Name: Gumlet
Author: gumlet

Gumlet MCP

Manage Gumlet video, live streams, analytics, and workspaces from an MCP client.

Tool-list grade A Remote · Streamable HTTP API key 94 tools v2.3.7

No reviews yet by gumlet The publisher’s own endpoint — this marketplace is not in the path

90/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

Manage Gumlet video, live streams, analytics, and workspaces from an MCP client.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http gumlet-mcp https://mcp.gumlet.com/mcp/v1 --header 'GUMLET_API_KEY: ${GUMLET_API_KEY}'

# 2 — ask your agent for something these tools do
#   insights_breakdown_data, insights_aggregated_data, list_sdks and 91 more

It needs GUMLET_API_KEY (Gumlet API key. Create one in the dashboard under Developer, API keys): this sends it in the GUMLET_API_KEY header from your environment, so export it first — its endpoint answers 401 without it.

Gumlet costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

gumlet1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.

Claude Codedeclared by this listing

This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it. Claude Code reads GUMLET_API_KEY (Gumlet API key. Create one in the dashboard under Developer, API keys) from your environment each time it connects and sends it in the GUMLET_API_KEY header — its endpoint answers 401 without it — so the key stays out of its config: export it in your shell profile (macOS, Linux), or run setx GUMLET_API_KEY … and open a new terminal (Windows).

claude mcp add --scope user --transport http gumlet-mcp https://mcp.gumlet.com/mcp/v1 --header 'GUMLET_API_KEY: ${GUMLET_API_KEY}'

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add — but its publisher asks for a key of their own on every call.

What it asks of you

It reaches a system of yours, so it needs your own credential rather than the publisher’s: GUMLET_API_KEY header — Gumlet API key. Create one in the dashboard under Developer, API keys.. You set it in your own client’s config, on your machine — this marketplace never holds it.

What it writes

One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.

What you approve

94 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Read viewer metrics for one workspace, grouped by a breakdown field, for a date range of at most 60 days. This does not change assets or delivery.

Parameter	Type	Required	Notes
date_range	object	no	The timeframe to get the data for. The maximum range between start_at and end_at is 60 days.
filters	array	no	Build segments of users using multiple filters on the data, value should be an exact match
breakdowns	array	no	Breakdown fields and metrics to retrieve data for. Supports 1 to 3 breakdowns per request.
workspace_id	string	no	The five to ten character unique identifier of the Gumlet workspace ID available on the Video Workspaces.

This endpoint retrieves aggregated data of the given metrics.

Parameter	Type	Required	Notes
aggregate	array	no	Aggregate multiple metrics at the same time
workspace_id	string	no	The unique identifier of the Gumlet workspace ID available on the Video Workspaces.
timeframe	object	no	The timeframe to get the data for. The maximum range between start_at and end_at is 60 days.
filters	array	no	Get aggregations for metrics with multiple filters, value should be an exact match

List official Gumlet client SDKs so agents can discover them. Python: pip install gumlet (https://pypi.org/project/gumlet/). Node.js: npm install @gumlet/nodejs-sdk (https://www.npmjs.com/package/@gumlet/nodejs-sdk). Use this when the user wants to integrate Gumlet in application code. Do not use this to call the live Gumlet API; use the API tools instead.

No parameter schema on file.

Get install commands and a usage snippet for an official Gumlet SDK. language=python returns pip install gumlet (https://pypi.org/project/gumlet/). language=nodejs returns npm install @gumlet/nodejs-sdk (https://www.npmjs.com/package/@gumlet/nodejs-sdk). Aliases: py, node, js, ts, javascript, typescript, npm, pypi.

Parameter	Type	Required	Notes
language	string	yes	—

An asset refers to media content/video that is processed, stored, and delivered through Gumlet. This endpoint creates an asset allowing users to ingest media content into the Gumlet system for processing and delivery.

Parameter	Type	Required	Notes
input	string	no	URL or web address of a file that Gumlet should download to create a new asset.
profile_id	string	no	Provide profile_id of the previously created video profile. This parameter will override all the parameters (except input and collection_id) from the video profile.
format	string	no	Transcode and deliver the asset in the requested format. The options can be one of ABR (HLS + DASH) and MP4.
tag	array	no	Specify a text string or identifier which can identify an asset or bunch of assets later.
title	string	no	Specify a text string or identifier which can be used for filtering or searching the asset.
description	string	no	Attach some textual data with the asset. This field is neither searchable nor filterable.
metadata	object	no	Add your metadata you want to associate with this asset.<br/> Example: <br/> <code> { "internal_video_id" : "123Abc" } </code>
width	string	no	Resize video with the given width. Can be an absolute value in pixels or a percentage value with the % suffix. Specified values greater than the original asset width will be ignored. Applicable only
height	string	no	Resize video with the given height. Can be an absolute value in pixels or a percentage value with the % suffix. Specified values greater than the original asset height will be ignored. Applicable on
resolution	string	no	Required resolutions of the transformed asset in case of HLS or MPEG-DASH delivery format. Can be a comma-separated string out of the following values: 240p, 360p, 480p, 540p, 720p, and `108
crop	object	no	This transformation can be used to crop the video by defining a rectangular area within the dimensions of the output video.
pad	object	no	This transformation can be used to add padding to the video.
trim	object	no	Trim transformation can be used to trim videos based on time duration.
image_overlay	object	no	Image overlay can be used to brand a video or add a visual label in the form of an image.
text_overlay	object	no	Text overlay can be used to brand a video or add a label in the form of text.
animated_gif	object	no	Create an animated GIF from the video.
additional_tracks	array	no	Add additional Audio / Subtitle tracks to Gumlet for transcoding and delivery along with video asset track.
generate_subtitles	object	no	Gumlet allows you to generate subtitles from the audio stream (use <a href='https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes'> ISO 639-1 </a> Language Codes)
mp4_access	boolean	no	Creates MP4 version for download purpose in case of MPEG-DASH or HLS delivery format. Default: false
per_title_encoding	boolean	no	Gumlet analyzes each input video on a wide range of visual aspects. Based on the analysis, it chooses a unique set of transcoding options for processing the video. This ensures that the output video i

