Atlas / MCP servers / dreamrec / LivePilot

LivePilotBLOCK

Name: LivePilot
Author: dreamrec

mcp/dreamrec/livepilot

MCP server by dreamrec · ableton · ableton live · agent · Audited 2026-10-08

Talk to Ableton Live 12 through your AI client. Build, edit, listen, compare, and learn from your choices — 474 tools across 57 domains.

Verdict

BLOCK

Grade

Trust score

65 /100

Exposed tools

200 291r · 156w · 27d

Transport

stdio · streamable-http

License

NOASSERTION

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

██╗     ██╗██╗   ██╗███████╗██████╗ ██╗██╗      ██████╗ ████████╗
██║     ██║██║   ██║██╔════╝██╔══██╗██║██║     ██╔═══██╗╚══██╔══╝
██║     ██║██║   ██║█████╗  ██████╔╝██║██║     ██║   ██║   ██║
██║     ██║╚██╗ ██╔╝██╔══╝  ██╔═══╝ ██║██║     ██║   ██║   ██║
███████╗██║ ╚████╔╝ ███████╗██║     ██║███████╗╚██████╔╝   ██║
╚══════╝╚═╝  ╚═══╝  ╚══════╝╚═╝     ╚═╝╚══════╝ ╚═════╝    ╚═╝

Make the change. Hear what happened. Keep what works. LivePilot connects an AI client to Ableton Live 12. Sketch ideas, edit the set, compare versions, and learn from the choices you keep. 474 tools · 57 domains · macOS + Windows

[!NOTE] LivePilot works with any MCP client, including Claude Code, Claude Desktop, Codex, Cursor, VS Code, and Windsurf. Changes inside the Live set use Ableton's undo stack. Downloads, saved memory, library scans, and installer changes happen outside the set and cannot be undone from Ableton.

[!WARNING] LivePilot is moving quickly. Pin a version for repeatable studio or live-performance setups, and check the [changelo

Read from source at commit 1a662479debeOBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)

claude mcp add livepilot -- npx -y [email protected]

Exposed tools (200)

