Suprsonic
NPM · SUPRSONIC-MCP · 2 COMPONENTS
One API key, dozens of capabilities for your AI agent. Zero provider auth.
Available components
Last scanned (6 hours ago)
Scores higher than 91% of npm servers
Category Search and Retrieval
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to O-mega-Enterprise/suprsonic-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 16 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3937 tokens (~164/item across 24 items; 24 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety92
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 2 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "bg-remove" implies "remove" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
- An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
- Security disclosure: fail → unverified ▼ functional
- 3 Nov 26 −1
- Security disclosure: unverified → fail ▼ functional
- Stability: fail → 0.90 functional
- 31 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
- 30 Oct 26 0
- Package version: 0.3.3 → 0.3.4 functional
- 29 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 28 Oct 26 +1
- Package version: 0.3.3 → 0.3.4 functional
- 27 Oct 26 −1
- Security disclosure: fail → unverified ▼ functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/suprsonic-mcp@0.3.4
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | O-mega-Enterprise/suprsonic-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/O-mega-Enterprise/suprsonic-mcp/.github/workflows/publish.yml@refs/tags/v0.3.4 |
| Rekor log index | 3320114051 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:69b6ddb9d948a7b4440ba5169981bcf00513bf6d157cc9b90aac1c9ba0e8d3b51a72f0e1dcacc64183ebe3e41cbed72c1c088ed5f8ae96ce7e568791a |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
bg-remove Background Removal ~83
Remove background from any image. Returns transparent PNG. Returns the cut-out as a base64 PNG with a transparent background. Use to isolate the subject of an existing image. To create a new image use images. Cost: 2 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| image_url | string | yes | URL to image. |
| size | string | – | Output resolution. |
No output schema declared.
No examples provided.
code-execute Code Execution ~142
Execute code in a secure sandbox with pre-configured environments. Returns stdout, stderr, the exit code, the run time, and the files the code wrote to /home/user/output/ as base64. Use for calculations, data processing and running scripts. Each call runs in a fresh sandbox that is destroyed afterwards, so nothing carries over from one call to the next. Cost: 2 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The code to execute. |
| language | string | – | Programming language. |
| template | string | – | Pre-configured environment. |
| timeout | number | – | Max execution time (1-300s). |
No output schema declared.
No examples provided.
companies Company Enrichment ~114
Enrich company data by domain. Returns the company's name, description, industry, size, founding year, headquarters, employees, revenue, funding, social links, technologies, logo and brand colors. Use for business facts about a company. For technical facts about its domain (WHOIS, DNS, SSL, hosting) use site-intel; for a person use profiles. Cost: 3 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| company_name | string | – | Optional name hint. |
| domain | string | yes | Company domain. |
No output schema declared.
No examples provided.
documents Document Extraction ~164
Extract structured data from URLs or content. Returns the extracted data as JSON (shaped by your schema when you pass one), with the source URL and whether long content was truncated. Use to turn a page or a text into structured fields. For a page's full text use scrape; for invoices and receipts use invoice-parse. Pass url or content; extraction_prompt says what to extract, and schema fixes the shape of the JSON you get back. Cost: 3 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | Pre-scraped text content. |
| extraction_prompt | string | yes | What to extract (required unless schema is provided). |
| schema | object | – | JSON schema for extraction. |
| url | string | – | URL to scrape and extract from. |
No output schema declared.
No examples provided.