This endpoint creates a video asset allowing upload of a video from the local file system and ingest media content into the Gumlet system for processing and delivery. Body parameters are the same as the Create Asset body parameters except for the input parameter, which this endpoint does not take. A successful response will be returned with upload_url field. You can make PUT request to that

Parameter	Type	Required	Notes
collection_id	string	no	Gumlet video workspace id.
profile_id	string	no	Provide profile_id of the previously created video profile. This parameter will override all the parameters (except input and collection_id) from the video profile.
format	string	no	Transcode and deliver the asset in the requested format. The options can be one of ABR (HLS + DASH) and MP4.
tag	array	no	Specify a text string or identifier which can identify an asset or bunch of assets later.
title	string	no	Specify a text string or identifier which can be used for filtering or searching the asset.
description	string	no	Attach some textual data with the asset. This field is neither searchable nor filterable.
metadata	object	no	Add your metadata you want to associate with this asset.<br/> Example: <br/> <code> { "internal_video_id" : "123Abc" } </code>
width	string	no	Resize video with the given width. Can be an absolute value in pixels or a percentage value with the % suffix. Specified values greater than the original asset width will be ignored. Applicable only
height	string	no	Resize video with the given height. Can be an absolute value in pixels or a percentage value with the % suffix. Specified values greater than the original asset height will be ignored. Applicable on
resolution	string	no	Required resolutions of the transformed asset in case of HLS or MPEG-DASH delivery format. Can be a comma-separated string out of the following values: 240p, 360p, 480p, 540p, 720p, and `108
crop	object	no	This transformation can be used to crop the video by defining a rectangular area within the dimensions of the output video.
pad	object	no	This transformation can be used to add padding to the video.
trim	object	no	Trim transformation can be used to trim videos based on time duration.
image_overlay	object	no	Image overlay can be used to brand a video or add a visual label in the form of an image.
text_overlay	object	no	Text overlay can be used to brand a video or add a label in the form of text.
animated_gif	object	no	Create an animated GIF from the video.
additional_tracks	array	no	Add additional Audio / Subtitle tracks to Gumlet for transcoding and delivery along with video asset track.
generate_subtitles	object	no	Gumlet allows you to generate subtitles from the audio stream (use <a href='https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes'> ISO 639-1 </a> Language Codes)
mp4_access	boolean	no	Creates MP4 version for download purpose in case of MPEG-DASH or HLS delivery format. Default: false
per_title_encoding	boolean	no	Gumlet analyzes each input video on a wide range of visual aspects. Based on the analysis, it chooses a unique set of transcoding options for processing the video. This ensures that the output video i

This endpoint retrieves the details of an asset that has previously been created.

Parameter	Type	Required	Notes
asset_id	string	yes	An asset id for the previously created asset.

This endpoint removes an asset given its unique asset id. The asset will be removed from storage as well, associated URLs will be inaccessible.

Parameter	Type	Required	Notes
asset_id	string	yes	Asset id of the video asset which needs to be deleted.

This endpoint allows users to update video asset that has previously been created.

Parameter	Type	Required	Notes
asset_id	string	no	Asset ID to update. This is a required parameter.
title	string	no	Specify a text string or identifier which can be used for filtering or searching the asset.
description	string	no	Attach some textual data with the asset. This field is neither searchable nor filterable.
tag	string	no	Specify a text string or identifier which can identify an asset or bunch of assets later. You can pass multiple comma-separated values.
call_to_actions	array	no	A CTA is an explicit prompt within the video content encouraging viewers to take a particular action.
metadata	string	no	Set of key-value pairs that you can attach to this Asset. This can be useful for storing additional information.<br/> Example: <br/> <code> { "internal_video_id" : "123Abc" } </code>
remove_subtitles	array	no	Comma separated string of language codes.
input	string	no	For replacing videos, pass this along with asset_id {workspace_id}/{asset_id}/origin-{asset_id}
reprocess	boolean	no	To reprocess same video, pass this as true.

Select frame from video to use as thumbnail.

Parameter	Type	Required	Notes
asset_id	string	yes	Asset id of the video asset which needs to be deleted.
frame_at_second	number	no	Actual time in second at which thumbnail extraction needs to be done. It can be a fraction of a second as well

Use any image file to use as thumbnail. Once you use the API, you will get upload_url in the response, and that can be used to upload the image file. Here is the sample curl request. ``bash curl --location --request PUT '<upload_url>' \ --data '<YOUR_FILE_PATH>' ``

Parameter	Type	Required	Notes
asset_ID	string	yes	An asset id for the previously created asset.

Upload .srt or .vtt file to the video asset. The response of this API call gives upload_url for each language specified. You need to send a PUT request of the subtitle files to those URLs. Once that's done, you need to call the subtitle upload complete API. Only after that, Gumlet will add subtitles to asset.

Parameter	Type	Required	Notes
asset_ID	string	yes	An asset id for the previously created asset.
language_codes	array	no	List of language codes to upload subtitle file (use <a href='https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes'> ISO 639-1 </a> Language Codes)

This API must be called after adding subtitles; the add subtitle call gives you URLs to upload, and you complete a PUT request to those URLs. Once that is done, calling this initiates the process to actually add the subtitle to the video.

Parameter	Type	Required	Notes
asset_ID	string	yes	An asset id for the previously created asset.
upload_responses	array	no	Array of objects of uploaded languages

Add any audio file to the video asset. The response of this API call gives upload_url for each language specified. You need to send a PUT request of the audio files to those URLs. Once that's done, you need to call the audio upload complete API. Only after that will Gumlet add audio to the asset.

