MCP server · Audited from source

Nuclear MCP server

by nukeop/nuclearAGPL-3.0 licenceAudited 20 Sep 2026 · source 16368561634a

npm @nuclearplayer/website 2.12.3streamable-http★ 18,480

✕BLOCKGrade D · 69/100 · 20 Sep 2026 · 1636856

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade D (69/100). It exposes 70 tools: 42 read, 19 write and 9 destructive. The audit recorded 26 findings (0 critical, 1 high, 1 medium, 19 low). Maintainer's description: Streaming music player that finds free music for you

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Nuclear MCP server (nukeop/nuclear)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/nukeop/nuclear

Why this is BLOCK. The audit found 0 critical and 1 high findings; the most severe is Code injection at packages/player/src/services/plugins/PluginLoader.ts:134. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 20 Sep 2026

Trust score69/100✕BLOCK D

0 critical1 high1 medium19 low5 info

26 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared5 observations
NetworkDeclared8 observations
ShellDeclared3 observations
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

Findings (26)

Sorted by severity · the 25 most severe of 26 are listed

HIGHCode injectioncode.eval_exec · packages/player/src/services/plugins/PluginLoader.ts:134

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

new Function('exports', 'module', 'require', code)(

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

clearQueue, deletePlaylist, removeAlbum, removeArtist, removeByIds, removeByIndices, removeTrack, removeTracks, stop

Why: 9 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenanceinv.binary · packages/docs/.gitbook/assets/nuclear-mcp.zip

F-13 Inventory / provenanceCWE-1104Layer L0

nuclear-mcp.zip

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

LOWInventory / provenanceinv.hidden_file · .node-version

F-13 Inventory / provenanceCWE-1104Layer L0

.node-version

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .prettierignore

F-13 Inventory / provenanceCWE-1104Layer L0

.prettierignore

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · packages/docs/.gitbook.yaml

F-13 Inventory / provenanceCWE-1104Layer L0

.gitbook.yaml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWFilesystem / pathfs.traversal · packages/hifi/src/test/mocks/mockLogger.ts:1

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { LoggerProvider } from '../../LoggerProvider';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/player/src/components/ConnectedPlayerBar/ConnectedControls.tsx:8

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { useCoreSetting } from '../../hooks/useCoreSetting';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/player/src/components/ConnectedPlayerBar/ConnectedControls.tsx:9

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { useProviders } from '../../hooks/useProviders';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/player/src/components/ConnectedPlayerBar/ConnectedControls.tsx:10

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { playbackManager } from '../../services/playback';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/player/src/components/ConnectedPlayerBar/ConnectedControls.tsx:11

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { useQueueStore } from '../../stores/queueStore';

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · README.md:91

F-04 Network egressCWE-200 · CWE-319Layer L1

claude mcp add nuclear --transport http http://127.0.0.1:8800/mcp

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · README.md:97

F-04 Network egressCWE-200 · CWE-319Layer L1

codex mcp add nuclear --url http://127.0.0.1:8800/mcp

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · README.md:107

F-04 Network egressCWE-200 · CWE-319Layer L1

"url": "http://127.0.0.1:8800/mcp"

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · README.md:119

F-04 Network egressCWE-200 · CWE-319Layer L1

"url": "http://127.0.0.1:8800/mcp"

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · packages/docs/integrations/http-api.md:9

F-04 Network egressCWE-200 · CWE-319Layer L1

Enable Nuclear Jam in Settings, then Integrations. The **API URL** field shows the base URL (e.g. `http://192.168.1.42:4120/api`).