domains Domains ~631
Find domain names and the extensions that fit a business. Returns, by mode, name ideas with prices, extensions that fit with reasons, one name across extensions, availability for a list of domains, prices per extension, or the extension catalog. Use to name a business or check domains before buying one; it never registers or buys a domain. For facts about a domain that is already live use site-intel. mode decides which fields apply: company_name and description for the suggest modes, query for search-extensions, domains for check-availability, tlds for pricing. Cost: suggest-names 5 credits, suggest-extensions 3 credits, search-extensions 2 credits, check-availability 1 credit, pricing 1 credit, tlds 1 credit, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| company_id | string | – | Optional O-mega/Founden company id; pulls the real business brief to ground the fit. |
| company_name | string | – | The business name (suggest-extensions), or for suggest-names a natural-language brief: any ordering or limit it states (for example "shortest" or "renewal under $15") is read and applied beneath your… |
| description | string | – | What the business does; grounds the fit (suggest-* modes). |
| domains | array | – | Full domains to check, e.g. ["brewhaven.com"] (check-availability). |
| exact_extension | boolean | – | search-extensions: check ONLY the typed extension. |
| mode | string | – | Which domain capability to run. |
| offset | number | – | search-extensions: pagination offset into the catalog. |
| purpose | string | – | What the domain is for (suggest-names / suggest-extensions): website (the site address), cold (a dedicated cold-email domain, kept apart from the site) or extra. Context the model weighs when judging… |
| query | string | – | An exact name to check across extensions (search-extensions). |
| search_options | object | – | Search options, only the fields you set (suggest-names / search-extensions / suggest-extensions): priorities (objective keys in priority order: total_length, annual_price, renewal_price, registration… |
| tlds | array | – | Extensions to price (pricing), to check the name across (search-extensions), or to restrict name ideas to (suggest-names). |
No output schema declared.
No examples provided.
email-verify Email Verification ~106
Check if an email is deliverable, catch-all, or disposable. Returns the status (such as valid, invalid or catch-all) with a sub-status, whether it is a free mailbox, a suggested correction, the domain's age and its mail servers. Use before emailing an address you were given or found. To find an address from a person's name use emails. Cost: 1 credit, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Email to verify. |
No output schema declared.
No examples provided.
emails Email Finder ~112
Find professional email addresses. Returns the address with its confidence (0 to 1) and verification status. Use to find a named person's work email at a company. To check an address you already have use email-verify; for the person's background use profiles. Cost: 2 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | – | Company name (optional). |
| domain | string | yes | Company domain. |
| first_name | string | yes | First name. |
| last_name | string | yes | Last name. |
No output schema declared.
No examples provided.
file-convert File Conversion ~198
Convert documents, web pages, spreadsheets and images between formats. Returns a download URL of the converted file with its name, size and formats. Use to change a file's format, for example Word to PDF or PDF to Markdown. To extract specific fields use documents; to read a web page's text use scrape. Cost: 2 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| file_url | string | yes | URL of the file to convert (for source_format web, the page itself). |
| source_format | string | yes | Format of the file: pdf, docx, pptx, xlsx, csv, html, web (a page, from its HTML without JavaScript), txt, epub, svg, png, jpg, webp, gif, bmp, tiff or heic. |
| target_format | string | – | Format to convert to. The conversion table's pairs convert in-house; other pairs go to ConvertAPI. |
No output schema declared.
No examples provided.
images Image Generation ~103
Generate images from text prompts. Returns a hosted URL of the PNG and the same image as base64 (b64_json), with the aspect ratio and size used. Use to create a new picture from a description. To cut the background out of an existing image use bg-remove; to capture a web page use screenshot. Cost: 3 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| aspect_ratio | string | – | Aspect ratio. |
| prompt | string | yes | Image description. |
No output schema declared.
No examples provided.
invoice-parse Invoice Parsing ~91
Extract structured data from invoices and receipts. Returns the invoice number, dates, supplier and customer, currency, subtotal, tax, total and every line item. Use for an invoice or receipt given as a PDF or image URL. For any other document use documents with your own schema. Cost: 3 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| document_url | string | yes | URL to invoice PDF/image. |
No output schema declared.
No examples provided.
profiles Profile Finder ~155
Find and enrich professional profiles. Returns the person's name, headline, current company and title, location, summary, experience, education, skills, photo URL and LinkedIn URL. Use to learn who a professional is and what they have done. For their work email use emails; for a company rather than a person use companies. Pass linkedin_url, or first_name and last_name; company helps find the right person. Cost: 3 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| company | string | – | Company name. |
| first_name | string | – | First name. |
| include_image | boolean | – | Fetch profile image. |
| last_name | string | – | Last name. |
| linkedin_url | string | – | LinkedIn profile URL. |
No output schema declared.