291 read · 156 write · 27 destructive. Blast radius: 27 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_arrangement_notes`	write	Add MIDI notes to an arrangement clip.
`add_drum_rack_pad`	write	Add a new pad (chain) to a Drum Rack and load a sample into it — atomic.
`add_notes`	write	Add MIDI notes to a clip. notes is a JSON array: [{pitch, start_time, duration, velocity?, probability?, velocity_deviation?, release_velocity?}].
`add_rack_macro`	write	Add one macro to a Rack, raising visible_macro_count by 1 (Live 11+).
`add_session_memory`	write	Add an ephemeral session memory entry.
`add_warp_marker`	write	Add a warp marker to an audio clip at the specified beat position.
`add_wavetable_mod_route`	write	Create a modulation routing on a Wavetable device (Live 11+).
`analyze_composition`	write	Run full composition analysis on the current Ableton session.
`analyze_for_automation`	read	Analyze a track
`analyze_harmony`	read	Analyze harmony of a MIDI clip: chords, Roman numerals, progression.
`analyze_loop_for_extension`	read	Read-only analyzer for develop mode — returns SeedState for a scene.
`analyze_loudness`	read	Analyze the integrated loudness of an audio file (OFFLINE — needs a rendered file).
`analyze_loudness_live`	read	Analyze the currently-playing master output
`analyze_midi_file`	read	Analyze a .mid file — works offline, no Ableton needed.
`analyze_mix`	write	Build the available mix state and run all critics.
`analyze_outcomes`	read	Analyze accumulated outcome memories to identify user taste patterns.
`analyze_phrase_arc`	read	Analyze a captured audio phrase for musical quality.
`analyze_reference_gaps`	read	Analyze gaps between your project and a reference.
`analyze_sample`	read	Analyze a sample and build a complete SampleProfile.
`analyze_sound_design`	write	Build full sound design state and run all critics for a track.
`analyze_spectrum_offline`	read	Analyze the frequency spectrum of an audio file (offline — no Ableton needed).
`analyze_synth_patch`	write	Extract a SynthProfile for a native synth on the given track+device.
`analyze_transition`	read	Analyze the transition boundary between two sections.
`apply_automation_recipe`	write	Apply a named automation recipe to a session clip.
`apply_automation_shape`	write	Generate and apply an automation curve to a session clip.
`apply_creative_constraint_set`	write	Apply creative constraints to focus suggestions.
`apply_follow_action_preset`	write	Apply a named follow-action preset to a clip (Live 12.0+).
`apply_gesture_template`	write	Apply a compound gesture template — multiple coordinated automation gestures.
`apply_semantic_move`	write	Compile and optionally execute a semantic move against the current session.
`assign_clip_groove`	read	Assign a groove to a clip (Live 11+).
`atlas_audition`	read	v1.25 — Full sidecar dump for one atlas URI (hybrid surface Layer B).
`atlas_chain_suggest`	read	Suggest a full device chain for a track role.
`atlas_compare`	read	Compare two devices — strengths, weaknesses, and recommendation for a role.
`atlas_cross_pack_chain`	write	Execute a cross-pack signature recipe step-by-step (Pack-Atlas Phase F).
`atlas_demo_story`	read	Generate a track-by-track narrative + production-sequence for a demo .als (Pack-Atlas Phase E).
`atlas_describe_chain`	read	Free-text describe-a-chain: a sentence like
`atlas_device_info`	read	Get complete atlas knowledge about a device — parameters, recipes, pairings, gotchas.
`atlas_explore`	read	v1.25 — Refined per-role atlas candidate query (hybrid surface Layer B).
`atlas_extract_chain`	read	Rebuild a specific demo track
`atlas_macro_fingerprint`	read	Find presets with similar macro state to the source —
`atlas_pack_aware_compose`	read	Bootstrap a project with pack-coherent track selection given an aesthetic brief (Pack-Atlas Phase F).
`atlas_pack_info`	read	Inspect a single Ableton pack — device list + enrichment coverage.
`atlas_search`	read	Search the device atlas for instruments, effects, kits, or plugins.
`atlas_substitute`	read	v1.25 — Anti-tag-driven swap for a chosen candidate (hybrid surface Layer B).
`atlas_suggest`	read	Suggest devices for a production intent.
`atlas_techniques_for_device`	read	Reverse-lookup: what techniques / principles reference this device?
