# com.jojapi/tiktok-download-video TikTok Download Video: TikTok API 🔥 300/month is free The most powerful Tiktok Api available The. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.0.0 - **Author:** com.jojapi - **License:** Unknown - **Endpoints:** streamable-http https://mcp.jojapi.com/tiktok-download-video - **Source:** https://jojapi.com/hub/api/tiktok-download-video - **Endpoint health:** reachable (last checked 2026-10-02T13:12:02.573Z, 5 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 4 days ## Security scan - **Status:** clean - **Scanned:** 2026-10-02T13:12:02.573Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. **Findings** - injection-shaped content (note) in the `get_getVideo` tool: Links to undeclared domain: tiktok.com - injection-shaped content (note) in the `get_musicInfo` tool: Links to undeclared domain: vm.tiktok.com - injection-shaped content (note) in the `get_commentList` tool: Links to undeclared domain: tiktok.com - injection-shaped content (note) in the `get_mixInfo` tool: Links to undeclared domain: vm.tiktok.com ## Tools 19 declared. Observed from a live `tools/list` probe. - `get_getVideo` — Get tiktok video full info. HD Quality, No Watermark. Fast. Support Tiktok & Douyin. Support Getting Image List. Support Tiktok Stories. Billing per call: 1 Cre - `get_userFavoriteVideo` — get user favorite videos for latest unique_id or user_id is not empty Group: User Related API. Billing per call: 1 Credits. - `get_userPublishVideo` — get user post videos for latest get user feed unique_id or user_id is not empty Group: User Related API. Billing per call: 1 Credits. - `get_userInfo` — get user info unique_id or user_id is not empty Group: User Related API. Billing per call: 1 Credits. - `get_searchUser` — get user list by keywords Group: User Related API. Billing per call: 1 Credits. - `get_userFollowingList` — get user following list Group: User Related API. Billing per call: 1 Credits. - `get_musicVideo` — get music post video list Group: Music Related API. Billing per call: 1 Credits. - `get_musicInfo` — get music info Group: Music Related API. Billing per call: 1 Credits. - `get_feedSearch` — search video list by keywords Group: Feed Related API. Billing per call: 1 Credits. - `get_feedList` — get feed video list by region Group: Feed Related API. Billing per call: 1 Credits. - `get_regionList` — Feed Related API Group: Feed Related API. Billing per call: 1 Credits. - `get_commentReply` — get reply list by comment id Group: Comment Related API. Billing per call: 1 Credits. - `get_commentList` — get comment list by video Group: Comment Related API. Billing per call: 1 Credits. - `get_challengePosts` — get challenge post videos Group: Challenge(hashTag). Billing per call: 1 Credits. - `get_challengeSearch` — search challenge Group: Challenge(hashTag). Billing per call: 1 Credits. - `get_challengeInfo` — get challenge info Group: Challenge(hashTag). Billing per call: 1 Credits. - `get_mixPosts` — get play list post video list Group: Mix (Playlist). Billing per call: 1 Credits. - `get_mixInfo` — get playlist info Group: Mix (Playlist). Billing per call: 1 Credits. - `get_mixList` — get playlist by user id unique_id or user_id is not empty Group: Mix (Playlist). Billing per call: 1 Credits. ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"tiktok-download-video\": {\n \"type\": \"http\",\n \"url\": \"https://mcp.jojapi.com/tiktok-download-video\"\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface. - Floor 9, ceiling 27 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/com.jojapi%2Ftiktok-download-video - Install plan: https://forgeregistry.com/api/v1/packages/com.jojapi%2Ftiktok-download-video/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/com.jojapi%2Ftiktok-download-video - HTML page: https://forgeregistry.com/registry/com.jojapi%2Ftiktok-download-video - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.