontextprotocol/inspector node dist/index.js

Add to Claude Code

In .claude/settings.json → mcpServers:

{
  "mcpServers": {
    "bunny": {
      "command": "npx",
      "args": ["-y", "mcp-bunny-pro"],
      "env": {
        "BUNNY_STREAM_API_KEY": "your-stream-key",
        "BUNNY_STREAM_LIBRARY_ID": "123456",
        "BUNNY_API_KEY": "your-account-key"
      }
    }
  }
}

Working from a local build instead? Swap the command for "command": "node", "args": ["projects/mcp-bunny-pro/dist/index.js"].

Add to Claude Desktop

~/Library/Application Support/Claude/claude_desktop_config.json (macOS) / %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "bunny": {
      "command": "npx",
      "args": ["-y", "mcp-bunny-pro"],
      "env": {
        "BUNNY_STREAM_API_KEY": "your-stream-key",
        "BUNNY_STREAM_LIBRARY_ID": "123456"
      }
    }
  }
}

Paste the same block into Cursor's MCP config to use it there.

Example prompts

• "Import this video into Bunny: https://example.com/promo.mp4 and put it in the Launch collection"
• "List my last 10 videos and show which are still encoding"
• "Transcribe video abcd-1234 to English and generate a title from it"
• "How many views did the library get in the last 7 days, by country?"

Security

• SSRF guard (import_video, set_thumbnail): source URLs must be https:// and may not point at private/loopback/link-local hosts (incl. cloud metadata 169.254.169.254). Forwarded headers are validated against header-injection. Set BUNNY_ALLOW_PRIVATE_URLS=1 to relax this for trusted internal sources.
• File-read confinement (upload_video, add_caption): set BUNNY_UPLOAD_DIR to restrict filePath to one directory. Without it, any absolute path the process can read is allowed — fine for single-user stdio, risky if the server is shared.
• includeAccessKey exposes a secret: list_libraries/get_library with includeAccessKey: true return each library's Stream API key — a long-lived secret — directly in the tool output, which then lives in the agent's conversation history and client logs. The response is wrapped in a _warning. Only enable it when you truly need the key, and rotate it if it may have leaked.

Notes

• Stream API host: https://video.bunnycdn.com; account API host: https://api.bunny.net.
• All requests authenticate via the AccessKey header.
• Transient failures (429 / 5xx / timeouts) are retried with exponential backoff.
• Local uploads are read into memory and sent as a single PUT; for multi-GB resumable uploads use Bunny's tus endpoint directly (not exposed as a tool here).

Strat Academy — Helbert Paranhos · curadoria única das publicações.