`atlas_transplant`	read	Adapt a structure from one musical context to another (Pack-Atlas Phase C).
`audit_layer`	write	Run the §5 layer-precision audit on a single track in one call.
`augment_with_samples`	write	Plan sample-based layers to add to the existing session.
`back_to_arranger`	read	Switch playback from session clips back to the arrangement timeline.
`batch_set_parameters`	write	Set multiple device parameters in one call.
`build_project_brain`	read	Build a full Project Brain snapshot from the current Ableton session.
`build_reference_profile`	read	Build a reference profile from an audio file or style/genre name.
`build_song_brain`	read	Build the musical identity model for the current song.
`build_world_model`	read	Build a WorldModel snapshot of the current Ableton session.
`capture_and_insert_scene`	write	Capture currently-playing clips and insert them as a new scene. Distinct from capture_midi.
`capture_audio`	read	Capture audio from Ableton Live to a WAV file on disk.
`capture_midi`	read	Capture recently played MIDI notes into a new clip.
`capture_stop`	write	Stop an in-progress audio capture early.
`check_brief_compliance`	read	Check whether an intended tool call complies with the active creative brief.
`check_clip_key_consistency`	read	Cross-check a clip
`check_flucoma`	read	Check if FluCoMa is installed and sending data.
`check_safety`	read	Validate a proposed action against safety policies before executing.
`check_translation`	read	Check playback robustness — mono safety, small speakers, harshness.
`classify_progression`	read	Classify a chord progression by its neo-Riemannian transform pattern.
`classify_simpler_slices`	read	Classify each Simpler slice as KICK / SNARE / HAT / ghost via FFT analysis.
`clear_clip_automation`	destructive	Clear automation envelopes from a session clip.
`clear_clip_follow_action`	destructive	Disable follow action on a clip (Live 12.0+).
`clear_scene_follow_action`	destructive	Disable a scene
`clear_simpler_slices`	destructive	Remove all manual slices from the Simpler (Live 11+).
`commit_experiment`	write	Commit the winning branch — re-apply its moves permanently.
`commit_preview_variant`	write	Commit the chosen variant from a preview set — APPLIES the plan.
`compare_experiments`	read	Compare and rank all evaluated branches in an experiment.
`compare_phrase_impact`	read	Compare phrase-level emotional impact across multiple sections.
`compare_phrase_renders`	read	Compare multiple audio captures and rank by musical quality.
`compare_preview_variants`	write	Compare and rank variants in a preview set.
`compare_to_reference`	read	Compare a mix to a reference track (offline — no Ableton needed).
`compile_goal_vector`	read	Compile a user request into a validated GoalVector.
`compile_hybrid_brief`	write	Merge 2+ concept packets into a single hybrid brief (v1.19 Item B).
`compose`	write	Plan, brief, or execute a multi-layer composition from a text prompt
`compose_fast_apply`	write	Phase-3 of the LLM-creative fast mode (2026-05-01).
`compose_full_apply`	write	Phase-3 of full mode (v1.24 LLM-creative): execute the agent-designed plan.
`compressor_set_sidechain`	write	Configure a Compressor
`consult_ableton_knowledge`	read	Tier-3: Ableton Knowledge consultation orchestrator.
`continue_playback`	read	Continue playback from the current position.
`copy_device_state`	read	Copy one A/B state to the other (Live 12.3+).
`corpus_add_source`	write	Register a new scan source in the user manifest.
`corpus_canonicalize_plugins`	read	Dedupe the plugin inventory by canonical vendor + name; prefer VST3 as
`corpus_cluster_plugins`	read	Group canonical plugins by vendor; return a cluster manifest the agent
`corpus_detect_plugins`	read	Phase 2.1 + 2.2 — detect installed VST3 / AU / VST2 / AAX / LV2 plugins
`corpus_discover_manuals`	read	Phase 2.3 + 2.4 — find local manual files for a detected plugin and
`corpus_emit_synthesis_briefs`	read	Phase 4 — emit sonnet-subagent briefs for plugin identity synthesis.
`corpus_init`	read	Initialize the user-corpus output directory + manifest.yaml.
`corpus_list_scanners`	read	Enumerate registered scanner types and their supported file extensions.
`corpus_remove_source`	destructive	Remove a source from the manifest.
`corpus_research_targets`	read	Phase 3 — emit a structured WebSearch task packet for the agent to fulfill.
