Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

Analysis · October 16, 2026 · repo

jub0t/ConcatJSON-RPCagent-infrastructurelocal-aimcp

Concat Lets AI Agents Edit Video Through a Local API

The open-source CapCut alternative exposes every editing action as a JSON-RPC call. Here is what an agent can do with it today, and what the MCP label on the repo does not mean yet.

Video editing is one of the last creative jobs that still mostly happens by hand. Coding agents write code, draft docs and fill spreadsheets, but when the task is "cut these twelve clips into a rough edit, add a title card and export a vertical version," the work usually lands back on a person dragging clips across a timeline. The tools were built for a mouse. Agents don't have one.

A new kind of editor is showing up that skips the mouse. Concat calls itself "the free, open-source, cross-platform CapCut replacement," and it sat at #10 on Trendshift's daily board on October 16, three days after v0.2.7 shipped on October 13. The interesting part is not the editor. It is one sentence in its developer docs: "Anything the Concat window can do to a project, your program can do through the Concat API, over JSON-RPC or gRPC."

That makes the timeline something an agent can operate. It also raises the questions you should ask about any tool that hands an agent a socket into your machine: who can connect, what can they touch, and what is actually shipped versus promised.

What Concat is

Concat is a desktop video editor for macOS, Windows, Linux and Android (iPhone and iPad builds are sideloaded), written in Rust, licensed AGPL-3.0-or-later, and openly labeled beta: "it works, and it still has edges." It had a little over 7,000 GitHub stars on October 16.

The feature list reads like a consumer editor: multi-track editing, keyframes, a large library of effects, filters and transitions, and export up to 4K at 60 frames per second in H.264, HEVC or AV1. The AI parts run on your machine. Captions come from Whisper (OpenAI's open speech-to-text model) running locally, and there is local text-to-speech, voice cloning from a few seconds of audio, and background removal. Per the README, those models "download once from Settings and work offline after that."

For an agent builder, local matters twice. Your footage does not go to a cloud API, and a script that captions a hundred clips does not run up a bill.

How an agent talks to it

The API uses JSON-RPC, which is a plain format for remote calls: you send one line of JSON naming a method and its parameters, and you get one line back with a result or an error. Concat speaks it three ways, per the JSON-RPC transport docs:

  • Over stdin, with concat-cli api. Your program starts the process and writes requests to it. No network socket exists and no token is needed. The docs put it simply: "No token, no socket. The process is yours."
  • Over a local socket, with concat-cli serve. By default it listens on 127.0.0.1:7420, which means only programs on the same machine can reach it.
  • From the open editor, through the window's Settings, Remote page, which serves the same API while Concat is running. It is off until you turn it on.

The method names read like the menu of an editor. project.create and project.open start work. media.import brings in a clip. edit.apply carries the actual edits as commands like addClip, addTextClip, updateClip and setClipTransform. export.run renders, and the server streams export.progress events until export.done or export.failed. There are also preview.frame for grabbing a still, template.instantiate for filling a saved template, and edit.undo and edit.redo.

The recipes page shows how those compose. The rough-cut recipe creates a project, imports each clip, places each one on the track where the previous one ended (reading clip durations back with project.get), and saves. The vertical-cut recipe adds a second timeline, sets the video to 1080 by 1920 at 30 frames per second, places the clips and rescales them, then exports. That second one is the job a social media team does by hand every week, and here it is a short script.

Errors come back with a machine-readable code, such as notOpen when you forget to open the project first or busy when you start a second export while one is running. An agent can branch on those instead of parsing prose, which is exactly what you want from a tool an LLM will call.

The MCP label, and what actually shipped

Trendshift's listing describes Concat as having "MCP and API support," and the README mentions an MCP API too. MCP, the Model Context Protocol, is the standard way tools plug into Claude, Codex and other agents, so that label is what made me look twice.

The project's own MCP page is refreshingly direct about it: the MCP server is "planned and prototyped, not shipped." A prototype with 17 tools went up as pull request #69 and was closed without merging because it re-implemented the transport instead of reusing Concat's existing server. The page says a check of version 0.2.6 found no MCP crate or dependency in the code.

I like this. Plenty of projects let a roadmap item sit in a feature list for months. Concat wrote a page explaining the gap and how to work around it.

The workaround is a bridge. You run Concat's socket server, then a small stdio MCP server (one your agent host starts) that opens a connection to Concat and turns each tool call into an API call. The docs sketch it in Python with the mcp package's FastMCP, reading the port from CONCAT_PORT (default 7420) and the token from CONCAT_API_TOKEN. They also list its limits: one connection, no streaming progress, and a hand-picked tool list. You decide which methods the agent gets, and you write that list yourself.