Parameter	Type	Required	Notes
asset_ID	string	yes	An asset id for the previously created asset.
language_codes	array	no	List of language codes to upload audio file (use <a href='https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes'> ISO 639-1 </a> Language Codes)

Finish adding audio tracks to an existing video asset. Call this only after the audio files have been PUT to the upload URLs from the add-audio call. This attaches those tracks to the asset.

Parameter	Type	Required	Notes
asset_ID	string	yes	An asset id for the previously created asset.
upload_responses	array	no	—

This endpoint will create/update video asset chapters.

Parameter	Type	Required	Notes
asset_id	string	yes	Gumlet asset ID
chapters	array	no	List of chapters

This endpoint gives usage analytics data of your videos. Ex - top assets, bandwidth consumption

Parameter	Type	Required	Notes
metrics	array	no	Define the metric you need the data for. Supported values: bandwidth_consumption, asset_duration, storage_unit, top_assets, drm_requests, ai_credit_usage, and errored_videos.
date_range	object	no	The timeframe to get the data for. Currently we only support a maximum of 60 days between start_at and end_at.
filters	object	no	—
top_assets_count	string	no	Count of video assets that should be returned. Max assets count is 1000 per page.
top_assets_page	string	no	top_assets metric may get paginated response. Iterate this parameter to get more data.
group_by	string	no	Group by hourly, daily or monthly. If you don't specify anything it's hourly by default.

This endpoint lists top streamed assets in a video collection

Parameter	Type	Required	Notes
start_at	string	yes	Date in yyyy-MM-dd format
end_at	string	yes	Date in yyyy-MM-dd format
collection_id	string	no	Gumlet workspace ID
page	string	no	Page number of the response.
page_size	string	no	Assets to list per page.

Use this endpoint to retrieve a pre-signed upload URL for the given part number.

Parameter	Type	Required	Notes
asset_id	string	yes	An asset id of the created asset for which you are uploading parts
part_number	string	yes	Part number of multiple parts of the original video which you you are uploading

Once you upload all parts to S3 bucket via pre-signed URL, use this endpoint to complete the multipart upload.

Parameter	Type	Required	Notes
asset_id	string	yes	An asset id for which you are uploading original video via multipart
parts	array	no	List of object containing part number with ETag received as a response header while uploading each part

This endpoint retrieves the details of all profiles that have previously been created.

Parameter	Type	Required	Notes
offset	integer	no	Offset value for a paginated list of profiles. Can be zero for the first time and current_offset value received from the last request afterwards.
size	integer	no	Page size for the paginated list. Default: 10

Gumlet provides the functionality of creating multiple video assets using the same set of parameters. A Video profile is a set of parameters that can be referenced/used while creating a video as a single parameter.

Parameter	Type	Required	Notes
name	string	no	Profile name or identifier.
format	string	no	Transcode and deliver the asset in the requested format. The options can be one of ABR (HLS + DASH) and MP4.
width	string	no	Resize video with the given width. Can be an absolute value in pixels or a percentage value with the % suffix. Specified values greater than the original asset width will be ignored. Only applicable
height	string	no	Resize video with the given height. Can be an absolute value in pixels or a percentage value with the % suffix. Specified values greater than the original asset height will be ignored. Only applicab
resolution	string	no	Required resolutions of the transformed asset in case of HLS or MPEG-DASH delivery format. Can be a comma-separated string out of the following values: 240p, 360p, 480p, 540p, 720p, and `108
crop	object	no	This transformation can be used to crop the video by defining a rectangular area within the dimensions of the output video.
pad	object	no	This transformation can be used to add padding to the video.
trim	object	no	Trim transformation can be used to trim videos based on time duration.
image_overlay	object	no	Image overlay can be used to brand a video or add a visual label in the form of an image.
text_overlay	object	no	Text overlay can be used to brand a video or add a label in the form of text.
animated_gif	object	no	Create an animated GIF from a video.
generate_subtitles	object	no	Gumlet allows you to generate subtitles from the audio stream (use <a href='https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes'> ISO 639-1 </a> Language Codes). Remove this object if you do
transcribe	boolean	no	This will generate the subtitles in the native audio.
mp4_access	boolean	no	Creates mp4 version for download purpose in case of MPEG-DASH or HLS delivery format. Default: false
per_title_encoding	boolean	no	Gumlet analyzes each input video on a wide range of visual aspects. Based on the analysis, it chooses a unique set of transcoding options for processing the video. This ensures that the output video i
process_low_resolution_input	boolean	no	Currently, the minimum supported frame size is 57600 (240x240) pixels for HLS/DASH and 21025 (145x145) pixels for MP4 format. However, enabling this flag will allow Gumlet to simply put yo
audio_only	boolean	no	This flag allows Gumlet to transcode and deliver audio-only in the specified format. In this case,This flag allows Gumlet to transcode and deliver audio-only in the specified format. In this case, vid
enable_drm	boolean	no	Enable DRM encryption for transcoded videos. Gumlet supports Widevine and FairPlay DRMs.

This endpoint retrieves the details of a video profile that has previously been created.

Parameter	Type	Required	Notes
profile_id	string	yes	Profile id of the profile which needs to be retrieved.

Update an existing profile. Settings provided in body parameters will only be updated in the existing profile.

Parameter	Type	Required	Notes
profile_id__path	string	yes	Profile id of the profile which need to be updated. (Path parameter)
profile_id	string	no	Profile id of the profile which needs to be deleted.
name	string	no	Profile name or identifier.
format	string	no	Transcode and deliver the asset in the requested format. The options can be one of ABR (HLS + DASH) and MP4.
width	string	no	Resize video with the given width. Can be an absolute value in pixels or a percentage value with the % suffix. Specified values greater than the original asset width will be ignored. Only applicable
height	string	no	Resize video with the given height. Can be an absolute value in pixels or a percentage value with the % suffix. Specified values greater than the original asset height will be ignored. Only applicab
resolution	string	no	Resize video with the given height. Can be an absolute value in pixels or a percentage value with the % suffix. Specified values greater than the original asset height will be ignored. Only applicab
crop	object	no	This transformation can be used to crop the video by defining a rectangular area within the dimensions of the output video.
pad	object	no	This transformation can be used to add padding to the video.
trim	object	no	Trim transformation can be used to trim videos based on time duration.
image_overlay	object	no	Image overlay can be used to brand a video or add a visual label in the form of an image.
text_overlay	object	no	Text overlay can be used to brand a video or add a label in the form of text.
animated_gif	object	no	Create an animated GIF from a video.
generate_subtitles	object	no	Gumlet allows you to generate subtitles from the audio stream (use <a href='https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes'> ISO 639-1 </a> Language Codes). You can remove this object if
transcribe	boolean	no	To generate the subtitles in the native audio.
mp4_access	boolean	no	Creates mp4 version for download purpose in case of MPEG-DASH or HLS delivery format. Default: false
per_title_encoding	boolean	no	Gumlet analyzes each input video on a wide range of visual aspects. Based on the analysis, it chooses a unique set of transcoding options for processing the video. This ensures that the output video i
process_low_resolution_input	boolean	no	Currently, the minimum supported frame size is 57600 (240x240) pixels for HLS/DASH and 21025 (145x145) pixels for MP4 format. However, enabling this flag will allow Gumlet to simply put yo
audio_only	boolean	no	This flag allows Gumlet to transcode and deliver audio-only in the specified format. In this case,This flag allows Gumlet to transcode and deliver audio-only in the specified format. In this case, vid
enable_drm	boolean	no	Enable DRM encryption for transcoded videos. Gumlet supports Widevine and FairPlay DRMs.

This endpoint removes a profile given its unique profile_id. The profile will be removed but video assets created using the profile will remain as it is.

Parameter	Type	Required	Notes
profile_id	string	yes	Profile id of the profile which needs to be deleted.

Get all playlists for given workspace

Parameter	Type	Required	Notes
collection_id	string	yes	Workspace ID

Create new playlist inside video wprkspace

Parameter	Type	Required	Notes
collection_id	string	no	Workspace ID in which the playlist should be created
title	string	no	Playlist title
description	string	no	Playlist description

This operation adds a single asset or a list of assets to a playlist.

Parameter	Type	Required	Notes
playlist_id	string	yes	Playlist ID in which the asset needs to be added.
asset_list	array	no	—

Removed an asset or list of assets from a given playlist.

Parameter	Type	Required	Notes
playlist_id	string	yes	Playlist ID that is to be deleted.
delete_list	array	no	Array of video asset ids to delete

This endpoint allows you to update playlist name, channel visibility, or playlist order on a channel page.

Parameter	Type	Required	Notes
playlist_id	string	yes	ID for the playlist to update.
title	string	no	Playlist title
description	string	no	Playlist description
position	integer	no	Playlists have order in which they will be shown on the channel page.
player_config	object	no	Configure player settings for this playlist, it overrides the setting set on collection.
channel_visibility	boolean	no	If true then playlist will be visible on channel page.

Deletes a playlist by plalist ID.

Parameter	Type	Required	Notes
playlist_id	string	yes	Playlist ID that is to be deleted.

Get a list of all assets inside playlist. You can choose in which order are assets returned.

Parameter	Type	Required	Notes
playlist_id	string	yes	ID of playlist in which you need to list assets.
sort_by	string	no	Optional, if sort_by is set to asset_title it will sorted by title name. Otherwise order in which user added the assets in playlist.
sort_order	integer	no	-1 or 1
page_number	integer	no	Optional. Minimum: 1
page_size	string	no	Optional. Minimum: 10

Reorder videos inside a playlist either by moving a single asset to a position or by sorting the playlist by title or created date.

Parameter	Type	Required	Notes
playlist_id	string	yes	Playlist id.
body		no	—

List all webhooks.

No parameter schema on file.

Creates a new webhook listener. Gumlet POSTs JSON to url for each matching event and sends secret_token in the x-gumlet-token header. Payload schemas are documented in the webhooks section.

Parameter	Type	Required	Notes
url	string	no	URL from the application you want to send data to.
secret_token	string	no	Secret sent back in the x-gumlet-token header of each webhook POST so you can confirm the request came from Gumlet.
triggers	array	no	Events that invoke this webhook. status subscribes to every video asset status event. live-video-status subscribes to every live video status event. Any other value subscribes to that event only.
sources	array	no	List of video collection identifiers for which webhooks are needed to be invoked.

Update a webhook listener.

Parameter	Type	Required	Notes
webhook_id	string	yes	Unique identifier for the Gumlet Webhook which needs to be updated.
url	string	no	URL from the application you want to send data to.
secret_token	string	no	Secret sent back in the x-gumlet-token header of each webhook POST so you can confirm the request came from Gumlet.
triggers	array	no	Events that invoke this webhook. status subscribes to every video asset status event. live-video-status subscribes to every live video status event. Any other value subscribes to that event only.
sources	array	no	List of video collection identifiers for which webhooks are needed to be invoked.

Delete webhook listener endpoint.

Parameter	Type	Required	Notes
webhook_id	string	yes	Unique identifier for the Gumlet Webhook which needs to be deleted.

This endpoint list image sources which are assigned to the user or token.

Parameter	Type	Required	Notes
offset	integer	no	Skip number of items. Helpful for pagination.
size	integer	no	Results per page.

This endpoint allows users to create image source.

Parameter	Type	Required	Notes
namespace	string	no	unique subdomain associated with the image source
type	string	no	—
aws	object	no	This is a required field if source type is aws.
proxy	object	no	This is a required field if source type is proxy.
gcs	object	no	This is a required field if source type is gcs.
dostorage	object	no	This is a required field if source type is dostorage.
wasabi	object	no	This is a required field if source type is wasabi.
cloudinary	object	no	This is a required field if source type is cloudinary.
azure	object	no	This is a required field if source type is azure.
linode	object	no	This is a required field if source type is linode.
backblaze	object	no	This is a required field if source type is backblaze.
cloudflare	object	no	This is a required field if source type is cloudflare.
webfolder	object	no	—

Get all details about image source.