`corpus_scan`	write	Run scans on the user corpus.
`corpus_setup_wizard`	write	First-run setup — survey the user
`corpus_status`	read	Report manifest contents + freshness for each source.
`corpus_trim_plugin_identity`	read	Slim a plugin
`create_arrangement_clip`	write	Duplicate a session clip into Arrangement View at a specific beat position.
`create_audio_clip_on_take_lane`	write	Create an arrangement audio clip on a specific take lane (Live 12.2+).
`create_audio_track`	write	Create a new audio track. index=-1 appends at end.
`create_clip`	write	Create an empty MIDI clip in a clip slot (length in beats).
`create_cue_point`	write	Create a named locator at a beat position in the Arrangement.
`create_experiment`	write	Create an experiment set to compare multiple approaches.
`create_midi_clip_on_take_lane`	write	Create an arrangement MIDI clip on a specific take lane (Live 12.2+).
`create_midi_track`	write	Create a new MIDI track. index=-1 appends at end.
`create_native_arrangement_clip`	write	Create an empty MIDI clip directly in Arrangement View (Live 12.1.10+).
`create_preview_set`	write	Create a preview set with multiple creative options.
`create_return_track`	write	Create a new return track.
`create_scene`	write	Create a new scene. index=-1 appends at end.
`create_take_lane`	write	Create a new take lane on a track (Live 12.2+).
`crop_simpler`	read	Crop a Simpler
`delete_clip`	destructive	Delete a clip from a clip slot. This removes all notes and automation. Use undo to revert.
`delete_device`	destructive	Delete a device from a track. Use undo to revert if needed.
`delete_rack_variation`	destructive	Delete a Rack variation by index (Live 11+).
`delete_scene`	destructive	Delete a scene by index. Use undo to revert if needed.
`delete_track`	destructive	Delete a track by index. Use undo to revert if needed.
`detect_hook_neglect`	read	Detect if a strong hook exists but is underused across sections.
`detect_identity_drift`	read	Detect whether recent changes have damaged the song
`detect_payoff_failure`	read	Detect where the song should deliver a payoff but doesn
`detect_repetition_fatigue`	read	Detect repetition fatigue — are patterns overused?
`detect_role_conflicts`	read	Detect role conflicts — are tracks fighting for the same musical space?
`detect_stuckness`	read	Detect whether the session is losing momentum.
`detect_theory_issues`	read	Detect music theory issues: parallel fifths/octaves, out-of-key notes,
`develop_apply`	write	Phase-3 develop mode: server-side execute the agent
`develop_hook`	read	Suggest development strategies for a hook.
`discard_experiment`	read	Discard an entire experiment — no changes are kept.
`discard_preview_set`	write	Discard an entire preview set and all its variants.
`discard_wonder_session`	read	Reject all Wonder variants and close the session.
`distill_reference_principles`	read	Learn musical principles from a reference — not surface traits.
`duplicate_arrangement_notes`	read	Duplicate specific notes in an arrangement clip by ID, with optional time offset (beats).
`duplicate_clip`	read	Duplicate a clip from one slot to another.
`duplicate_notes`	read	Duplicate specific notes by ID (JSON array of ints), with optional time offset (in beats).
`duplicate_scene`	read	Duplicate a scene (copies all clip slots).
`duplicate_track`	read	Duplicate a track (copies all clips, devices, and settings).
`ensure_analyzer_on_master`	read	Idempotent pre-flight: load LivePilot_Analyzer on master if missing.
`enter_wonder_mode`	read	Activate Wonder Mode — stuck-rescue workflow with real diagnosis.
`evaluate_composition_move`	write	Evaluate whether a composition move improved the arrangement.
`evaluate_mix_move`	write	Score a mix change using the evaluation fabric.
`evaluate_move`	write	Evaluate whether a production move improved the mix toward the goal.
`evaluate_sample_fit`	write	Run the 6-critic battery to evaluate how well a sample fits the current song.
`evaluate_with_fabric`	write	Evaluate a move using the unified Evaluation Fabric.
`explain_preference_vs_identity`	read	Explain how taste preference and song identity score a candidate.
`explain_song_identity`	read	Explain the current song
`explain_taste_inference`	read	Explain why the system thinks the user prefers certain approaches.
`export_clip_midi`	read	Export a session clip