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@ianvs/prettier-plugin-sort-imports, @tailwindcss/vite, @vitejs/plugin-react, @vitest/coverage-v8, eslint, husky, jsdom, lint-staged

Why: 17 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · packages/eslint-config/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@eslint/css, @eslint/js, @eslint/json, @eslint/markdown, @ianvs/prettier-plugin-sort-imports, eslint, eslint-config-prettier, eslint-plugin-prettier

Why: 14 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · packages/hifi/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

hls.js, @testing-library/jest-dom, @testing-library/react, @types/react, @types/react-dom, @vitejs/plugin-react, @vitest/coverage-v8, jsdom

Why: 12 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · packages/i18n/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

i18next, react-i18next, @types/react, @vitejs/plugin-react, @vitest/coverage-v8, typescript, vite, vite-plugin-dts

Why: 9 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · packages/model/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

zod, @vitest/coverage-v8, typescript, vite, vitest

Why: 5 dependency range(s) float
Fix: pin exact versions or ship a lockfile

INFOInventory / provenanceinv.oversize · packages/docs/.gitbook/assets/dashboard-main.png

F-13 Inventory / provenanceCWE-1104Layer L0

packages/docs/.gitbook/assets/dashboard-main.png

Why: 2055326 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · packages/docs/.gitbook/assets/playlists.png

F-13 Inventory / provenanceCWE-1104Layer L0

packages/docs/.gitbook/assets/playlists.png

Why: 1659523 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · packages/docs/.gitbook/assets/search-albums.png

F-13 Inventory / provenanceCWE-1104Layer L0

packages/docs/.gitbook/assets/search-albums.png

Why: 1883574 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · packages/docs/.gitbook/assets/search-artists.png

F-13 Inventory / provenanceCWE-1104Layer L0

packages/docs/.gitbook/assets/search-artists.png

Why: 1770561 bytes not read
Fix: —

Tools it exposes

70 declared in source · 9 destructive

42 read19 write9 destructive

9 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	What it does	Risk
`clearQueue`	Remove all items from the queue.	destructive
`deletePlaylist`	Delete a playlist by ID.	destructive
`removeAlbum`	Remove an album from favorites by its provider reference.	destructive
`removeArtist`	Remove an artist from favorites by its provider reference.	destructive
`removeByIds`	Remove items from the queue by their IDs.	destructive
`removeByIndices`	Remove items from the queue by their indices.	destructive
`removeTrack`	Remove a track from favorites by its provider reference.	destructive
`removeTracks`	Remove items from a playlist by their item IDs.	destructive
`stop`	Stop playback and reset position.	destructive
`addAlbum`	Add an album to favorites.	write
`addArtist`	Add an artist to favorites.	write
`addAt`	Insert tracks at a specific position.	write
`addNext`	Insert tracks immediately after the current item.	write
`addToQueue`	Add tracks to the end of the queue.	write
`addTrack`	Add a track to favorites.	write
`addTracks`	Add tracks to a playlist. Returns the created playlist items.	write
`createPlaylist`	Create a new empty playlist. Returns the playlist ID.	write
`importPlaylist`	Import a full playlist object. Returns the new playlist ID.	write
`play`	Start or resume playback.	write
`reorder`	Move a queue item from one position to another.	write
`reorderTracks`	Move a track within a playlist from one position to another.	write
`saveQueueAsPlaylist`	Save the current queue as a new playlist. Returns the playlist ID.	write
`set`	Set the value of a setting by its namespace-relative ID. The ID is automatically prefixed with the caller namespace.	write
`setGlobal`	Set the value of any setting by its fully qualified ID.	write
`setRepeatMode`	Set the repeat mode:	write
`setShuffleEnabled`	Enable or disable shuffle.	write
`setVolume`	Set the volume level (0 to 1, where 0 is silent and 1 is full volume).	write
`updateItemState`	Update the loading status of a queue item.	write
`Gruvbox`	Retro groove color scheme. Based on the classic Vim theme.	read
`Sakura`	Cherry blossom	read
`YoRHa`	Inspired by the UI of NieR:Automata.	read
`fetchAlbumDetails`	Fetch full album details including track listing.	read
`fetchArtistAlbums`	Fetch an artist	read
`fetchArtistBio`	Fetch an artist	read
`fetchArtistPlaylists`	Fetch playlists associated with an artist.	read
`fetchArtistRelatedArtists`	Fetch artists similar to the given artist.	read
`fetchArtistSocialStats`	Fetch an artist	read
`fetchArtistTopTracks`	Fetch an artist	read
`fetchEditorialPlaylists`	Fetch editorial/curated playlists, optionally from a specific provider.	read
`fetchNewReleases`	Fetch new album releases, optionally from a specific provider.	read
`fetchTopAlbums`	Fetch top/trending albums, optionally from a specific provider.	read
`fetchTopArtists`	Fetch top/trending artists, optionally from a specific provider.	read
`fetchTopTracks`	Fetch top/trending tracks, optionally from a specific provider.	read
`get`	Get a specific provider by ID and kind.	read
`getAlbums`	Get all favorite albums.	read
`getArtists`	Get all favorite artists.	read
`getCurrentItem`	Get the currently playing queue item.	read
`getGlobal`	Get the value of any setting by its fully qualified ID	read
`getIndex`	Get the list of all playlists with summary info.	read
`getPlaylist`	Get a playlist by ID with all its items.	read
`getQueue`	Get the current queue state.	read
`getRepeatMode`	Get the current repeat mode:	read
`getState`	Get the current playback state (status, seek position, duration).	read
`getTracks`	Get all favorite tracks.	read
`getVolume`	Get the current volume level (0 to 1).	read
`goToId`	Jump to a specific queue item by its ID.	read
`goToIndex`	Jump to a specific position in the queue.	read
`goToNext`	Skip to the next item.	read
`goToPrevious`	Go back to the previous item.	read
`isAlbumFavorite`	Check if an album is in favorites.	read
`isArtistFavorite`	Check if an artist is in favorites.	read
`isMuted`	Check whether audio output is muted.	read
`isShuffleEnabled`	Check whether shuffle is enabled.	read
`isTrackFavorite`	Check if a track is in favorites.	read
`list`	List all registered providers, optionally filtered by kind (metadata, streaming, lyrics, dashboard).	read
`pause`	Pause playback.	read
`search`	Search for artists, albums, tracks, and playlists.	read
`seekTo`	Seek to a position in seconds.	read
`setMuted`	Mute or unmute audio.	read
`toggle`	Toggle between play and pause.	read

Safer alternatives

All image, video & audio servers →

mcp-imslp✓SAFE

smeet666/mcp-imslp

MCP server for IMSLP, the Petrucci Music Library. Read works, scores and recordings. No API key required.

7 readGrade B

PixVerse✓SAFE

pixverseai/pixverse-mcp

Official PixVerse Model Context Protocol (MCP) server that enables interaction with powerful AI video generation APIs.

3 writeGrade B

Vods✓SAFE

aahl/mcp-vods

📺 MCP Server for Binge-watch / MoonTV / LunaTV. 一个用于追剧/追番的MCP服务器,为AI提供搜索影视播放地址的能力,并支持在小米电视上直接播放

1 readGrade B

Audit history

2026-09-20
✕BLOCK D 69 / 100
Source changed, verdict held · 16368561634a
2026-09-16
✕BLOCK D 69 / 100
First audit · 10f8e40debaa

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Nuclear MCP server

What is the Nuclear MCP server?

Streaming music player that finds free music for you

What tools does Nuclear expose?

70 in total: 42 read-only, 19 that write, and 9 that can delete or overwrite (clearQueue, deletePlaylist, removeAlbum, removeArtist, removeByIds). Every one is listed on this page with its risk.

Is Nuclear safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 9 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Nuclear need?

It reads CODECOV_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Nuclear run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @nuclearplayer/website at 2.12.3.

How current is this page?

The grade is for one exact copy of the source (16368561634a), read on 2026-09-20. The repository is watched and re-audited when it changes.

I already installed Nuclear. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

nukeop/nuclear on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
ModelsAtlas trust audit — BLOCK verdict for commit 16368561634aObserved · 20 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Nuclear MCP server?
GChatGPT CClaude PPerplexity
What tools does Nuclear expose?
GChatGPT CClaude PPerplexity
Is Nuclear safe to connect to an agent?
GChatGPT CClaude PPerplexity