Parameter	Type	Required	Notes
image_source_id	string	yes	Image source id. You can get it on Gumlet dashboard or using list sources API endpoint.

Update settings on an image source that already exists. This does not create a source or purge cached images.

Parameter	Type	Required	Notes
image_source_id	string	yes	image source id which you want to update
type	string	no	—
webfolder	object	no	This is a required field if source type is webfolder.
aws	object	no	This is a required field if source type is aws.
proxy	object	no	This is a required field if source type is proxy.
gcs	object	no	This is a required field if source type is gcs.
dostorage	object	no	This is a required field if source type is dostorage.
wasabi	object	no	This is a required field if source type is wasabi.
linode	object	no	This is a required field if source type is linode.
backblaze	object	no	This is a required field if source type is backblaze.
cloudflare	object	no	This is a required field if source type is cloudflare.
cloudinary	object	no	This is a required field if source type is cloudinary.
azure	object	no	This is a required field if source type is azure.
default_params	object	no	—
error_image	string	no	URL for error image to display when we get broken image from your origin.
request_headers	array	no	—
response_headers	array	no	—
temp_cname	array	no	—
browser_cache_time	integer	no	Browser cache time in seconds. For example setting this to 3600 caches the image in browser for 3600 seconds (1 hour)
cdn_cache_time	integer	no	CDN cache time in seconds.

This endpoint removes a image source. All image delivery using this subdomain will be stopped.

Parameter	Type	Required	Notes
image_source_id	string	yes	Image source ID to delete. You can get this on Gumlet dashboard or in list source API.

You can purge cache for any image by using our cache purge API.

Parameter	Type	Required	Notes
subdomain	string	yes	Subdomain is same subdomain you created while creating source. If you serve image from example.gumlet.com, please enter only 'example' for this parameter.
paths	array	no	An array of path of images to purge. It should be provided without any query parameters.

This endpoint helps you get image analytics data like bandwidth consumption, request count, CDN hit ratio, etc.

Parameter	Type	Required	Notes
metrics	array	no	Define the metric you need the data for. Supported values: bandwidth_consumption, requests_count, transformations_count, bandwidth_savings, origin_hit_rate, `avg_transformation_response_time
date_range	object	no	The timeframe to get the data for. Currently we only support a maximum of 30 days between start_at and end_at.
group_by	string	no	—
filters	object	no	—

A live asset refers to media content/video that is live-streamed through Gumlet. This endpoint creates a live streaming asset allowing users to live stream a video that will be pushed to Gumlet.

Parameter	Type	Required	Notes
live_source_id	string	no	Gumlet live video source/collection id.
resolution	string	no	Required resolutions in HLS delivery format for live stream. Can be an array of string out of the following values: 240p, 360p, 480p, 540p, 720p, and 1080p. Resized rendition will retain t
title	string	no	Your live stream asset title
mp4_access	boolean	no	Creates <code>MP4</code> version for download purpose.
orientation	string	no	—
start_at	string	no	—

A live asset refers to media content/video that is live-streamed through Gumlet. This endpoint allows users to update a live streaming asset.

Parameter	Type	Required	Notes
live_asset_id	string	no	Gumlet live video asset id.
title	string	no	Your live stream asset title
start_at	string	no	—

This endpoint retrieves the details of a live video asset that has previously been created.

Parameter	Type	Required	Notes
live_asset_id	string	yes	A live asset id for the previously created asset.

This endpoint removes a live asset given its unique live asset id. The live asset will be removed from storage as well, associated URLs will be inaccessible.

Parameter	Type	Required	Notes
live_asset_id	string	yes	Live asset id of the live asset which needs to be deleted.

This endpoint allows marking live assets complete. Once the live asset is marked complete, it can no longer be used to ingest the live stream on Gumlet.

Parameter	Type	Required	Notes
live_asset_id	string	yes	Live asset id of the live stream which needs to be completed.

This endpoint lists live assets on the basis of status for the given live_source_id.

Parameter	Type	Required	Notes
live_source_id	string	yes	Gumlet live source/collection id.
status	string	no	To filter live assets on the basis of their current status. Can be specified as a single status value string or comma-separated status values. The status value can be one of created, active, `comp
offset	integer	no	Offset value for a paginated list of assets.
size	integer	no	Page size for the paginated list.

Recovers a deleted asset from the recycle bin.

Parameter	Type	Required	Notes
asset_id	string	no	Gumlet Video Asset Id which needs to be recovered.

Start a live stream.

Parameter	Type	Required	Notes
live_asset_id	string	yes	List asset id for which the stream needs to start.

Generate presigned upload URLs for live stream thumbnails. Supported thumbnail states are preparing, disconnected, and end.

Parameter	Type	Required	Notes
live_asset_id	string	no	Gumlet live video asset id.
statuses		no	Thumbnail states to upload. You can send an array or a comma-separated string.

This endpoint list video workspace which are assigned to the user or token.

Parameter	Type	Required	Notes
offset	string	no	Number of workspaces to skip. For example if you need to list 11 to 20th workspaces, pass offset as 10 and size as 10.
size	string	no	Number of workspace to return in single response.

Video workspaces are top-level entities in Gumlet. You can use them to organize videos for different teams/departments or use cases.

