krozov-ai-tools
Plugin marketplace by Kirill Rozov — Claude Code and Grok Build.
Installation
Claude Code
Add the marketplace:
/plugin marketplace add kirich1409/krozov-ai-tools
Install a plugin:
/plugin install youtube-transcript@krozov-ai-tools
maven-mcp is not in this marketplace. Install it from kirich1409/maven-mcp.
Grok Build
Add the marketplace, then install with trust so MCP servers and hooks activate:
grok plugin marketplace add kirich1409/krozov-ai-tools
grok plugin install youtube-transcript --trust
Requires Python 3.9+ on PATH (python3). Reload plugins (r in the Plugins tab) or start a new session after install.
Plugins
maven-mcp
Moved to kirich1409/maven-mcp. This repository does not ship that plugin and its marketplace entry cannot install it.
youtube-transcript
Fetches existing YouTube subtitles (manual or auto-generated) via the InnerTube API. Auto-registers an MCP server that returns transcript text — no speech-to-text, no video/audio download, only captions YouTube already publishes.
See plugins/youtube-transcript/ for full documentation.
Install as a desktop extension (.mcpb)
Besides the marketplace install above, youtube-transcript is published as an .mcpb bundle you can install into the Claude desktop app with a double click. Requires Python 3.9+ on macOS or Linux (compatibility in the bundle manifest declares darwin, linux).
1. Download. Releases of this repository interleave two independent version lines, so the newest release may belong to maven-mcp. Pick a release from the plugin's own tag namespace — releases tagged youtube-transcript--v* — not from /releases/latest. Each release that carries a bundle attaches two files: youtube-transcript-<version>.mcpb and youtube-transcript-<version>.mcpb.sha256.
2. Verify authenticity — build provenance. Installing an .mcpb makes the Claude desktop app run the bundled Python server on your machine, with your own privileges and no sandbox — an unverified bundle is arbitrary code execution, not just a file. Verification is blocking: if any of the commands below fails, do not install the bundle. Report it as a security issue instead.
gh attestation verify youtube-transcript-<version>.mcpb \
--repo kirich1409/krozov-ai-tools \
--signer-workflow kirich1409/krozov-ai-tools/.github/workflows/release.yml \
--source-ref refs/tags/youtube-transcript--v<version> \
--deny-self-hosted-runners
The fully-qualified --signer-workflow is load-bearing: --repo alone accepts an attestation minted by any workflow in the repository.
What this proves: these exact bytes were produced by that workflow file in that repository, at that tag, on a GitHub-hosted runner. What it does not prove: --signer-workflow pins the workflow's path, not the source commit — add --source-digest <commit sha> to pin that too. Provenance also says nothing about whether anyone reviewed the release; it says where the bytes came from.
3. Checksum — corruption detection only.
shasum -a 256 -c youtube-transcript-<version>.mcpb.sha256
This catches a truncated or corrupted download. It is not an authenticity control: both files are published together by the same job, so anyone able to replace the bundle on the release can replace the checksum with it. Authenticity is step 2's job, not this one.
The bundle is byte-reproducible: scripts/pack-mcpb.sh normalizes the archive's metadata before checksumming it (mcpb pack itself embeds file mtimes and ignores SOURCE_DATE_EPOCH) and stores entries uncompressed, so the digest does not depend on your Python version, platform, or zlib build. The one precondition is the mcpb CLI version, and the repository pins it — npm ci in tools/mcpb installs exactly the version the release used.
Rebuild the released tag and compare:
git clone https://github.com/kirich1409/krozov-ai-tools
cd krozov-ai-tools
git checkout youtube-transcript--v<version>
(cd tools/mcpb && npm ci --ignore-scripts)
bash scripts/pack-mcpb.sh
shasum -a 256 dist/youtube-transcript-<version>.mcpb
The digest must equal the one in the published .mcpb.sha256. Requires node, npm, jq, git, and python3. That is still a rebuild-and-compare check, not an authenticity control; authenticity is step 2's job. Scope and known limits — docs/PLUGIN-STANDARDS.md §12.
4. Install. Double-click the verified .mcpb; the Claude desktop app installs it as an extension.
License
MIT
