Atlas / MCP servers / brightlikethelight / Music21

Music21CAUTION

Name: Music21
Author: brightlikethelight

mcp/brightlikethelight/music21-1

MCP server by brightlikethelight · ai tools · docker · kubernetes · Audited 2026-10-09

🎵 Production-ready MCP server for music analysis & generation | FastMCP • music21 • OAuth2 • Docker | First music21 MCP integration with enterprise features

Verdict

CAUTION

Grade

Trust score

83 /100

Exposed tools

14 12r · 1w · 1d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/brightlikethelight/music21-mcp-server/actions/workflows/ci.yml) [](https://github.com/brightlikethelight/music21-mcp-server/actions/workflows/ci.yml) [](https://github.com/brightlikethelight/music21-mcp-server/actions) [](https://www.python.org/downloads/) [](https://opensource.org/licenses/MIT) [](https://github.com/astral-sh/ruff) [](https://modelcontextprotocol.io)

Professional music analysis with 4 different interfaces - MCP server, HTTP API, CLI tools, and Python library. Built on the powerful music21 library with protocol-independent architecture for maximum reliability.

🎯 Why Multiple Interfaces?

Based on 2025 research showing MCP has 40-50% production success rate, this project provides multiple pathways to the same powerful music21 analysis functionality:

📡 MCP Server - For Claude Desktop integration (when it works)
🌐 HTTP API - For web applications (reliable backup)
💻 CLI Tools - For automation (always works)
🐍 Python Library - For direct programming access

🎵 Core Music Analysis Features

Analysis Tools (13 Available)

Import & Export: MusicXML, MIDI, ABC, Lilypond, music21 corpus
Key Analysis: Multiple algorithms (Krumhansl, Aarden, Bellman-Budge)
Harmony Analysis: Roman numerals, chord progressions, cadence detection

Read from source at commit b28e6ea4c616OBSERVED · 2026-10-09

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add music21-mcp-server -- uvx music21-mcp-server

claude-desktop

{
  "mcpServers": {
    "music21-mcp-server": {
      "command": "uvx",
      "args": [
        "music21-mcp-server"
      ]
    }
  }
}

Exposed tools (14)

12 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`chord_analysis`	read	Analyze chord progressions in a score
`delete_score`	destructive	Delete a score from storage
`export_score`	read	Export a score to various formats
`generate_counterpoint`	read	Generate species counterpoint (1=note-against-note, 2=2:1, 3=3:1, 4=syncopated, 5=florid)
`harmonize_melody`	read	Generate harmonization for a melody in various styles (classical, jazz, pop, modal)
`harmony_analysis`	read	Perform harmony analysis (roman numeral or functional)
`health_check`	read	Check server and adapter health
`imitate_style`	read	Generate music imitating a specific composer style (bach, mozart, chopin, debussy) or analyze score for style
`import_score`	write	Import a score from various sources
`key_analysis`	read	Analyze the key signature of a score
`list_scores`	read	List all available scores
`pattern_recognition`	read	Recognize patterns in music
`score_info`	read	Get detailed information about a score
`voice_leading_analysis`	read	Analyze voice leading patterns in a score

Trust audit

CAUTIONgrade B · trust 83/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: none-observed
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (18)

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/music21_mcp/health_checks.py:347

module = __import__(dep_name)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_score

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.pre-commit-config.yaml

.pre-commit-config.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/music21_mcp/performance_cache.py:78

return hashlib.md5(cache_key_data.encode(), usedforsecurity=False).hexdigest()

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/music21_mcp/performance_cache.py:244

score_hash = hashlib.md5(

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/music21_mcp/performance_cache.py:253

score_hash = hashlib.md5(

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/music21_mcp/performance_optimizations.py:263

return hashlib.md5(str(pitches).encode(), usedforsecurity=False).hexdigest()[

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/music21_mcp/performance_optimizations.py:636

score_hash = hashlib.md5(