The developer + agent integration layer for the Vivideo API โ a shared client, an MCP server, a CLI, and Skills. Agents are a primary user, not an afterthought.
Everything sits on top of the public API (the source of truth). No backend business logic is duplicated here โ the toolchain only adds client-side ergonomics and guardrails.
vivideo-toolchain/ npm workspaces monorepo (TypeScript)
โโโ packages/core @vivideo/core one typed API client + guardrails (shared)
โโโ packages/mcp @vivideo/mcp MCP server (stdio) โ 13 agent tools
โโโ packages/cli @vivideo/cli `vivideo` CLI โ humans, scripts, CI, agents
โโโ skills/ reusable agent Skills (SKILL.md)
โโโ docs/ installation, configuration, workflows
Architecture
One client, one set of types, derived from packages/core/openapi.yaml. The MCP server and CLI both call @vivideo/core โ there is exactly one representation of each request/response, so the tools, CLI, docs and OpenAPI stay consistent.
@vivideo/core adds only client-side concerns, never business logic:
| Guardrail | What it does |
|---|
| Rate limiting | Token-bucket cap on request rate (default 8/s) โ the client can't become a request flood. |
| Concurrency cap | Semaphore limits in-flight requests (default 4). |
| Bounded retries | Retries only retryable failures, with full-jitter backoff, capped attempts. |
Honors Retry-After | On 429 it waits the API-specified delay before retrying. |
| Idempotency | Every video-create sends an Idempotency-Key; retries reuse it โ no duplicate charges. |
| Timeouts | Per-request AbortController timeout (default 30s). |
| Safe waiting | waitForVideo polls at the API's suggested interval, with a hard timeout โ never a while(true). |
| Secret redaction | API keys / signing secrets are stripped from every log, error, and output. |
These complement โ and never bypass โ the API's own auth, rate limits, idempotency, credit checks, premium gates, ownership and error model.
Quick start
npm install
npm run build
export VIVIDEO_API_KEY="vv_live_..."
node packages/cli/dist/index.js account
node packages/cli/dist/index.js create auto --prompt "A 20s product teaser" --wait
node packages/mcp/dist/index.js
Once published: npm i -g @vivideo/cli (gives vivideo), and npx @vivideo/mcp for the server.
Docs
- MCP server โ install, configure, connect to clients, tool reference
- CLI โ install, auth, command reference, JSON & non-interactive use, exit codes
- Skills โ install & use
- Workflows โ human & agent, end to end
- Security, rate limits, idempotency, credits & premium, troubleshooting
Authentication & security
- Keys are read from (in order): explicit option โ
VIVIDEO_API_KEY env โ ~/.vivideo/config.json (written owner-only 0600).
- The key is never printed โ all output passes through secret redaction;
configure stores it without echoing it.
- Keys are account-scoped secrets. Keep them server-side; one per integration so a leak is revocable in isolation.
Not included (honest scope)
- Cancellation โ the public API has no cancel endpoint, so no cancel tool/command is offered. Failed/stuck renders are auto-refunded by the API.
- Agent/chat mode โ not exposed by the public API, so not in the toolchain.
- Nothing here publishes to npm, provisions DNS, or deploys โ those are external steps (see the final section of docs/mcp.md).
Development
npm run build
npm run typecheck
npm test
Requires Node โฅ 18.17.