Thirteen named feeds make a configuration shelf, not a TV app
qist/tvbox collects configurations for OK Video, TVBox, and CatVod clients. The README describes 13 numbered files or feeds, ranging from a small selection to large combinations of video-on-demand sources, live channels, parsers, and JavaScript-based providers. You bring the player; this repository tells that player where and how to look.
That distinction changes the buying decision. There is no single server or desktop program to launch, and a working configuration can depend on remote URLs maintained by unrelated people. The maintainer calls this a personal repository, asks users to fork it, and says validity and timeliness are not guaranteed.
Version 1.1.3 changes how CatVodOpen reads a private fork
For CatVodOpen, the README splits its advice around version 1.1.3. Newer clients use a github:// string that includes a token and points to dist/index.js.md5; older clients use a different Gitee path. It also says CatVodOpen supports only private repositories with DAV in this setup. That is enough to get an experienced user oriented, though it assumes familiarity with the client and its configuration screen.
Embedding an access token in a configuration URL deserves care. Scope the token to the smallest private repository permission available, keep the string out of screenshots and shared logs, and rotate it if exposed. Those are operational precautions, not features supplied by qist/tvbox. The README also says the app needs storage permission or authentication data can be lost because it cannot write to disk. On a managed device, that permission must fit the organization's policy.
What happened when we ran it
commit 577412f produced no install, build, test, dependency, or vulnerability result in the lab. The harness classified the JavaScript repository as having no supported ecosystem and found no Dockerfile. That outcome fits what the root contents show: qist/tvbox behaves as data and scripts consumed by other apps, rather than a package with a documented local build target.
The absence of a run result should not be read as a pass or a failure. We have no measured claim about whether jsm.json, any playlist, or any third-party parser worked on September 14, 2026. Validating those items would require a compatible client, network access to each source, and any required accounts. The repository's own disclaimer tells users to judge legality, accuracy, completeness, and validity for themselves, which is a larger burden than syntax checking a JSON file.
More than 10 Aliyun connections can put an account at risk
Cloud-drive integration brings account consequences. The README says Aliyun may restrict or ban accounts when accelerated use exceeds 10 concurrent connections. It describes Xunlei restrictions as stricter and warns against one token being used by several people in different locations. It also mentions 32-character token and open-token flows for original-quality transfers. These are warnings from the repository, not guarantees about either provider's current policy.
Issue 93, opened May 26, 2026 and updated August 19, reports that cloud-drive logins disappeared after upgrading a client to version 5.5.2. The reporter says rescanning showed success while the client still appeared logged out. That report does not identify the cause, but it is directly relevant to anyone adopting configurations around stored credentials. Test account login, restart behavior, and playback before relying on a living-room device that is hard to debug remotely.
The September 14 push shows upkeep, while 22 issues and PRs remain
GitHub recorded a last push on September 14, 2026, the day we fetched the repository. It also showed 11,283 stars and 22 open issues and pull requests. Recent threads include login loss, unusable configuration files, token placement, and basic requests for usage instructions. That mix suggests the files are being changed and people use them, while the support surface still assumes community troubleshooting rather than a maintained product contract.
GitHub returned no latest release for the repository. A missing release does not mean the project is abandoned, especially with a same-day push. It does remove a convenient stable checkpoint for users. Pinning a commit in a private fork gives you a known configuration state, but streams and remote parsers can still change underneath it. Review diffs before pulling updates, especially when they touch executable JavaScript, JAR files, proxy domains, or credential handling.
No declared license blocks a clean organizational adoption
GitHub reports no license for qist/tvbox. The README adds its own restrictions: study and research only, no commercial use, no redistribution by public accounts or media, no use in mainland China, and deletion within 24 hours. Those terms do not resemble a standard open-source license. A company that needs clear rights to modify, redistribute, or ship the material has enough reason to stop before assessing the technical convenience.
Rights to the streams are a separate question. The repository says resources came from other contributors and disclaims their legality and accuracy. A configuration that loads in FongMi TV is not evidence that each underlying source is authorized in your country. For a personal experiment, verify every source and accept that it may vanish. For a product, school, workplace, or paid service, use licensed media sources and software with explicit redistribution terms.
A player repository is the better starting point for owned software
FongMi/TV, q215613905/TVBoxOS, and takagen99/Box are actual client repositories named in the qist README. They do not solve content licensing, but they let a developer inspect application code, releases, and build instructions rather than beginning with somebody else's changing feed list. Choose among them by target device and playback needs, then supply sources you are permitted to use.
qist/tvbox makes sense for a narrow audience: Chinese-reading hobbyists who already have a compatible client and want a maintained menu of community configurations. The lack of a runnable target is only part of the caution. No declared license, explicit use restrictions, volatile external feeds, token handling, and account warnings make it a poor foundation for organizational use. Its 11,283 stars do not cancel those terms.