No examples provided.
research Deep Research ~259
Multi-step deep research: search, scrape, enrich entities, and synthesize into a cited report. Returns a report (title, summary, sections, key findings, confidence) with numbered sources and the people and companies it found, enriched. Use for a question that needs many sources and a synthesized, cited answer. It takes far longer and costs more than search, which suits a quick fact. Cost: standard 10 credits, deep 20 credits, comprehensive 35 credits, charged only when a call succeeds. Options change it: include_analysis true +5, academic in source_types +2, enrich_entities false -3, synthesis false -5.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | string | – | Research depth. |
| enrich_entities | boolean | – | Enrich detected people and companies with profile and firmographic data. |
| freshness | string | – | Time filter for search results. |
| include_analysis | boolean | – | Generate computational analysis with charts. |
| max_sources | number | – | Maximum number of sources to collect. |
| query | string | yes | The research question or objective. |
| source_types | string | – | Comma-separated source types: web, news, academic. |
| synthesis | boolean | – | Generate a synthesized report. Set false for raw mode (sources + entities only). |
No output schema declared.
No examples provided.
scrape Scrape ~221
Extract content from any URL as Markdown or HTML. Returns the page's content in the chosen format (Markdown by default) with its title, description and links. Use when you have a URL and need what the page says. Start with fast; use standard for pages that need JavaScript and thorough only for sites that block scrapers. To pull specific fields into JSON use documents; to see the page as an image use screenshot. Cost: fast 1 credit, standard 2 credits, thorough 5 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | – | Mode: fast (Raw HTTP, no JS. <1s), standard (Full JS rendering. 2-5s), thorough (Anti-bot proxies + JS rendering. 10-30s). |
| output | string | – | Content format. |
| timeout | number | – | Seconds the page may take to load (up to 55). |
| url | string | yes | URL to scrape. |
| wait_for | string | – | CSS selector to wait for (standard and thorough modes). |
No output schema declared.
No examples provided.
screenshot Screenshot ~111
Capture a rendered screenshot of any webpage. Returns the image as base64 with its format, dimensions and size in bytes. Use to see how a page looks. To read its text use scrape. Cost: 1 credit, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Output format. |
| full_page | boolean | – | Capture full scrollable page. |
| height | number | – | Viewport height. |
| url | string | yes | URL to capture. |
| width | number | – | Viewport width. |
No output schema declared.
No examples provided.
search Web Search ~212
Search the web with SERP, AI synthesis, or both. Returns, by mode: serp the organic results (title, url, snippet, position) with any knowledge graph and featured snippet; ai a written answer with the URLs it cites; deep both. Use for current facts, news and finding pages. To read one page in full use scrape; for a report built from many sources use research. Cost: serp 1 credit, ai 2 credits, deep 3 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | ISO country code of the Google results (serp and deep modes). |
| freshness | string | – | Only sources from this window, in every mode. |
| mode | string | – | Mode: serp (Raw Google SERP results), ai (AI-synthesized answers with citations), deep (SERP + AI synthesis combined). |
| num_results | number | – | Maximum number of organic results (serp and deep modes). |
| query | string | yes | The search query. |
No output schema declared.
No examples provided.
site-intel Site Intelligence ~171
Get comprehensive domain intelligence: WHOIS, DNS, SSL, tech stack, email security, hosting. Returns, by mode, the registration (WHOIS) data, DNS records with email security, the technology stack, a security grade from A to F, or the subdomains; overview combines registration, DNS, SSL and hosting. Use for technical facts about a domain. For business facts about the company behind it use companies; to find a name you can register use domains. Cost: overview 2 credits, whois 1 credit, dns 1 credit, tech-stack 2 credits, security 2 credits, subdomains 2 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain to analyze (e.g. stripe.com). |
| mode | string | – | Intelligence depth. |
No output schema declared.
No examples provided.
sms SMS ~172
Send SMS or WhatsApp messages. Default channel is SMS (reliable delivery). WhatsApp requires recipient opt-in: they must have messaged your Business number within 24 hours. Returns the message id, channel, recipient, sender number and send status. Sends a real message to a phone number: a sent message cannot be recalled, and every call sends a new one. Use it to text a number the user gave you. Cost: 1 credit, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| channel | string | – | Delivery channel. Auto sends via SMS. WhatsApp requires opt-in: recipient must have messaged your Business number in the last 24 hours, otherwise the message is silently dropped by Meta. |
| message | string | yes | Message text. |
| to | string | yes | Phone number (E.164). |
No output schema declared.