The security model, in plain words

Concat's socket server is careful in the ways that matter most, and the docs are honest about the rest.

Every connection has to present a token as its first line, loopback included. If you don't set one, the server makes up a 128-bit token that only the process that started it knows. A wrong or missing token gets an unauthorized error and a closed connection. That closes the usual gap with tools that listen on localhost, where any other program on the machine could otherwise connect and start issuing commands.

Writes are fenced. The --root flag sets the folders the API may write under, and it defaults to your home folder. Pass a narrower folder and the agent can only save projects and exports there.

Reads are not fenced, and the docs say so: "Reads are not confined: anyone with the token can probe any file the server's user can read." An agent holding the token can ask Concat to open or import any file your account can see. On a laptop with SSH keys and a downloads folder full of documents, that is a real reach.

The traffic is not encrypted either. The docs say to keep the port off the open internet and to bind beyond loopback only behind an SSH tunnel or a TLS reverse proxy. Their summary is the right mental model: "A server is a door into the machine, as the user running it."

Put this into practice

The lowest-friction path depends on whether you already build Rust projects.

From a release build. Download v0.2.7 from the releases page, open the editor, and turn on the API from Settings, Remote. That serves the same API on 127.0.0.1:7420, and it requires a token. Every connection opens with the auth line before anything else:

{ "jsonrpc": "2.0", "id": 0, "method": "auth", "params": { "token": "<your token>" } }

Then send {"jsonrpc":"2.0","id":1,"method":"version"} and read the capabilities list in the reply. The docs recommend this as the first call because it tells you what your build serves.

From source. The README lists Rust 1.93 or later, FFmpeg 7 or later development libraries, cmake and a C++ compiler. The README also says source builds add gRPC and a command-line tool. Then:

cd src
cargo run -p concat-cli -- api '{"method":"version"}'

Stdin mode is the safest way to let an agent drive Concat, because no socket exists for anything else to find.

Scope the server if you use one. Give it its own working folder and its own token:

cargo run -p concat-cli -- serve --root ~/agent-edits --token "$CONCAT_API_TOKEN"

That keeps writes inside ~/agent-edits. It does not limit reads, so run it as a user account that can't see files the agent has no business opening, or keep the agent's tool list to methods that only touch the project folder.

Start with one recipe. Pick the rough cut or the vertical cut from the recipes page, and run the calls by hand once on throwaway clips. Then hand the same sequence to your agent as a script or as a small set of bridge tools. You will see which errors come back (forgetting project.open returns notOpen) before the agent meets them on real footage.

Honest limitations

It is beta, and the v0.2.7 release notes (corrected on October 16) say so plainly. A blur or glow effect can still stall exports on Windows (#297), the Windows build is not code-signed yet, the Android build had not been checked on a phone, and Intel Macs need macOS 13.4 or later.

There is no MCP server yet. If your agent host only speaks MCP, you are writing and maintaining the bridge, including its tool list and its handling of export progress.

AGPL-3.0-or-later is a strong copyleft license, which matters if you plan to modify Concat and offer it to others, including over a network. The developer docs say a program that only talks to Concat over the API is a client, and the project's LICENSE-EXCEPTIONS.md lets qualifying clients and plugins use their own license only while they talk to Concat through its documented interfaces. Read both before you ship anything commercial on top of it.

The privacy claim deserves a footnote. The README says "Nothing uploads" and "100% local," and it also links a policy describing "what Concat sends over the network (nothing you did not ask for)." Model downloads, at minimum, need a connection. If you edit sensitive footage, read that policy and watch the traffic yourself once.

And the API's read access is broad. A token in the wrong place is read access to your home directory.

Where this leaves you

Concat is a working answer to a question agent builders keep running into: what happens when the tool you need is a desktop app? You give it an API that mirrors the window, protect it with a token, and let the agent drive. The pieces are there today in the CLI and the socket server. The MCP server is a promise with an honest status page.

Try one recipe this week by hand. If the export comes out the way you expected, you have just found out how much of your video work was really a list of API calls.

Sources: jub0t/Concat repository and README · Concat v0.2.7 release, October 13, 2026, notes corrected October 16 · Concat developer docs · JSON-RPC transport · MCP status page · Recipes. Docs read October 16, 2026; the MCP page describes the tree as of 0.2.6.