jellyfin-mcp is WIP (pre-1.0). Only the latest published release receives security fixes. Pin to a released version if you need a known-good build.

Please do not open a public GitHub issue for security problems. Email me@solomonneas.dev with:

• A short description of the issue.
• Steps to reproduce (or a minimal proof of concept).
• The version or commit you tested against.
• Whether you would like to be credited in the release notes.

You should get an acknowledgment within 72 hours. If you do not, please follow up; the mail may have been filtered. You can also use GitHub's private vulnerability reporting from the Security tab.

• Argument-injection or path-traversal flaws in how tool inputs are forwarded to the Jellyfin API.
• Leaks of secrets, API keys, Quick Connect codes, or upstream Jellyfin response bodies into tool results, model context, or logs.
• A destructive or privileged tool (jellyfin_restart_server, jellyfin_shutdown_server, jellyfin_delete_user, jellyfin_set_user_password, jellyfin_quick_connect_authorize, the Continue Watching clears, bulk session controls, resume-position writes) executing without the documented confirm: true gate.
• JELLYFIN_VERIFY_SSL=false affecting TLS validation for any outbound request other than the configured Jellyfin connection.

• jellyfin_set_user_password takes the new password as plaintext tool input. That value transits the LLM conversation, the model provider's request logs, and any saved transcript. This is documented in the README and the tool description. Treat any password set this way as exposed and rotate it.
• Anyone who can reach this server with a valid JELLYFIN_API_KEY can perform whatever that key authorizes. The MCP server does not add its own access control beyond the confirm: true gates. Scope the API key appropriately.

• Bugs in Jellyfin itself; report those upstream at https://github.com/jellyfin/jellyfin.
• Bugs in the MCP SDK, Claude Code, Codex, OpenClaw, or other MCP clients; report those to their respective projects.
• Issues that require an attacker to already have your JELLYFIN_API_KEY, write access to your MCP client config, or shell access to the host.

We aim to ship a fix within 14 days of confirming a valid report. A coordinated disclosure timeline can be negotiated for issues that need longer.