Parameter	Type	Required	Notes
name	string	no	Specify a text string or identifier for the workspace.
type	string	no	Video workspaces are top-level entities in Gumlet. You can use them to organize videos for different teams/departments or use cases.
default_profile_id	string	no	Gumlet provides the functionality of creating multiple video assets using the same set of parameters.
insight_property_id	string	no	The five to ten character unique identifier of the Gumlet Insight Property available on the dashboard.
video_protection	object	no	Gumlet provides multiple options for securing your video playback.
aws	object	no	This is a required field if workspace type is aws.
proxy	object	no	This is a required field if workspace type is proxy.
gcs	object	no	This is a required field if workspace type is gcs.
dostorage	object	no	This is a required field if workspace type is dostorage.
wasabi	object	no	This is a required field if workspace type is wasabi.
cloudinary	object	no	This is a required field if workspace type is cloudinary.
azure	object	no	This is a required field if workspace type is azure.
linode	object	no	This is a required field if workspace type is linode.
backblaze	object	no	This is a required field if workspace type is backblaze.
cloudflare	object	no	This is a required field if workspace type is cloudflare.
zoom	object	no	This is a required field if workspace type is zoom.
data_localization	string	no	Data localization region

This endpoint get all the data of video workspace that has previously been created.

Parameter	Type	Required	Notes
workspace_id	string	yes	Gumlet workspace ID. You can get it on Gumlet dashboard or retrieve it using list workspace API.

This endpoint allows users to update video workspace that has previously been created.

Parameter	Type	Required	Notes
workspace_id	string	yes	Gumlet workspace ID. You can get it on Gumlet dashboard or retrieve it using list workspace API.
name	string	no	video workspace name
default_profile_id	string	no	Gumlet provides the functionality of creating multiple video assets using the same set of parameters.
temp_cname	array	no	cname for channel
insight_property_id	string	no	The five to ten character unique identifier of the Gumlet Insight Property available on the dashboard.
player_config	object	no	Configure player settings for this playlist, it overrides the setting set on workspace.
video_protection	object	no	Gumlet provides multiple options for securing your video playback.
channel_settings	object	no	Configurations to set various channel settings.
type	string	no	Video workspaces are top-level entities in Gumlet. You can use them to organize videos for different teams/departments or use cases.
webfolder	object	no	This is a required field if workspace type is webfolder.
aws	object	no	This is a required field if workspace type is aws.
proxy	object	no	This is a required field if workspace type is proxy.
gcs	object	no	This is a required field if workspace type is gcs.
dostorage	object	no	This is a required field if workspace type is dostorage.
wasabi	object	no	This is a required field if workspace type is wasabi.
linode	object	no	This is a required field if workspace type is linode.
backblaze	object	no	This is a required field if workspace type is backblaze.
cloudflare	object	no	This is a required field if workspace type is cloudflare.
cloudinary	object	no	This is a required field if workspace type is cloudinary.
azure	object	no	This is a required field if workspace type is azure.

This endpoint removes a video workspace given its unique asset id. All the asset in workspace will be removed from storage as well, associated URLs will be inaccessible.

Parameter	Type	Required	Notes
workspace_id	string	yes	Gumlet workspace ID. You can get it on Gumlet dashboard or retrieve it using list workspace API.

List folders for a video workspace. Use parent_id to list only folders inside a specific parent folder.

Parameter	Type	Required	Notes
workspace_id	string	yes	Video workspace id.
parent_id	string	no	Parent folder id. Send null to list root folders.

Create a folder inside a video workspace. Optionally provide parent_id to create a nested folder.

Parameter	Type	Required	Notes
workspace_id	string	yes	Video workspace id.
name	string	no	Folder name.
parent_id	string/null	no	Parent folder id. Send null or omit it to create a root-level folder.

Get a single folder by id.

Parameter	Type	Required	Notes
workspace_id	string	yes	Video workspace id.
folder_id	string	yes	Folder id.

Rename a folder, move it to another parent folder, or move assets into the folder by sending asset_ids.

Parameter	Type	Required	Notes
workspace_id	string	yes	Video workspace id.
folder_id	string	yes	Folder id.
name	string	no	New folder name.
parent_id	string/null	no	New parent folder id. Send null to move the folder to the root level.
asset_ids	array	no	Asset ids to move into this folder.

Delete a folder. Descendant folders and assets inside them are deleted by the backend workflow.

Parameter	Type	Required	Notes
workspace_id	string	yes	Video workspace id.
folder_id	string	yes	Folder id.

Remove one or more assets from their current folder assignment inside the workspace.

Parameter	Type	Required	Notes
workspace_id	string	yes	Video workspace id.
asset_ids	array	no	—

List folders and assets for a workspace in a single response. Use parent_id to browse a specific folder, or filters like title, status, and playlist_id to search assets.

Parameter	Type	Required	Notes
workspace_id	string	yes	Video workspace id.
type	string	no	Return folders, videos, or all. Default is all.
parent_id	string	no	Parent folder id. Send null to browse the root level.
title	string	no	Search folders or assets by title or description.
status	string	no	Comma-separated asset status values.
tag	string	no	Comma-separated asset tags.
playlist_id	string	no	Filter assets to a playlist.
start_date	string	no	Asset created_at lower bound. Date in yyyy-MM-dd format.
end_date	string	no	Asset created_at upper bound. Date in yyyy-MM-dd format.
min_duration	number	no	Minimum asset duration in seconds.
max_duration	number	no	Maximum asset duration in seconds.
sortBy	string	no	Sort assets by a supported field.
orderBy	string	no	Asset sort order.
searchIndex	string	no	Search index used for asset title search.
offset	integer	no	Offset for paginated results.
size	integer	no	Page size. Maximum 100.
signed_token	string	no	Whether URLs should be pre-signed in the API response. Possible values: true and false. Default is false.

Invite one or more viewers to a members-only channel.

Parameter	Type	Required	Notes
video_workspace_id	string	yes	Gumlet workspace ID. You can get it on Gumlet dashboard or retrieve it using list workspace API.
users	array	yes	List of viewers to invite. A maximum of 200 viewers can be invited in one request.

Remove one or more viewers from a channel by email address.

Parameter	Type	Required	Notes
video_workspace_id	string	yes	Gumlet workspace ID. You can get it on Gumlet dashboard or retrieve it using list workspace API.
emails	array	yes	Email addresses of viewers to remove. A maximum of 200 viewers can be removed in one request.

Invite viewers to a channel by uploading a CSV file.

