# three.ws Audio (npm · @three-ws/audio-mcp)

Text-to-speech, speech-to-text, audio-to-face lipsync, and motion-capture clips for 3D agents.

- Trust score: 66/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@three-ws/audio-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/nirholas-audio-mcp/three-ws-audio-mcp.md), [page](https://verifymcp.io/servers/nirholas-audio-mcp/three-ws-audio-mcp)

## Channel facts

- Registry: `npm`
- Package: `@three-ws/audio-mcp`
- Version: `0.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 29 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 63/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1573 tokens (~314/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add nirholas-audio-mcp -- npx -y @three-ws/audio-mcp
```

### Codex

```bash
codex mcp add nirholas-audio-mcp -- npx -y @three-ws/audio-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nirholas-audio-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@three-ws/audio-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add nirholas-audio-mcp --command npx --arg -y --arg @three-ws/audio-mcp
```

### Hermes

```yaml
mcp_servers:
  nirholas-audio-mcp:
    command: "npx"
    args: ["-y", "@three-ws/audio-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "nirholas-audio-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@three-ws/audio-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 66, +3)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 63, +46)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: Apache-2.0

### 2026-07-31 (score 17, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 24, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 42)

First indexed and scored.

## MCP tools (5)

### `text_to_speech` (~344 tokens)

Text to speech

Synthesize spoken audio from text for a 3D avatar and return it as a base64 audio data URL (data:<mime>;base64,…) plus metadata. Free NVIDIA NIM Magpie TTS leads; OpenAI is the paid backstop. Because Magpie emits raw PCM, every non-pcm request is served as WAV — the returned `mime`, `format`, and `voice` describe the bytes you actually get, not the request. Pair the audio with audio_to_face to drive lipsync. Input text is capped at 4096 characters. Read-only — synthesizes audio without changing any platform state.

Input parameters:

- `format` (string): Requested audio container (default "mp3"). The free NVIDIA lane serves every non-pcm request as WAV; the response metadata reports what you actually received.
- `language` (string): BCP-47 language for the free NVIDIA lane (default "en-US"; also es-US, fr-FR, de-DE, zh-CN, vi-VN, it-IT, hi-IN, ja-JP).
- `model` (string): OpenAI TTS model for the paid backstop lane (default "gpt-4o-mini-tts"). Ignored by the free NVIDIA lane, which always uses magpie-tts-multilingual.
- `speed` (number): Playback speed multiplier, 0.5–2.0 (OpenAI backstop lane only; default 1.0).
- `text` (string, required): The text to speak (1–4096 characters).
- `voice` (string): Voice persona (default "nova"). The same id renders on either provider lane.

### `speech_to_text` (~294 tokens)

Speech to text

Transcribe spoken audio to text using the free NVIDIA NIM Riva recognizer. Pass the audio as base64 (raw or a data: URL). Accepted encodings: wav, pcm (set sampleRate), flac, ogg/opus — the WebM container from a browser MediaRecorder must be decoded to WAV or PCM first. Returns { text, confidence, language, model, durationSec } and, when `words` is set, per-word timestamps. Audio is capped at ~8 MB. Read-only — recognizes speech without changing any platform state.

Input parameters:

- `audio` (string, required): The audio to transcribe, base64-encoded (a raw base64 string or a data:<mime>;base64,… URL). Max ~8 MB decoded.
- `format` (string): Audio encoding of the supplied bytes (default "wav"). Use "pcm" for raw 16-bit little-endian PCM (set sampleRate).
- `language` (string): BCP-47 language hint for recognition (default "en-US").
- `model` (string): Override the Riva model name (advanced; defaults to the configured model).
- `sampleRate` (integer): Sample rate in Hz for raw PCM input (default 16000). Ignored for WAV, which carries its own rate in the header.
- `words` (boolean): When true, also return per-word timestamps in a `words` array.

### `audio_to_face` (~363 tokens)

Audio to face (lipsync)

Generate a per-frame ARKit blendshape lipsync track from speech using free NVIDIA NIM Audio2Face-3D. Provide either `text` (the server synthesizes it with Magpie TTS, then animates that clip and returns both the audio and the animation) or `audio` (base64 wav/pcm you already have, so the lips match the exact bytes you will play). Returns { animation: { fps, blendShapeNames, frames, durationSec } } where each frame is { t, w } — t in seconds, w = weights ordered by blendShapeNames (ARKit-52). On the text path it also returns { audio: { base64, contentType, format } }. Read-only — produces an animation track without changing platform state.

Input parameters:

- `audio` (string): Pre-synthesized audio to animate, base64-encoded (raw or a data: URL). Provide this OR `text`. Set `format` to match the bytes.
- `format` (string): Encoding of `audio` (default "wav"). Use "pcm" for raw 16-bit little-endian PCM and set `sampleRate`.
- `language` (string): BCP-47 language for the text path (default "en-US"). Ignored when `audio` is supplied.
- `sampleRate` (integer): Sample rate in Hz for raw PCM `audio` (default 16000). Ignored for WAV.
- `text` (string): Text to synthesize and animate (1–4096 chars). Provide this OR `audio`. On this path the synthesized audio is returned alongside the animation.
- `voice` (string): Voice for the text path (default "nova"). Ignored when `audio` is supplied.

### `motion_capture_clips` (~221 tokens)

List motion-capture clips

List motion-capture clips from the three.ws library — recorded face/pose/hand/VMC tracks an avatar can play back. Returns clip metadata (id, slug, name, kind, format, duration_ms, frame_count, tags, visibility, play_count, price) but NOT the frames; fetch a clip by id with motion_capture_clip to get the animation track. Anonymous callers see only public clips; set THREE_WS_API_KEY to include your own. Cursor-paginated via next_cursor. Read-only live data.

Input parameters:

- `cursor` (string): Pagination cursor from a previous response's next_cursor.
- `include_public` (boolean): When authenticated (THREE_WS_API_KEY set), return your clips AND public ones instead of just your own. Ignored anonymously (always public-only).
- `kind` (string): Filter by capture kind: "face" (blendshapes), "pose" (body), "hand", or "vmc".
- `limit` (integer): How many clips to return (1–100, default 50).

### `motion_capture_clip` (~147 tokens)

Get a motion-capture clip

Fetch a single motion-capture clip by id, including its full per-frame animation track. Returns { clip } with metadata plus `frames`: each frame is { t, shapes, mat? } — t in seconds, shapes a name→weight map (ARKit blendshapes for face clips; joint channels for pose/hand/vmc), and an optional 16-float transform matrix. Use this to drive an avatar from a clip discovered via motion_capture_clips. Public and unlisted clips are readable anonymously; a private clip needs THREE_WS_API_KEY for its owner. Read-only.

Input parameters:

- `id` (string, required): The clip id (UUID) returned by motion_capture_clips.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/nirholas-audio-mcp/three-ws-audio-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 63
- 2026-08-01: 17
- 2026-07-31: 17
- 2026-07-30: 24
- 2026-07-28: 42
- 2026-07-27: 42

## Links

- npm package: https://www.npmjs.com/package/@three-ws/audio-mcp
- Socket report: https://socket.dev/npm/package/@three-ws/audio-mcp
- Repository: https://github.com/nirholas/three.ws
- Website: https://three.ws/
- Changelog RSS feed: https://verifymcp.io/servers/nirholas-audio-mcp/three-ws-audio-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/nirholas-audio-mcp/three-ws-audio-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/nirholas-audio-mcp/three-ws-audio-mcp