B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · Developer tools, Design & media
palmier-pro
macOS video editor built for AI
Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 46/100
- Rank
- Not ranked: outside the 500 most popular tools
- GitHub stars
- 14.6k
What it does
Palmier Pro is a macOS video editor designed to work natively with AI agents and MCP connectors, enabling automated video editing workflows. It appears to expose video editing capabilities through an MCP server interface, allowing AI systems to programmatically create, edit, and export video content.
Who it’s for
AI builders and developers integrating video generation or editing into agent workflows, and macOS-based content automation teams. Executives exploring AI-driven video production pipelines.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Follow the setup steps in the project’s official README: https://github.com/palmier-io/palmier-pro (opens external site)
Risks
- File system access: MCP server likely requires broad file I/O permissions to read/write video files; could be exploited to access unintended media or system files.
- Credential handling: Unclear how API keys or cloud export credentials (if supported) are stored and rotated; potential for leakage via agent prompts.
- Supply chain: Single maintainer repository (inferred from GitHub); limited peer review and slow update cadence (if any) may delay security patches.
- Prompt injection: Video metadata and file paths passed to agent could be manipulated to trigger unintended edits or system calls.
- Data exfiltration: No explicit audit or data-residency controls visible; raw video files could be sent to unexpected endpoints if agent is compromised.
How to stay secure
Least-privilege permissions
- Restrict folder access: Only grant palmier-pro permission to a dedicated "video projects" folder, not your entire hard drive or Desktop. This limits what files the AI agent can accidentally or maliciously access.
- Use a separate user account: Create a macOS user account just for video editing with palmier-pro. This prevents the agent from accessing your personal documents, photos, or passwords if compromised.
- Disable cloud sync temporarily: If you use iCloud or Dropbox, pause syncing while editing—prevents video files from being automatically uploaded to cloud services the agent might access.
Network isolation
- Disable internet when editing sensitive projects: Turn off Wi-Fi or use a firewall rule to block palmier-pro's network access unless you're actively uploading final exports. This stops unauthorized data transmission.
- Use a VPN or local network only: If the agent must connect online, route it through a VPN so third parties cannot see what data is being sent or received.
- Check for "phone home" behavior: In your Mac's firewall settings, monitor which servers palmier-pro contacts; unfamiliar IP addresses or frequent connections may indicate data exfiltration (sending files somewhere without your knowledge).
Monitoring
- Watch system resources: Open Activity Monitor while editing. If CPU, memory, or network usage spikes unexpectedly, the agent may be performing unwanted operations.
- Enable macOS file access logs: Use your Mac's System Settings to review which apps accessed files in the past 24 hours. Look for access to folders outside your video projects directory.
- Keep software updated: Check GitHub or the app's website weekly for security patches. A single maintainer means fixes may lag behind threats, so update immediately when available.
Red flags to watch for
- Unexpected file changes: If video files, system files, or personal documents are modified when you didn't edit them, the agent may be compromised.
- Unfamiliar prompts or outputs: If the AI agent suggests edits you didn't request or mentions files you don't recognize, someone may have injected malicious instructions via metadata or file names.
- Requests for passwords or API keys in chat: Never type credentials into the agent's chat interface. Legitimate tools should use secure key management, not text prompts.
- Crashes or freezes during specific edits: Repeated crashes when opening certain video files could indicate an attack exploiting the file format to run malicious code.
Alternatives
- FFmpeg MCP connector – Lower-level, widely-audited, command-line video tooling with stronger Linux/cross-platform support.
- Descript API – Cloud-based video/audio editing with clearer permissions and audit trails; requires paid account.
- OpenAI Whisper + video composition – Decoupled speech-to-text + custom editing logic; more transparent and modular.
- RunwayML API – AI-native video generation (not editing); different use case but often paired with agent workflows.