This program has not been audited, so please treat it accordingly. It runs on your own computer, talks to Discord and the player (MPC-HC, MPC-BE, MPC-QT, mpv, VLC, PotPlayer or IINA, or on Linux a video player over D-Bus) locally, and to Kodi at the address you enter once you set its password (this computer by default): its web server, and port 9090 there for its notifications. Every other address it reaches is in the list below; a test fails when the code names one that is not. The Privacy tab's Recent connections shows which of them it actually asked since it started, how often and when.

Asked by the program. The catalogs, each with its own switch on the Privacy tab:

And these, only for what they are named for:

Once signed in, it also reads from your own Plex server, and from the Jellyfin or Emby server whose address you entered (Accounts tab): to sign in, to read its session list and to sign out.

Loaded by the window and by Discord, not by the program: the cover on your status and in the preview comes from the image host the catalog named for it (image.tmdb.org for TMDB), and the player's logo from this repository on raw.githubusercontent.com.

Only linked, opened in your browser or shown as a button on your status: app.plex.tv (approving the Plex sign-in), stremio.com (entering the Stremio link code), and the title's page on www.imdb.com, www.themoviedb.org, www.tvmaze.com, kitsu.io or the catalog that found it.

The Plex, Stremio, Jellyfin and Emby sign-ins are kept in config.json as plain text; a password you type goes to your own server once and is never stored. The Plex sign-in goes only to plex.tv and to a server that has first shown, without it, that it is the chosen server; a server shared with you gets the key plex.tv made for it, never your account's. Kodi's password is kept in config.json as plain text too, as VLC's is.

MPC-HC's web interface has no password and lets any web page read it (it answers every origin). While it is on, a website open in your browser could see what you play and send the player commands. "Set up the player connection" limits it to this computer, which keeps other devices out but not web pages you open here. Switch it off in MPC-HC (Options > Player > Web Interface) when you stop using this program.

If you find a security problem, please report it privately through GitHub's private vulnerability reporting rather than in a public issue. There is no guaranteed response time or fix, but reports are read.

Release files come with a SHA-256 checksum and a signed build record from GitHub. To check that a downloaded MPCvibedRPC.exe (or MPCvibedRPC-macos.zip, MPCvibedRPC-linux-amd64, ...) was built from this repository by its release workflow:

gh attestation verify MPCvibedRPC.exe --repo CptPakundo/MPCvibedRPC

You can also rebuild MPCvibedRPC.exe and the Linux programs yourself and compare: every release is published only after a second runner rebuilt them from the tag byte for byte. Check out the tag with the files as committed (LF line endings, for example git clone -c core.autocrlf=false), install the Go version named in .github/workflows/release.yml, run tools/ci/reproduce.sh X.Y.Z out and compare the files' SHA-256 with the release's .sha256 files. The macOS app is built with Apple's tools and cannot be rebuilt this way.

The program itself is not code-signed, so Windows SmartScreen may warn about it. The macOS app only has an ad-hoc signature (no Apple Developer ID, not notarized), so macOS asks you to confirm its first start.