Voice ModeBLOCK
Natural voice conversations with Claude Code
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Natural voice conversations with Claude Code (and other MCP capable agents)
[](https://pepy.tech/project/voice-mode) [](https://pepy.tech/project/voice-mode) [](https://pepy.tech/project/voice-mode)
VoiceMode enables natural voice conversations with Claude Code. Voice isn't about replacing typing - it's about being available when typing isn't.
Perfect for:
- Walking to your next meeting
- Cooking while debugging
- Giving your eyes a break after hours of screen time
- Holding a coffee (or a dog)
- Any moment when your hands or eyes are busy
See It In Action
[](https://www.youtube.com/watch?v=cYdwOD_-dQc)
Quick Start
Requirements: Computer with microphone and speakers
Option 1: Claude Code Plugin (Recommended)
The fastest way for Claude Code users to get started:
# Add the VoiceMode marketplace claude plugin marketplace add mbailey/voicemode # Install VoiceMode plugin claude plugin install voicemode@voicemode ## Install dependencies (CLI, Local Voice Services) /voicemode:install # Start talking! /voicemode:converse
Option 2: Python installer package
Installs dependencies and the VoiceMode Python package.
# Install UV package manager (if needed) curl -LsSf https://astral.sh/uv/install.sh | sh # Run the installer (sets up dependencies and local voice services) uvx voice-mode-install # Add to Claude Code claude mcp add --scope user voicemode -- uvx --refresh --from voice-mode voicemode-mcp-launcher # Optional: Add OpenAI API key as fallback for local services export OPENAI_API_KEY=your-openai-key # Start a conversation claude converse
For manual setup, see the Getting Started Guide.
Feat
41f91d5d341fOBSERVED · 2026-09-24Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add voice-mode --env OPENAI_API_KEY=${OPENAI_API_KEY} -- None voice-mode==8.12.0Exposed tools (25)
17 read · 4 write · 4 destructive. Blast radius: 4 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
check_audio_dependencies | read | Check system audio dependencies and provide installation guidance. |
check_audio_devices | read | List available audio input and output devices |
conch | read | Observe and manage the conch (VoiceMode |
config_reload | destructive | Reload configuration from .voicemode.env files and clear all caches. |
get_provider_details | read | Get detailed information about a specific provider endpoint. |
kokoro_install | write | |
kokoro_uninstall | destructive | Uninstall kokoro-fastapi and optionally remove models and data. |
list_config_keys | read | List all available configuration keys with their descriptions. |
list_tts_voices | read | List available TTS voices for different providers. |
pause_conversation | read | Pause the conversation for a duration while KEEPING the floor (conch hold). |
refresh_provider_registry | read | Manually refresh health checks for voice provider endpoints. |
service | read | Unified service management tool for voice mode services. |
show_config_files | read | Show which .voicemode.env files are being used for configuration. |
update_config | write | Update a configuration value in the voicemode.env file. |
voice_mode_info | read | Get diagnostic information about the voice-mode installation. |
voice_registry | read | Get the current voice provider registry showing all discovered endpoints. |
voice_statistics | read | |
voice_statistics_export | read | |
voice_statistics_recent | read | |
voice_statistics_reset | destructive | |
voice_statistics_summary | read | |
voice_status | read | Check the status of all voice services including TTS, STT, LiveKit, and audio devices. |
whisper_install | write | |
whisper_model_install | write | Download Whisper model(s) with pre-built Core ML support. |
whisper_uninstall | destructive | Uninstall whisper.cpp and optionally remove models and data. |
Trust audit
BLOCKgrade F · trust 47/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | WARN |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (9 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (25)
@CURRENT_VERSION=$$(uv run python -c "exec(open('voice_mode/__version__.py').read()); print(__version__)") && \os.environ.copy() ... curl
.claude/scripts/voicemode-hook-receiver
install.sh
importlib.import_module(f".{module_name}", package=__name__)importlib.import_module(f".{module_name}", package=__name__)importlib.import_module(f".{tool_name}", package=__name__)importlib.import_module(module_path, package=__name__)
| `VOICEMODE_MLX_AUDIO_BASE_URL` | `http://127.0.0.1:8890/v1` | OpenAI-compatible mlx-audio endpoint |
sys.settrace(trace_calls)
- **UV** - Python package manager (install: `curl -LsSf https://astral.sh/uv/install.sh | sh`)
config_reload, kokoro_uninstall, voice_statistics_reset, whisper_uninstall
AGENTS.md
result = _run(_handler("../../etc/passwd"))result = _run(_handler("../../etc/passwd"))- `VOICEMODE_MLX_AUDIO_BASE_URL` (default `http://127.0.0.1:8890/v1`) -- OpenAI-compatible mlx-audio endpoint.
curl http://127.0.0.1:8880/docs
curl http://127.0.0.1:8880/openapi.json
curl http://127.0.0.1:8880/v1/models
src: url('data:font/woff2;base64,d09GMgABAAAAAAKgAA0AAAAAB8AAAAJOAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmAAgkIKgmSCFgsGAAE2AiQDCAQgBQYHLBttA8geh7HbZEkXzVA+8hE8v9bK9/v7cMBIgJBqYiTZU2BNROgoCXWqVuUE2BwBVW/MzP5yield base64.b64decode(data_b64)
- **[Full permissions guide](../../../../docs/guides/permissions.md)** — permission levels (voice-only, voice+service, all-with-denies), security notes on what each tool can do, common JSON mistakes.
- Security concerns from running npm with elevated privileges
**Generate JWT tokens** for API access using development credentials:
- [Manage personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens): You can use a personal access token in place of
Gates applied: no_behavioural_pass.
41f91d5d341ffull audit observations/trust-audit/mcp-server/mbailey__voice-mode.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-24 | 41f91d5d341f | BLOCK | F | 47 | first audit |
Questions
What is the Voice Mode MCP server?
Natural voice conversations with Claude Code
What tools does Voice Mode expose?
25 in total: 17 read-only, 4 that write, and 4 that can delete or overwrite (config_reload, kokoro_uninstall, voice_statistics_reset, whisper_uninstall). Every one is listed on this page with its risk.
Is Voice Mode safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (47/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 4 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Voice Mode need?
It reads CARTESIA_API_KEY, OPENAI_API_KEY, VOICEMODE_CREDENTIAL_STORE, VOICEMODE_MCP_TOKEN, VOICEMODE_SERVE_SECRET and VOICEMODE_SERVE_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Voice Mode run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as voice-mode.
How current is this page?
The grade is for one exact copy of the source (41f91d5d341f), read on 2026-09-24. The repository is watched and re-audited when it changes.