Parameter	Type	Required	Notes
video_workspace_id	string	yes	Gumlet workspace ID. You can get it on Gumlet dashboard or retrieve it using list workspace API.
viewers_csv	string	yes	CSV file containing viewer rows. Required columns: email, name. Maximum 500 viewers.

This endpoint retrieves the history of a live video asset that has previously been created.

Parameter	Type	Required	Notes
live_asset_id	string	yes	A live asset id for the previously created asset.

This endpoint retrieves viewer analytics data. This endpoint is use for deep insights on the analytics data.

Parameter	Type	Required	Notes
metrics	array	no	Get data for one or more metrics in the same request. Supported values: views, unique_views, impressions, completion_percent_by_views, playing_time, concurrent_users, `widget_form_submitte
workspace_id	string	no	Gumlet workspace ID
date_range	object	no	The timeframe to get the data for. The maximum range between start_at and end_at is 60 days.
filters	array	no	Build segments of users using multiple filters on the data, value should be an exact match
group_by	string	no	Data can be grouped by daily, weekly or monthly.
chart_dimension	object	no	Group metrics by the selected dimension. You can select up to 3 dimensions for nested category results; results follow the selection order.
download	boolean	no	Whether the request is to download the chart data

Read viewer metrics for one workspace, grouped by a breakdown field, for a date range of at most 60 days. This does not change assets or delivery.

Parameter	Type	Required	Notes
date_range	object	no	The timeframe to get the data for. The maximum range between start_at and end_at is 60 days.
filters	array	no	Build segments of users using multiple filters on the data, value should be an exact match
breakdowns	array	no	Breakdown fields and metrics to retrieve data for. Supports 1 to 3 breakdowns per request.
workspace_id	string	no	The five to ten character unique identifier of the Gumlet workspace ID available on the Video Workspaces.

This endpoint retrieves aggregated data of the given metrics.

Parameter	Type	Required	Notes
aggregate	array	no	Aggregate multiple metrics at the same time
workspace_id	string	no	The unique identifier of the Gumlet workspace ID available on the Video Workspaces.
timeframe	object	no	The timeframe to get the data for. The maximum range between start_at and end_at is 60 days.
filters	array	no	Get aggregations for metrics with multiple filters, value should be an exact match

You can purge the cache for any image path by using this cache purge API.

Parameter	Type	Required	Notes
source_id	string	yes	Image Source ID
paths	array	no	An array of path of images to purge. It should be provided without any query parameters.

You can get organization data using this API.

No parameter schema on file.

This endpoint gives information about the user account.

No parameter schema on file.

Get audit logs for the user activity in your organisation. Please note that this endpoint can only be accessed by owner and admin role users.

Parameter	Type	Required	Notes
date_range	object	no	—
page_number	integer	no	Page number of results.
page_size	integer	no	—
user_email	array	no	Array of user emails to filter the activity logs.
activity_type	array	no	Array of activity types to filter the audit logs

List all assets in a recycle bin for a given workspace. The deleted assets are available for 30 days. After that, assets are permanently deleted.

Parameter	Type	Required	Notes
offset	integer	no	Number of items to skip from start of page response.
size	integer	no	Number of items to return for a single page.
workspace_id	string	yes	ID of workspace for which you want to list the recycle bin items.

Delete multiple VOD assets at once.

Parameter	Type	Required	Notes
asset_list	array	no	LIst of asset ids to delete
source_id	string	no	Workspace ID from which assets needs to be deleted.

Add / remove tags from multiple assets at once.

Parameter	Type	Required	Notes
asset_list	array	no	List of asset ids to update the tags for.
source_id	string	no	Workspace ID in which the videos needs the operation
add_tags	array	no	List of tags to add to given assets.
remove_tags	array	no	List of tags to remove from given assets. Pass empty array if nothing is to be removed.

Get video analytics for a single asset.

Parameter	Type	Required	Notes
asset_id	string	yes	Gumlet asset ID
group_by	string	no	Group the data by this period.
date_range	object	no	—
metrics	array	no	List of metrics to return in response.
page_number	integer	no	Page number to fetch. Starting at 1
page_size	integer	no	Number of items to return per page

List all channel subscribers.

Parameter	Type	Required	Notes
workspace_id	string	yes	Gumlet workspace ID. You can get it on Gumlet dashboard or retrieve it using list workspace API.
page_number	integer	no	Page number to retrieve. Starts at 1.
page_size	integer	no	Number of items to return per page

Get logs history for a given webhook.

Parameter	Type	Required	Notes
webhook_id	string	yes	Webhook ID. You can get it using list webhook endpoint.

Liost all invoices that are generated so far.

No parameter schema on file.

Get billing details for this organization.

No parameter schema on file.

Update billing details

Parameter	Type	Required	Notes
address_line	string	no	Address line 1
city	string	no	Name of the city
company_name	string	no	Company name
country_code	string	no	ISO country code
gst_number	string	no	GST / VAT details of the company
postal	string	no	Postal code of the company
state_code	string	no	ISO code of the state / region

Get details about upcoming invoice.

No parameter schema on file.

List all live stream workspaces.

No parameter schema on file.

Create live stream workspace.

Parameter	Type	Required	Notes
name	string	no	Collection name

Update live stream workspace.

Parameter	Type	Required	Notes
live_workspace_id	string	yes	Live stream workspace ID.
name	string	no	Live stream collection name
video_source_id	string	no	Video on demand workspace ID

Delete the live stream workspace.

Parameter	Type	Required	Notes
live_workspace_id	string	yes	Live stream workspace ID.

Get usage analytics for your live streams.

Parameter	Type	Required	Notes
date_range	object	no	—
group_by	string	no	Group the data either weekly, daily or monthly
metrics	array	no	List of metrics required in response

Search all video assets / playlists / folders etc across workspaces.

