# io.github.jmedure/talkback (npm · talkback-mcp)

Chat with your Ableton session in real-time.

- Trust score: 65/100 (medium)
- Change this week: +21
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `talkback-mcp`: 65/100 (this document), [markdown](https://verifymcp.io/servers/jmedure-talkback/talkback-mcp.md), [page](https://verifymcp.io/servers/jmedure-talkback/talkback-mcp)

## Channel facts

- Registry: `npm`
- Package: `talkback-mcp`
- Version: `0.1.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (124 of 126), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (124 of 126), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (PolyForm-Shield-1.0.0) isn't a recognized OSI-approved license.
  - Actively maintained (last published 131 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 739 tokens (~73/item across 10 items; 10 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 82/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 47% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add jmedure-talkback -- npx -y talkback-mcp
```

### Codex

```bash
codex mcp add jmedure-talkback -- npx -y talkback-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "jmedure-talkback": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "talkback-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add jmedure-talkback --command npx --arg -y --arg talkback-mcp
```

### Hermes

```yaml
mcp_servers:
  jmedure-talkback:
    command: "npx"
    args: ["-y", "talkback-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "jmedure-talkback": {
      "command": "npx",
      "args": [
        "-y",
        "talkback-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 65, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 61, +42)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] License: unverified → fail
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: PolyForm-Shield-1.0.0

### 2026-07-31 (score 19, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 26, +2)

- [security regression] Malware scan: pass → unverified
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 24, −20)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 44)

First indexed and scored.

## MCP tools (10)

### `get_session_context` (~72 tokens)

Returns a snapshot of the current Ableton session: all tracks (names, volumes, panning, mutes, sends, device chains), return tracks, master track, and routing. Call once at the start of a conversation to orient yourself. No need to call again unless the user says the session has changed.

### `get_track_details` (~47 tokens)

Returns full detail for a specific track including all devices, every parameter in human-readable units, and per-device observations.

Input parameters:

- `track_name` (string, required): Track name (case-insensitive match)

### `get_spectral_snapshot` (~136 tokens)

Captures ~2 seconds of live audio from the master bus and returns peak/RMS levels across frequency bands. Transport MUST be playing — coordinate with the user on which section to analyze (e.g., 'play the chorus'). This is a point-in-time microscope, not a full-song analyzer. Use as a secondary check to verify what device parameter analysis suggests, or to detect issues invisible in the device chain (masking, phase, resonances). For most frequency questions, reading EQ and filter parameters via get_track_details is more informative.

Input parameters:

- `source` (string): 'master' for master bus, or a track name

### `get_plugin_library` (~50 tokens)

Returns all audio plugins (AU, VST3) installed on this system. Use to know what tools the producer has available.

Input parameters:

- `filter` (string): Optional search string to filter by plugin name

### `analyze_mix` (~95 tokens)

Runs rule-based heuristic analysis for potential mix issues: frequency buildup, dynamics problems, routing inefficiencies, headroom. Only call when the user explicitly asks for mix feedback or describes a specific problem — do NOT call proactively. Findings are suggestions to consider, not problems to fix. Mix quality is subjective — frame results in context of what the user is trying to achieve. A technically 'imperfect' setting may be an intentional artistic choice.

### `set_device_parameter` (~117 tokens)

Sets a device parameter to a new value. Pass values in human-readable units (dB, ms, Hz, ratio, percent). NEVER call without explicit user approval. Present the planned change with current → proposed values first, wait for a clear 'yes', then execute. If the user modifies the plan, re-present and re-confirm before executing.

Input parameters:

- `device_name` (string, required)
- `parameter_name` (string, required)
- `track_name` (string, required)
- `unit` (string, required)
- `value` (number, required)

### `toggle_device_bypass` (~67 tokens)

Enables or bypasses a device on a track. Useful for A/B comparison. Always confirm with the user before toggling.

Input parameters:

- `active` (boolean, required): true = device on, false = bypassed
- `device_name` (string, required)
- `track_name` (string, required)

### `create_group_track` (~53 tokens)

Creates a new group track containing the specified tracks. Always confirm with the producer first.

Input parameters:

- `group_name` (string, required): Name for the new group track
- `track_names` (array, required): Names of tracks to group

### `set_track_routing` (~48 tokens)

Changes a track's output routing. Always confirm with the producer first.

Input parameters:

- `output_target` (string, required): Name of the target track/group/bus
- `track_name` (string, required)

### `get_bridge_health` (~54 tokens)

Returns performance metrics from the M4L bridge device: poll execution time (avg/max), WebSocket message size, LiveAPI cache size, and track count. Use to diagnose performance issues or confirm the device is running efficiently.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/jmedure-talkback/talkback-mcp#diagnostics

## Score history

- 2026-08-03: 65
- 2026-08-02: 61
- 2026-08-01: 19
- 2026-07-31: 19
- 2026-07-30: 26
- 2026-07-28: 24
- 2026-07-27: 44

## Links

- npm package: https://www.npmjs.com/package/talkback-mcp
- Socket report: https://socket.dev/npm/package/talkback-mcp
- Repository: https://github.com/jmedure/talkback-mcp
- Changelog RSS feed: https://verifymcp.io/servers/jmedure-talkback/talkback-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/jmedure-talkback/talkback-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/jmedure-talkback/talkback-mcp