SongForge-MCPBLOCK
Generate original AI music tracks via Claude Desktop — MCP server powered by ACE-Step 1.5, with vocal/instrumental stem splitting and reference-style matching. No music software or AI/ML knowledge needed.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
SongForge-MCP
Generate original AI music through Claude, powered by ACE-Step 1.5
Quick Start • Features • Tools Reference • Architecture • Changelog • Contributing • Troubleshooting
Ask Claude for a song in plain English — "an upbeat pop track about road trips, with lyrics about freedom" — and get back a real, finished audio file. No music software, no AI/ML knowledge, and no account or subscription required. Everything runs on your own computer.
**If this is useful to you
3378e4d38fd3OBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add songforge-mcp -- uvx songforge-mcp
{
"mcpServers": {
"songforge-mcp": {
"command": "uvx",
"args": [
"songforge-mcp"
]
}
}
}Exposed tools (14)
10 read · 3 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
analyze_reference_audio | read | Starts measuring real BPM and musical key from an audio file |
check_vocal_track_status | read | Poll a job started by any job-based tool on this server |
delete_generated_track | destructive | Moves a file this server previously produced (a full-mix |
edit_audio_track | write | Starts trimming and/or fading a file this server previously |
generate_vocal_track | write | Start generating a full EDM/vocal track (music + vocals |
generate_vocal_track_takes | read | Starts generating multiple independent takes of the same song |
get_midi_notes | write | Returns the actual note data (pitch, start, end, velocity) from |
list_generated_tracks | read | Lists finished tracks sitting in this server |
list_recent_jobs | read | Lists recent background jobs (from generate_vocal_track, |
list_separator_models | read | List audio-separator |
play_audio | read | Plays a file this server previously produced, on demand. |
prepare_voice_reference | read | Checks whether reference vocal clips already exist for a named |
split_vocal_stems | read | Only call this when the user |
transcribe_instrumental_to_midi | read | Starts converting an instrumental audio file into MIDI via |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (4)
OS's own default media player — you don't need to tell the user to go
module = importlib.import_module(f"songforge_mcp.tools.{name}")delete_generated_track
module = __import__(f"songforge_mcp.tools.{name}", fromlist=["register"])Gates applied: instruction_override, no_behavioural_pass.
3378e4d38fd3full audit observations/trust-audit/mcp-server/xdarkzx__songforge-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | 3378e4d38fd3 | BLOCK | D | 69 | first audit |
Questions
What is the SongForge-MCP MCP server?
Generate original AI music tracks via Claude Desktop — MCP server powered by ACE-Step 1.5, with vocal/instrumental stem splitting and reference-style matching. No music software or AI/ML knowledge needed.
What tools does SongForge-MCP expose?
14 in total: 10 read-only, 3 that write, and 1 that can delete or overwrite (delete_generated_track). Every one is listed on this page with its risk.
Is SongForge-MCP safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does SongForge-MCP need?
No credential environment variables were found in its source, so it appears to need none.
How does SongForge-MCP run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as songforge-mcp.
How current is this page?
The grade is for one exact copy of the source (3378e4d38fd3), read on 2026-10-14. The repository is watched and re-audited when it changes.