Parameter	Type	Required	Notes
search_query	string	yes	Search query term
collection_id	string	no	Workspace ID if you want to limit search to a specific workspace
size	integer	no	Number of results to return
assets_offset	integer	no	Offset for assets
folders_offset	integer	no	Offset for folders
playlists_offset	integer	no	Offset for playlists
channels_offset	integer	no	Offset for channels

This call aborts multi-part upload and deletes the already uploaded parts from the storage.

Parameter	Type	Required	Notes
asset_id	string	yes	An asset id for the asset.
body	object	no	—

Lists all parts uploaded so far.

Parameter	Type	Required	Notes
asset_id	string	yes	An asset id for the asset.
body	object	no	—

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Gumlet or to call it, at any volume.

ATool-list grade · score 90 / 100

Release 2.3.7 · scanned 5 Nov 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score90

Findings0 threat · 6 capability

Capabilityhigh

Coveragemanifest

Verificationnot in this report

Surface digeste947ebcbe19d2ae4aa4cbec285bb7980d2c662043d173550e7e02e666f3f9ed8

Score vectorthreat 100 → client 90

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

Tool	Capability tags	Why the tag was assigned
insights_breakdown_data	no tags
insights_aggregated_data	no tags
list_sdks	no tags
get_sdk	no tags
create_asset	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
create_asset_direct_upload	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
get_asset_details	no tags
delete_asset	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
update_asset	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
thumbnail_select	state-write	state-write: declares readOnlyHint: false
thumbnail_upload	external-sinkstate-write	external-sink: keyword "curl"; state-write: declares readOnlyHint: false
upload_subtitles	state-write	state-write: declares readOnlyHint: false
complete_subtitle_upload	state-write	state-write: declares readOnlyHint: false
asset_audio_upload	state-write	state-write: declares readOnlyHint: false
complete_audio_upload	state-write	state-write: declares readOnlyHint: false
create_update_chapter	state-write	state-write: declares readOnlyHint: false
retrieve_analytics	no tags
top_assets	no tags
retrieve_part_url	no tags
complete_multipart_upload	state-write	state-write: declares readOnlyHint: false
list_profiles	no tags
create_profile	state-write	state-write: declares readOnlyHint: false
get_profile	no tags
update_profile	state-write	state-write: declares readOnlyHint: false
delete_profile	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
get_all_playlists	no tags
create_playlist	state-write	state-write: declares readOnlyHint: false
add_asset_playlist	state-write	state-write: declares readOnlyHint: false
remove_asset_playlist	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
update_playlist	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
delete_playlist	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
get_playlist_assets	no tags
reorder_asset_playlist	state-write	state-write: declares readOnlyHint: false
list_webhooks	no tags
create_webhook	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, openWorldHint: true
update_webhook	external-sinksensitive-source	external-sink: keyword "webhook", parameter "webhook", declares readOnlyHint: false, openWorldHint: true; sensitive-source: parameter "secret"
delete_webhook	external-sinkstate-write	external-sink: keyword "webhook", parameter "webhook"; state-write: declares readOnlyHint: false, destructiveHint: true
list_sources	no tags
create_image_source	state-write	state-write: declares readOnlyHint: false
get_image_sources_source_id	no tags
update_image_source	state-write	state-write: declares readOnlyHint: false
delete_source	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
purge_image_cache	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
retrieve_image_analytics	no tags
create_live_asset	state-write	state-write: declares readOnlyHint: false
update_live_asset	state-write	state-write: declares readOnlyHint: false
get_live_asset_status	no tags
delete_live_asset	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
complete_live_stream	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
filter_live_assets	no tags
recover	state-write	state-write: declares readOnlyHint: false
start_live	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
thumbnail_upload_live	state-write	state-write: declares readOnlyHint: false
list_workspaces	no tags
create_workspace	state-write	state-write: declares readOnlyHint: false
get_workspace	no tags
update_workspace	state-write	state-write: declares readOnlyHint: false
delete_workspace	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_folders	no tags
create_folder	state-write	state-write: declares readOnlyHint: false
get_folder	no tags
update_folder	state-write	state-write: declares readOnlyHint: false
delete_folder	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
remove_assets_folder	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_assets	untrusted-input	untrusted-input: keyword "browse"
invite_channel_viewers	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
remove_channel_viewers	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
invite_channel_viewers_csv	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
asset_status_history	no tags
viewer_analytics_data	no tags
analytics_breakdown_data	no tags
analytics_aggregated_data	no tags
image_purge	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
fetch_org	untrusted-input	untrusted-input: keyword "fetch"
fetch_user	untrusted-input	untrusted-input: keyword "fetch"
fetch_audit_logs	untrusted-input	untrusted-input: keyword "fetch"
list_recycle_bin	no tags
assets_delete_many	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
assets_tag_many	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
asset_analytics	no tags
list_channel_subscribers	no tags
webhook_history	sensitive-sourceexternal-sink	sensitive-source: keyword "get_logs"; external-sink: keyword "webhook", parameter "webhook"
list_invoices	no tags
fetch_billing_details	untrusted-input	untrusted-input: keyword "fetch"
update_billing_details	state-write	state-write: declares readOnlyHint: false
fetch_upcoming_invoice	untrusted-input	untrusted-input: keyword "fetch"
list_live_workspaces	no tags
live_workspace_create	state-write	state-write: declares readOnlyHint: false
live_workspace_update	state-write	state-write: declares readOnlyHint: false
live_workspace_delete	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
live_usage_analytics	no tags
global_search	no tags
multipart_upload_abort	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
multipart_upload_list	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

fetch_audit_logs → update_webhook → create_asset

A cross-tool exfiltration chain exists: fetch_audit_logs ⇒ update_webhook ⇒ create_asset.

flow-2

Tool "update_webhook" both reads sensitive data and can send it externally.

flow-3

Tool "webhook_history" both reads sensitive data and can send it externally.

Supply chain and provenance

Integrityfirst-seen

Surface digeste947ebcbe19d2ae4

Scanned2026-11-05

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Gumlet MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also