`extension_atlas_get`	read	Fetch a single overlay entry by namespace + entity_id.
`extension_atlas_list`	read	Enumerate user-local overlay namespaces and their entity_type counts.
`extension_atlas_search`	read	Search user-local atlas overlays under ~/.livepilot/atlas-overlays/.
`extract_piano_roll`	read	Extract a 2D piano roll matrix from a .mid file. Offline-capable.
`extract_timbre_fingerprint`	read	Build a TimbralFingerprint from analysis dicts.
`find_and_load_device`	read	Search the browser for a device by name and load it onto a track.
`find_primary_hook`	read	Find the most salient hook in the current session.
`find_voice_leading_path`	read	Find the shortest neo-Riemannian path between two chords.
`fire_clip`	read	Launch/fire a clip slot.
`fire_scene`	read	Fire (launch) a scene, triggering all its clips.
`fire_scene_clips`	read	Fire a scene, optionally filtering to specific tracks.
`flatten_track`	write	Flatten a frozen track — commit rendered audio permanently.
`force_arrangement`	destructive	Force ALL tracks to follow the arrangement and start playback.
`force_link_beat_time`	destructive	Force Ableton Link to a specific beat time (if supported by this Live version).
`freeze_track`	read	Freeze a track — render all devices to audio for CPU savings.
`generate_additive_process`	read	Generate an additive process (Philip Glass technique).
`generate_automation_curve`	read	Generate automation curve points WITHOUT writing them.
`generate_constrained_variants`	read	Generate creative variants under active constraints.
`generate_countermelody`	read	Generate a countermelody using species counterpoint rules.
`generate_euclidean_rhythm`	read	Generate a Euclidean rhythm using the Bjorklund algorithm.
`generate_m4l_effect`	read	Generate a Max for Live device from gen~ codebox code.
`generate_phase_shift`	read	Generate a phase-shifted canon (Steve Reich technique).
`generate_reference_inspired_variants`	read	Generate creative variants inspired by a distilled reference.
`generate_tintinnabuli`	read	Generate a tintinnabuli voice (Arvo Pärt technique).
`get_action_ledger_summary`	read	Return a summary of recent semantic moves from the action ledger.
`get_anti_preferences`	read	Return all recorded anti-preferences — dimensions the user has repeatedly disliked.
`get_appointed_device`	read	Return the Blue Hand (appointed/focused) device location as (track_index, device_index, track_name, device_name).
`get_arrangement_clips`	read	Get all arrangement clips on a track.
`get_arrangement_notes`	read	Get MIDI notes from an arrangement clip. Returns note_id, pitch, start_time,
`get_automation_recipes`	read	List all available automation recipes with descriptions.
`get_automation_state`	read	Get automation state for all parameters on a device.
`get_browser_items`	read	List items at a browser path (e.g.,
`get_browser_tree`	read	Get an overview of browser categories and their children.
`get_capability_state`	read	Probe the runtime and return a capability state snapshot.
`get_chroma`	read	Get 12 pitch class energies from FluCoMa for real-time chord detection.
`get_clip_automation`	read	List all automation envelopes on a session clip.
`get_clip_file_path`	read	Get the audio file path of a clip on disk.
`get_clip_follow_action`	read	Read a clip
`get_clip_groove`	read	Read a clip
`get_clip_info`	read	Get detailed info about a clip: name, length, loop, launch settings.
`get_clip_scale`	read	Read a clip
`get_composition_plan`	read	Preview what compose would do without executing or spending credits.
`get_control_surface_info`	read	Read detailed info about a single control surface.
`get_cue_points`	read	Get all cue points in the arrangement.
`get_detected_key`	read	Get the detected musical key and scale of the current session.
`get_device_ab_state`	read	Read a device
`get_device_info`	read	Get info about a device: name, class, type, active state, parameter count.
`get_device_parameters`	read	Get all parameters for a device with names, values, and ranges.
`get_device_presets`	read	List available presets for an Ableton device (e.g.
`get_display_values`	read	Get human-readable display values for all device parameters.
`get_emotional_arc`	read	Analyze the emotional arc of the arrangement — tension, climax, resolution.
`get_freeze_status`	read	Check if a track is frozen.

