Atlas / MCP servers / getdynamoi / mcp

mcpBLOCK

mcp/getdynamoi/mcp

Connect ChatGPT, Claude, Cursor, and other AI agents to Dynamoi for free Spotify Smart Links, music promotion campaigns, analytics, and distribution.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
5 5r · 0w · 0d
Transport
streamable-http
License
MIT
Stars
3
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Music marketing for AI agents.

[](https://www.npmjs.com/package/@dynamoi/mcp) [](./LICENSE) [](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.getDynamoi/dynamoi) [](https://cursor.com/install-mcp?name=dynamoi&config=eyJ1cmwiOiJodHRwczovL2R5bmFtb2kuY29tL21jcCJ9) [](https://insiders.vscode.dev/redirect/mcp/install?name=dynamoi&config=%7B%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fdynamoi.com%2Fmcp%22%7D)

The Dynamoi MCP server connects ChatGPT, Claude, Cursor, and other AI agents to Dynamoi, the music marketing platform for artists, labels, and managers. Agents can create free Spotify Smart Links, run managed YouTube and Meta promotion campaigns, read campaign and Smart Link analytics, check platform status, and apply for music distribution. Use the hosted MCP server, or use this package as a library.

https://dynamoi.com/mcp

The hosted server needs no install. Point any MCP client that supports remote Streamable HTTP and OAuth at that URL, and the user signs in with their Dynamoi account.

About Dynamoi

Dynamoi is a music marketing platform founded in 2021 by Trevor Loucks. It runs managed Meta and YouTube ad campaigns, music distribution, and royalty analytics for independent artists, labels, managers, and YouTube creators, alongside free Smart Links and analytics.

  • Free Smart Links: release pages and artist hubs built from Spotify

URLs, with link analytics, themes, validated pixel IDs, and team seats.

  • Managed Smart Campaigns: Meta ads that promote Spotify tracks
Read from source at commit 70d7a68956bcOBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add mcp -- npx -y @dynamoi/[email protected]
claude-desktop
{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@dynamoi/[email protected]"
      ]
    }
  }
}
03

Exposed tools (5)

5 read · 0 write · 0 destructive.

ToolRiskDescription
AurorareadColor-rich gradient atmosphere for pop, electronic, and high-energy releases.
BrutalistreadBold, poster-like treatment for artists who want sharp contrast and direct calls to action.
CinematicreadMoody cover-forward layout for cinematic, intimate, or premium release moments.
ClassicreadClean editorial layout for release pages that should feel calm and polished.
pingread
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (3 observation(s))
Shell
declared (1 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (7)

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94
src/server/workspace/workspace-script.generated.ts:2
atob( ... new Function(
Why it matters. decodes a payload and executes it
MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/server/messaging.test.ts:2
import packageJson from "../../package.json" with { type: "json" };
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/server/messaging.test.ts:3
import serverJson from "../../server.json" with { type: "json" };
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/server/workspace/tool.ts:3
import type { ResultEnvelope } from "../../types";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/server/workspace/workspace.test.ts:5
import { DYNAMOI_MCP_TOOL_SCOPES } from "../../auth/protected-resource";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/server/workspace/workspace.test.ts:254
"/../../",

Gates applied: critical_finding, no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 70d7a68956bcfull audit observations/trust-audit/mcp-server/getdynamoi__mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1170d7a68956bcBLOCKD69first audit
06

Questions

What is the mcp MCP server?

Connect ChatGPT, Claude, Cursor, and other AI agents to Dynamoi for free Spotify Smart Links, music promotion campaigns, analytics, and distribution.

What tools does mcp expose?

5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does mcp need?

No credential environment variables were found in its source, so it appears to need none.

How does mcp run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @dynamoi/mcp at 1.0.1.

How current is this page?

The grade is for one exact copy of the source (70d7a68956bc), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement