Atlas / MCP servers / xdarkzx / Reaper-MCP

Reaper-MCPBLOCK

Name: Reaper-MCP
Author: xdarkzx

mcp/xdarkzx/reaper-mcp

MCP server by xdarkzx · ai tools · audio editing · claude · Audited 2026-10-07

AI-powered music production and post-production in REAPER via MCP — 181 tools for composition, mixing, mastering, batch editing, audio QC, and ReaScript automation.

Verdict

BLOCK

Grade

Trust score

68 /100

Exposed tools

166 70r · 79w · 17d

Transport

stdio

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

ReaperMCP

AI-powered music production in REAPER through the Model Context Protocol

Quick Start • Why ReaperMCP? • Features • Tools Reference • Architecture • Changelog • Contributing • Troubleshooting

ReaperMCP connects any MCP-compatible AI assistant to REAPER, giving it full control over music production. Talk to your AI assistant and it composes, mixes, masters, and measures your music in real-time — the A

Read from source at commit 6e579d8b1efeOBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add xdarkzx-reaper-mcp -- uvx xdarkzx-reaper-mcp

claude-desktop

{
  "mcpServers": {
    "xdarkzx-reaper-mcp": {
      "command": "uvx",
      "args": [
        "xdarkzx-reaper-mcp"
      ]
    }
  }
}

Exposed tools (166)

70 read · 79 write · 17 destructive. Blast radius: 17 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_markers_batch`	write	Batch add markers/regions.
`analyze_chop_set`	write	Inspect a list of chops and classify each by duration.
`analyze_clipping`	read	Count samples at or above a clipping threshold (default -0.1 dBFS).
`analyze_frequency_spectrum`	read	Bass / mid / treble energy split and spectral centroid.
`analyze_loudness`	read	Measure integrated loudness (LUFS), true peak, loudness range, and crest factor.
`analyze_peaks`	read	Find click/pop candidates — short transients that spike well above the local baseline.
`analyze_region_qc`	write	Per-region silence + peak/click candidate report — the post-production QC pass.
`analyze_score`	read	Dump current MIDI data: per-track notes, CCs, timing stats.
`analyze_silence`	read	Find candidate silence spans — amplitude at/below threshold_db for at least min_duration.
`analyze_stereo_field`	read	Stereo correlation, mid/side balance, and width estimate.
`arrange_chops_to_chord_tones`	read	[NICHE] Retune each chop to a chord tone.
`bounce_stems`	read	Render the given tracks as individual audio stems (in-project).
`configure_tracks`	write	Batch set volume_db, pan, color, mute, solo, name on multiple tracks.
`detect_common_bpm`	read	Given a JSON array of file paths, return the most common BPM
`edit_section`	destructive	Clear+replace notes/CCs in a time range. For CC-only fixes, use rewrite_cc instead.
`envelope_add_points`	write	Batch-insert automation points into an envelope.
`envelope_clear_range`	destructive	Delete all envelope points in a time range.
`envelope_get_points`	read	Read automation points from a track or FX parameter envelope.
`fx_disable`	write	Bypass an FX plugin.
`fx_enable`	write	Enable an FX plugin.
`fx_get_chain`	read	Get FX chain for a track (names, enabled, presets, param counts).
`fx_get_instrument`	read	Find VSTi instrument on track. Returns index + params, or -1 if none.
`fx_get_params`	read	Get all parameters of an FX plugin (names, values, formatted display).
`fx_get_pin_mappings`	read	Read-only inspection of an FX plugin
`fx_get_preset`	read	Get current preset name and count.
`fx_list_installed`	read	List every FX plugin installed in REAPER, grouped by category.
`fx_move`	write	Move FX to different position in chain.
`fx_navigate_preset`	read	Step to next/previous preset.
`fx_remove_batch`	destructive	Remove one FX, several, or a whole chain, across one or many tracks, in one call.
`fx_rename`	write	Rename an FX instance
`fx_scan_params`	read	On-demand fallback: sweep a plugin
`fx_set_preset`	write	Load preset by name. Returns the resulting preset, not the parameters.
`fx_show_ui`	read	Open FX plugin UI window.
`get_track_instruments`	read	List all tracks with detected VSTi names and item counts.
`item_create_midi`	write	Create an empty MIDI item on a track. Returns the item
`item_delete`	destructive	Delete an item. Prefer items_apply for multiple.
`item_duplicate`	read	Copy an item N times at fixed spacing.
`item_get_all`	read	Get all media items. Filter by track or -1 for all.
`item_get_info`	read	Get detailed info for one item.
`item_insert_media`	write	Insert audio/MIDI file into track.
`item_move`	write	Move item to new position. Prefer items_apply for multiple.
`item_move_to_track`	write	Move item to different track.
`item_select`	read	Select/deselect an item.
`item_set_fade`	write	Set fade in/out. -1=unchanged. Prefer items_apply for multiple.
`item_set_length`	write	Set item length. Prefer items_apply for multiple.
`item_set_mute`	write	Mute/unmute item. Prefer items_apply for multiple.
`item_set_volume`	write	Set item volume in dB. Prefer items_apply for multiple.
`item_split`	read	Split item at position.
`item_split_at_positions`	read	Slice an item at a list of absolute project-time positions.
`item_split_at_transients`	read	Slice an audio item at every detected transient.
`item_take_add`	write	Add a new empty take to an item. Returns the new take
`item_take_delete_active`	destructive	Delete the currently active take from an item.
`item_take_list`	read	List all takes on an item with their active status.
`item_take_set_active`	write	Switch which take plays back on an item.
`items_apply`	destructive	Batch set position/length/volume_db/mute/fade_in/fade_out, or delete, across many items in one call.
`list_audio_subfolders`	read	List the subfolder structure under a folder — fast, no per-file
`marker_add`	write	Add marker. Prefer add_markers_batch for multiple.
`marker_add_region`	write	Add region. Prefer add_markers_batch for multiple.
`marker_delete`	destructive	Delete marker/region. Prefer markers_apply for multiple.
`marker_edit`	write	Edit marker/region. Prefer markers_apply for multiple, or to also edit a region
`marker_get_all`	read	Get all markers and regions. For just the region list plus a cheap
`marker_go_to`	write	Move cursor to marker.
`markers_apply`	destructive	Batch edit (name/position/start/end/color) or delete markers and regions in one call.
`midi_count_events`	read	Count notes, CCs, and sysex events in item.
`midi_delete_all_notes`	destructive	Clear all notes from a MIDI item.
`midi_delete_cc`	destructive	Delete a CC event.
`midi_delete_note`	destructive	Delete a note.
`midi_get_note_names`	read	Get MIDI note number to name mapping (C4=60, etc.).
`midi_get_notes`	read	Get notes in a MIDI item (capped at max_results to limit context size).
`midi_humanize`	write	Add random timing + velocity jitter to all notes in a MIDI item.
`midi_insert_cc`	write	Insert single CC event. For whole curves use the `ccs` array of rewrite_cc or compose_arrangement.
`midi_insert_note`	write	Insert single note into existing item. For composing use compose_arrangement.
`midi_insert_notes_batch`	write	Batch-insert notes into a MIDI item. Primary tool for writing MIDI.
`midi_insert_program_change`	write	Insert a MIDI Program Change, optionally preceded by Bank Select.
`midi_list_programs`	read	List the MIDI program names a track
`midi_quantize`	read	Quantize notes in a MIDI item to a time grid.
`midi_select_notes`	read	Select/deselect all notes in item.
`midi_set_item_extents`	write	Set MIDI item boundaries in quarter notes.
`midi_set_note`	write	Edit existing note. -1 keeps current value.
`midi_sort`	read	Sort MIDI events by time.
`project_backup`	write	Save a snapshot copy to `path` WITHOUT changing this project
`project_export_audio`	read	Render project to audio file(s) on disk.
`project_get_change_count`	read	Cheap check for whether the project has changed since you last looked.
`project_get_info`	read	Get project info (name, BPM, time sig, tracks, length, markers, render settings).
`project_get_metadata`	read	Get project render metadata (title, author, album, comment, etc.).
`project_get_notes`	read	Get the project notes/description text.
`project_get_notes_info`	read	Get the Title and Author fields of the Project Settings -> Notes tab.
`project_get_overview`	write	One cheap call for post-production awareness: counts, region list, change_count, and a selection summary.
`project_new`	write	Create a new empty REAPER project. Returns the new project info.
`project_open`	read	Open .rpp project file.
`project_redo`	read	Redo the last undone step, or the last several in one call.
`project_save`	write	Save the current project. Returns project info confirming the save.
`project_save_as`	write	Save project to new path. This project
`project_set_grid`	write	Set grid division (1.0=quarter, 0.5=eighth, 0.25=sixteenth).
`project_set_metadata`	write	Set project render metadata fields. Non-empty fields are written.
`project_set_notes`	write	Set the project notes/description text.
`project_set_notes_info`	write	Set the Title and Author fields of the Project Settings -> Notes tab.
`project_set_ripple_mode`	write	Set REAPER
`project_undo`	read	Undo the last step, or the last several steps in one call.
`project_undo_group`	write	Undo every step of the most recent multi-command tool run.
`reset_composition`	destructive	Unlock compose_arrangement without deleting MIDI. Use wipe_all_midi to also delete.
`rewrite_cc`	read	Replace CC automation in a time range, leaving notes untouched.
`scan_audio_folder`	read	Walk a folder for audio loops and parse metadata from filenames.
`script_list`	read	List ReaScripts (.lua/.eel only) found in REAPER
`script_run`	write	Run a ReaScript from REAPER
`selection_deselect_all_items`	read	Deselect all media items.
`selection_deselect_all_tracks`	read	Deselect all tracks.
`selection_get_selected_items`	read	Get a list of all currently selected media items with their full info.
`selection_get_selected_tracks`	read	Get a list of all currently selected tracks with their full info.
`selection_get_time`	read	Get current time selection. If you also need track/item counts or
`selection_select_all_items`	read	Select all items.
`selection_select_all_tracks`	read	Select all tracks.
`selection_set_loop`	write	Set loop points.
`selection_set_time`	write	Set time selection.
`send_create`	write	Create send between tracks. Prefer setup_routing for batch.
`send_get_all`	write	Get all sends/receives on a track.
`send_get_routing_diagram`	write	Get full project routing diagram (sends, receives, outputs).
`send_remove`	destructive	Remove a send.
`send_set_midi_channel`	write	Set MIDI source/destination channel on an existing send.
`send_set_mute`	write	Mute/unmute send.
`send_set_pan`	write	Set send pan.
`send_set_volume`	write	Set send volume.
`set_fx_preferences`	write	Save user FX preferences — per-category plugin overrides.
`setup_effect_bus`	write	Create effect return bus (track + FX + sends) in one call.
`setup_fx_chain`	write	Add and/or configure FX — the only tool for this, for one plugin
`setup_routing`	write	Batch create sends with optional volume/pan.
`take_set_pitch`	write	Pitch-shift a take by N semitones (no time change).
`take_set_playrate`	write	Time-stretch a take by changing its playrate.
`take_set_reversed`	write	Reverse an item
`tempo_add_marker`	write	Add a tempo and/or time-signature marker at a given time.
`tempo_clear_all`	destructive	Delete every tempo/time-sig marker — resets the project to its base tempo.
`tempo_delete_marker`	destructive	Delete a tempo/time-sig marker by its index (from `tempo_list_markers`).
`tempo_list_markers`	read	List all tempo + time-signature markers in the project.
`track_create`	write	Create new track.
`track_delete_batch`	destructive	Delete one track, several, or all of them, in one call.
`track_freeze`	read	Freeze a track to stereo audio (pre-fader render of FX + VSTi).
`track_get_all`	read	Get all tracks with properties (name, volume, pan, mute, solo, FX, items, routing).
`track_get_info`	read	Get detailed info for one track.
`track_get_mixer_state`	read	Get mixer state for all tracks (volumes, pans, mutes, solos, sends).
`track_get_peak`	read	Read instantaneous peak level from a track
`track_rename`	write	Rename a track.
`track_select`	read	Select/deselect a track.
`track_set_color`	write	Set track color (RGB 0-255). Prefer configure_tracks for batch.
`track_set_folder`	write	Set folder state. 0=normal, 1=folder parent, -1=last in folder.
`track_set_input`	write	Set recording input. 0-1023=mono (0=first input), +1024=stereo, 4096+=MIDI, -1=MIDI all inputs/channels.
`track_set_mute`	write	Mute/unmute a track.
`track_set_pan`	write	Set track pan. Prefer configure_tracks for batch.
`track_set_record_arm`	write	Arm/disarm track for recording.
`track_set_solo`	write	Solo/unsolo a track.
`track_set_volume`	write	Set track volume. Prefer configure_tracks for batch.
`track_template_apply`	write	Apply a saved template to a track — replaces its FX chain + settings.
`track_template_delete`	destructive	Delete a saved track template.
`track_template_list`	read	List all saved track templates.
`track_template_save`	write	Save a track
`track_unfreeze`	read	Unfreeze a track, restoring its original FX chain and MIDI state.
`transport_get_state`	read	Get transport state (play/record status, position, BPM, time sig, repeat).
`transport_pause`	read	Toggle pause.
`transport_play`	write	Start playback.
`transport_record`	write	Start recording.
`transport_set_bpm`	write	Set project tempo.
`transport_set_playrate`	write	Set playback speed.
`transport_set_position`	write	Set cursor position.
`transport_set_time_signature`	write	Set time signature.
`transport_stop`	write	Stop playback/recording.
`transport_toggle_metronome`	read	Toggle metronome.
`transport_toggle_repeat`	read	Toggle repeat/loop mode.

Trust audit

BLOCKgrade D · trust 68/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (8 observation(s))
Network: declared (1 observation(s))
Shell: declared (2 observation(s))
Dependencies: pinned
Secrets in source: none-found

Findings (13)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

reaper_mcp_shared/path_safety.py:49

".npmrc", ".netrc", ".pgpass", "id_rsa", "id_ed25519", "id_ecdsa",

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

reaper_mcp_shared/path_safety.py:50

"known_hosts", "authorized_keys", "credentials.json", "secrets.json",

Why it matters. touches a credential store

HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427

reaper_mcp/instructions/00_core.md:251

"worth checking," don't tell the user something is definitely broken.

Why it matters. asks the agent to act without the user's knowledge

HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427

reaper_mcp/instructions/50_postproduction.md:31

"worth checking," don't tell the user something is definitely broken.

Why it matters. asks the agent to act without the user's knowledge

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

reaper_mcp/tool_registry.py:298

module = importlib.import_module(f"reaper_mcp.tools.{name}")

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

reaper_mcp/tool_registry.py:341

importlib.import_module(f"reaper_mcp.tools.{name}")

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

edit_section, envelope_clear_range, fx_remove_batch, item_delete, item_take_delete_active, items_apply, marker_delete, markers_apply, midi_delete_all_notes, midi_delete_cc, midi_delete_note, reset_com

Why it matters. 17 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/test_tool_registry.py:23

module = __import__(f"reaper_mcp.tools.{name}", fromlist=["register"])

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

tests/test_path_safety.py:113

@pytest.mark.parametrize("name", [".env", ".ENV", "id_rsa", "known_hosts", ".netrc"])

Why it matters. touches a credential store

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

tests/test_path_safety.py:117

@pytest.mark.parametrize("name", ["Kick_140bpm.wav", "environment.wav", "id_rsa.wav"])

Why it matters. touches a credential store

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_script_tools.py:49

_validate_script_path("../../../etc/passwd")

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_script_tools.py:53

_validate_script_path("sub/../../escape.lua")

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

SECURITY.md:7

Instead, use GitHub's private reporting: go to the [Security tab](https://github.com/xDarkzx/Reaper-MCP/security) → **Report a vulnerability**. This opens a private conversation only you and the maint

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha 6e579d8b1efefull audit observations/trust-audit/mcp-server/xdarkzx__reaper-mcp.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-07	`6e579d8b1efe`	BLOCK	D	68	first audit

Questions

What is the Reaper-MCP MCP server?

AI-powered music production and post-production in REAPER via MCP — 181 tools for composition, mixing, mastering, batch editing, audio QC, and ReaScript automation.

What tools does Reaper-MCP expose?

166 in total: 70 read-only, 79 that write, and 17 that can delete or overwrite (edit_section, envelope_clear_range, fx_remove_batch, item_delete, item_take_delete_active). Every one is listed on this page with its risk.

Is Reaper-MCP safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (68/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 17 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Reaper-MCP need?

No credential environment variables were found in its source, so it appears to need none.

How does Reaper-MCP run?

It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as xdarkzx-reaper-mcp.

How current is this page?

The grade is for one exact copy of the source (6e579d8b1efe), read on 2026-10-07. The repository is watched and re-audited when it changes.

Source	xDarkzx/Reaper-MCP
PyPI	`xdarkzx-reaper-mcp`
Transports	stdio
License	Apache-2.0
Activity	pushed 2d ago