No examples provided.
sound-generate Sound Generation ~189
Generate sound effects and short music tracks from text prompts (NOT speech: use tts for spoken voice). Returns the audio as base64 with its format, sample rate and duration. Use for sound effects, ambience and short instrumental music. It produces no spoken words: for speech use tts. Cost: 4 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| duration_seconds | number | – | Length of generated audio in seconds (0.5 to 22). Leave unset to let the model auto-decide based on the prompt. |
| output_format | string | – | Audio format and quality. |
| prompt | string | yes | Description of the sound effect or music to generate. NOT for speech (use tts for spoken voice). |
| prompt_influence | number | – | How strictly to follow the prompt (0.0 = creative, 1.0 = literal). Default 0.3. |
No output schema declared.
No examples provided.
stt Speech-to-Text ~128
Transcribe audio to text with timestamps. Returns the transcript, its confidence, language and duration, and every word with its start and end time. Use for a short clip whose exact words and timings you need. For a long recording with several speakers use transcribe; for caption files use subtitle. Pass audio_url, or the audio itself as audio_base64. Cost: 2 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| audio_base64 | string | – | Base64-encoded audio. |
| audio_url | string | – | URL to audio file. |
| language | string | – | Language code. |
No output schema declared.
No examples provided.
subtitle Subtitles ~102
Generate SRT/VTT subtitles from audio or video. Returns the subtitles as SRT or VTT text with the language, duration and number of cues. Use to caption a video or an audio file. For a plain transcript use stt or transcribe. Cost: 2 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| audio_url | string | yes | URL to audio/video. |
| format | string | – | Subtitle format. |
| language | string | – | Language code. |
No output schema declared.
No examples provided.
transcribe Transcription ~128
Transcribe audio with speaker diarization and timestamps. Returns the full transcript with its confidence, language, duration, word and speaker counts, and the utterances, each with its speaker and start and end time. Use for meetings, interviews and podcasts, where who spoke when matters. For a short clip's word timings use stt; for caption files use subtitle. Cost: 3 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| audio_url | string | yes | URL to audio/video file. |
| language | string | – | Language code. |
| speaker_labels | boolean | – | Enable speaker diarization. |
No output schema declared.
No examples provided.
tts Text-to-Speech ~111
Convert text to speech audio. Returns the speech as base64 MP3 audio with its sample rate and the voice used. Use for spoken voice or narration, up to 2,000 characters a call. For sound effects or music use sound-generate. Cost: 2 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| provider | string | – | TTS provider. |
| text | string | yes | Text to convert (max 2000 chars). |
| voice_model | string | – | Deepgram voice model ID. |
No output schema declared.
No examples provided.
video-download Video Download ~132
Download video from any URL and return a temporary download link. Returns a download link that expires after one hour, with the file name, size, duration, quality, format, title and thumbnail. Use to get a video, or only its audio, as a file. For its details without downloading use video-info. Cost: video 3 credits, audio 2 credits, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Output format. |
| quality | string | – | Desired video quality (best available up to this resolution). |
| url | string | yes | URL of the video or post containing a video. |
No output schema declared.
No examples provided.
video-info Video Info ~102
Extract video metadata, available formats, and thumbnail from any URL. Returns the title, duration, thumbnail, uploader, upload date, view count, platform and the available formats with their sizes. Use to inspect a video before downloading it. To get the file use video-download; for what is said in it use transcribe. Cost: 1 credit, charged only when a call succeeds.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | URL of the video or post containing a video. |
No output schema declared.
No examples provided.
How do I install the Suprsonic MCP server?
Suprsonic runs locally as an npm package, launched with npx -y suprsonic-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · suprsonic-mcp
claude mcp add o-mega-enterprise-suprsonic-mcp -- npx -y suprsonic-mcp
What is the Suprsonic MCP server?
Suprsonic is an MCP server listed in the public MCP registry as io.github.O-mega-Enterprise/suprsonic-mcp. One API key, dozens of capabilities for your AI agent. Zero provider auth. This page covers its npm package (suprsonic-mcp).
Is the Suprsonic MCP server safe to use?
Suprsonic scores 87 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Suprsonic MCP server expose?
Suprsonic exposes 24 tools: search, scrape, profiles, emails, images, and 19 more. Their descriptions and schemas cost roughly 3,937 tokens of context every time the server is loaded.
Is the Suprsonic MCP server still maintained?
Suprsonic is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Suprsonic MCP server under?
Suprsonic declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.