Atlas / MCP servers / newsbubbles / ismail

ismailBLOCK

mcp/newsbubbles/ismail

A DAW for AI agents: write music as text, read the audio back as text. MCP server, CLI and an agent skill.

Verdict
BLOCK
Grade
F
Trust score
40 /100
Exposed tools
—
Transport
stdio
License
MIT
Stars
13
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

New here? You don't need to know music or code. Open an AI agent that can run programs on your computer (Claude Code, Codex, Cursor, or the Code tab in the Claude desktop app) and paste this line: `` Set me up with ismail: https://github.com/newsbubbles/ismail `` It installs everything, asks what you want to make, and plays you a first idea. If you have a VR headset, it can put you on a stage inside your music later. You don't need to know what a "skill", "MCP" or "plugin" is: your agent handles that.

A DAW for AI agents. It can't hear, so it reads. And it plays live.

Your agent writes the song as notes, sounds and code, reads back what it made, and then performs it: DJ decks, transitions, requests taken while the music plays. Away from the desk, the set goes in your pocket: a phone page you listen to with the screen off and talk back to through your earbuds.

[](https://github.com/newsbubbles/ismail/actions/workflows/tests.yml)

[](https://newsbubbles.github.io/ismail/)

Agents: start at AGENTS.md.

[Listen to songs an agent made with it](https://newsbubbles.github.io/ismail/), each shown with the text the agent read while making it. The playhead runs across that text as the song plays.

Read from source at commit 82fc80bfc502OBSERVED · 2026-10-10
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (pypi)
claude mcp add ismail -- uvx ismail==0.3.0 mcp
03

Trust audit

BLOCKgrade F · trust 40/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (6 observation(s))
Network
declared (16 observation(s))
Shell
declared (8 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
ismail/instruments.py:519
exec(p['code'], ns)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
ismail/stage/bridge/blender_bridge.py:161
exec(compile(open(_pass, encoding='utf-8').read(), _pass, 'exec'),
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
ismail/stage/page/live.js:436
if (ASIDE.has(c.type)) exec(c);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
ismail/stage/page/live.js:437
else await exec(c);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
ismail/exampage/words.html:1
<!doctype html>
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
MEDIUMInventory / provenance · inv.binary · CWE-1104
ismail/stage/page/sounds/ack_0.wav
ack_0.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
ismail/stage/page/sounds/ack_1.wav
ack_1.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
ismail/stage/page/sounds/ack_2.wav
ack_2.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
ismail/stage/page/sounds/ack_3.wav
ack_3.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
ismail/stage/page/sounds/ack_4.wav
ack_4.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
ismail/provenance.py:25
return getattr(importlib.import_module(f'ismail.voices.{cat}.{voice}'), 'INFO', None)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
ismail/voices/__init__.py:78
return importlib.import_module(f"{__name__}.{rel}")
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
ismail/voices/__init__.py:237
return importlib.import_module(self.real)
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
ismail/phone/page/app.js:152
function flushEv(beacon) {
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
ismail/phone/page/app.js:156
if (beacon && navigator.sendBeacon) { navigator.sendBeacon('api/events', new Blob([body], { type: 'application/json' })); return; }
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
ismail/exampage/__init__.py:209
with urllib.request.urlopen(f'http://127.0.0.1:{port}/health', timeout=2) as r:
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
ismail/exampage/__init__.py:230
return f'http://127.0.0.1:{port}/eye/'
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
ismail/live/ops.py:28
req = urllib.request.Request(f"http://127.0.0.1:{port}/", data=json.dumps({'op': name, 'args': args}).encode(),
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
ismail/live/ops.py:522
return (f"stream {name}: http://127.0.0.1:{port}{r['path']} | {r['format']} {r['channels']} ch {r['rate']} Hz | "
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
ismail/phone/ops.py:30
req = urllib.request.Request(f'http://127.0.0.1:{port}/agent', headers={'Content-Type': 'application/json'},
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
ismail/features.py:32
return hashlib.sha1(blob.encode()).hexdigest()[:20]
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
ismail/handoffs.py:93
return hashlib.sha1(s.encode('utf8')).hexdigest()[:12]
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
ismail/phone/ops.py:239
key = hashlib.sha1(f'{src}|{st.st_size}|{st.st_mtime_ns}'.encode('utf8')).hexdigest()[:16]
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
ismail/phone/server.py:88
h = hashlib.sha1()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
ismail/render.py:271
return hashlib.sha1(blob.encode()).hexdigest()[:20]

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha 82fc80bfc502full audit observations/trust-audit/mcp-server/newsbubbles__ismail.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1082fc80bfc502BLOCKF40first audit
05

Questions

What is the ismail MCP server?

A DAW for AI agents: write music as text, read the audio back as text. MCP server, CLI and an agent skill.

Is ismail safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (40/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does ismail need?

It reads VR_PASS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does ismail run?

It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as ismail.

How current is this page?

The grade is for one exact copy of the source (82fc80bfc502), read on 2026-10-10. The repository is watched and re-audited when it changes.

Advertisement