Trust audit

BLOCKgrade D · trust 65/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (5 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

mcp_server/atlas/overlays.py:357

parsed = yaml.load(f, Loader=_YAML_LOADER)

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

MEDIUMInventory / provenance · inv.binary · CWE-1104

m4l_device/LivePilot_Analyzer.adv

LivePilot_Analyzer.adv

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

m4l_device/LivePilot_Elektron.amxd

LivePilot_Elektron.amxd

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

m4l_device/LivePilot_MIDITool_Generate.amxd

LivePilot_MIDITool_Generate.amxd

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

m4l_device/LivePilot_MIDITool_Transform.amxd

LivePilot_MIDITool_Transform.amxd

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

remote_script/LivePilot/__init__.py:137

importlib.import_module(full_name)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

clear_clip_automation, clear_clip_follow_action, clear_scene_follow_action, clear_simpler_slices, corpus_remove_source, delete_clip, delete_device, delete_rack_variation, delete_scene, delete_track, f

Why it matters. 27 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.mcpbignore

.mcpbignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/composer/develop/test_brief_builder.py:187

mod = __import__(f"mcp_server.composer.develop.{mod_info.name}", fromlist=[""])

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/composer/full/test_no_form_templates.py:32

mod = __import__(mod_info.name, fromlist=[""])

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/composer/full/test_no_form_templates.py:51

mod = __import__(mod_info.name, fromlist=[""])

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/composer/full/test_no_form_templates.py:67

parent_pkg = __import__(parent_pkg_name, fromlist=[""])

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

mcp_server/curves.py:329

h = hashlib.md5(f"{x:.6f}:{s:.6f}".encode(), usedforsecurity=False).hexdigest()

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

mcp_server/curves.py:378

h = hashlib.md5(f"{i}:{s:.6f}".encode(), usedforsecurity=False).hexdigest()

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

mcp_server/curves.py:615

h = hashlib.md5(f"{i}:{s:.6f}".encode(), usedforsecurity=False).hexdigest()

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

mcp_server/sample_engine/tools.py:1258

digest = hashlib.md5(file_hash.encode()).hexdigest()[:12]

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_midi_io.py:249

filename = "../../../evil.mid"  # relative path with traversal

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_security_batch_fixes.py:66

traversal_id = "../../etc/passwd"

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/manual/splice-endpoint-capture.md:59

1. Open mitmweb (web UI at http://127.0.0.1:8081).

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/manual/troubleshooting.md:47

To use several AI clients at once, run one shared server instead: start it with `LIVEPILOT_TRANSPORT=http` (optionally `LIVEPILOT_HTTP_PORT`, default `8109`) and point each client at `http://127.0.0.1

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

requirements.txt

numpy, fastmcp, midiutil, pretty_midi, pyloudnorm, soundfile, scipy, mutagen

Why it matters. 11 requirement(s) not pinned with ==

Fix. pin exact versions

INFOInventory / provenance · inv.oversize · CWE-1104

m4l_device/LivePilot_Analyzer.amxd

m4l_device/LivePilot_Analyzer.amxd

Why it matters. 6764431 bytes not read

INFOInventory / provenance · inv.oversize · CWE-1104

mcp_server/atlas/device_atlas.json

mcp_server/atlas/device_atlas.json

Why it matters. 3506347 bytes not read

INFOPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427

livepilot/skills/livepilot-creative-director/SKILL.md:130

The `mix` family is dominant only when the user asks for balance, loudness, headroom, masking, stereo translation, send levels, or an explicit mix pass. Otherwise use mix analysis as safety/evidence a

INFOPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427

livepilot/skills/livepilot-mix-engine/SKILL.md:14

Use `set_track_volume`, `set_track_pan`, and broad send-level balancing only when the user explicitly asks for balance/level/pan/send work, or when analyzer evidence shows a safety/translation problem

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha 1a662479debefull audit observations/trust-audit/mcp-server/dreamrec__livepilot.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-08	`1a662479debe`	BLOCK	D	65	first audit

Questions

What is the LivePilot MCP server?

Talk to Ableton Live 12 through your AI client. Build, edit, listen, compare, and learn from your choices — 474 tools across 57 domains.

What tools does LivePilot expose?

200 in total: 291 read-only, 156 that write, and 27 that can delete or overwrite (clear_clip_automation, clear_clip_follow_action, clear_scene_follow_action, clear_simpler_slices, corpus_remove_source). Every one is listed on this page with its risk.

Is LivePilot safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (65/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 27 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does LivePilot need?

It reads LIVEPILOT_BRIDGE_TOKEN_DISABLE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does LivePilot run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as livepilot at 1.30.0.

How current is this page?

The grade is for one exact copy of the source (1a662479debe), read on 2026-10-08. The repository is watched and re-audited when it changes.

Source	dreamrec/livepilot
npm	`livepilot@1.30.0`
Transports	stdio · streamable-http
Credentials it reads	`LIVEPILOT_BRIDGE_TOKEN_DISABLE`
License	NOASSERTION
Activity	pushed 0d ago