Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Suprsonic

NPM · SUPRSONIC-MCP · 2 COMPONENTS

One API key, dozens of capabilities for your AI agent. Zero provider auth.

0 this week 87 Trust /100

Last scanned (6 hours ago)

Scores higher than 91% of npm servers

Category Search and Retrieval

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to O-mega-Enterprise/suprsonic-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 16 days ago).Pass
  • Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability67
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3937 tokens (~164/item across 24 items; 24 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
  • Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety92
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 2 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "bg-remove" implies "remove" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
  • An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +1
    • Security disclosure: fail → unverified ▼ functional
  • 3 Nov 26 −1
    • Security disclosure: unverified → fail ▼ functional
    • Stability: fail → 0.90 functional
  • 31 Oct 26 0
    • Security disclosure: fail → unverified ▼ functional
  • 30 Oct 26 0
    • Package version: 0.3.3 → 0.3.4 functional
  • 29 Oct 26 0
    • Security disclosure: unverified → fail ▼ functional
  • 28 Oct 26 +1
    • Package version: 0.3.3 → 0.3.4 functional
  • 27 Oct 26 −1
    • Security disclosure: fail → unverified ▼ functional
  • 24 Oct 26 −5
    • CVE-2023-54404 affects this package: high ▼ security
    • Known CVEs: pass → fail ▼ security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/suprsonic-mcp@0.3.4

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo O-mega-Enterprise/suprsonic-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/O-mega-Enterprise/suprsonic-mcp/.github/workflows/publish.yml@refs/tags/v0.3.4
Rekor log index 3320114051
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:69b6ddb9d948a7b4440ba5169981bcf00513bf6d157cc9b90aac1c9ba0e8d3b51a72f0e1dcacc64183ebe3e41cbed72c1c088ed5f8ae96ce7e568791a

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 93 packages
Packages resolved 93
Stale 30
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 24 exposed · ~3,937 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
bg-remove ~83

Remove background from any image. Returns transparent PNG. Returns the cut-out as a base64 PNG with a transparent background. Use to isolate the subject of an existing image. To create a new image use images. Cost: 2 credits, charged only when a call succeeds.

NameTypeReqDescription
image_urlstringyesURL to image.
sizestring–Output resolution.

No output schema declared.

No examples provided.

code-execute ~142

Execute code in a secure sandbox with pre-configured environments. Returns stdout, stderr, the exit code, the run time, and the files the code wrote to /home/user/output/ as base64. Use for calculations, data processing and running scripts. Each call runs in a fresh sandbox that is destroyed afterwards, so nothing carries over from one call to the next. Cost: 2 credits, charged only when a call succeeds.

NameTypeReqDescription
codestringyesThe code to execute.
languagestring–Programming language.
templatestring–Pre-configured environment.
timeoutnumber–Max execution time (1-300s).

No output schema declared.

No examples provided.

companies ~114

Enrich company data by domain. Returns the company's name, description, industry, size, founding year, headquarters, employees, revenue, funding, social links, technologies, logo and brand colors. Use for business facts about a company. For technical facts about its domain (WHOIS, DNS, SSL, hosting) use site-intel; for a person use profiles. Cost: 3 credits, charged only when a call succeeds.

NameTypeReqDescription
company_namestring–Optional name hint.
domainstringyesCompany domain.

No output schema declared.

No examples provided.

documents ~164

Extract structured data from URLs or content. Returns the extracted data as JSON (shaped by your schema when you pass one), with the source URL and whether long content was truncated. Use to turn a page or a text into structured fields. For a page's full text use scrape; for invoices and receipts use invoice-parse. Pass url or content; extraction_prompt says what to extract, and schema fixes the shape of the JSON you get back. Cost: 3 credits, charged only when a call succeeds.

NameTypeReqDescription
contentstring–Pre-scraped text content.
extraction_promptstringyesWhat to extract (required unless schema is provided).
schemaobject–JSON schema for extraction.
urlstring–URL to scrape and extract from.

No output schema declared.

No examples provided.

domains ~631

Find domain names and the extensions that fit a business. Returns, by mode, name ideas with prices, extensions that fit with reasons, one name across extensions, availability for a list of domains, prices per extension, or the extension catalog. Use to name a business or check domains before buying one; it never registers or buys a domain. For facts about a domain that is already live use site-intel. mode decides which fields apply: company_name and description for the suggest modes, query for search-extensions, domains for check-availability, tlds for pricing. Cost: suggest-names 5 credits, suggest-extensions 3 credits, search-extensions 2 credits, check-availability 1 credit, pricing 1 credit, tlds 1 credit, charged only when a call succeeds.

NameTypeReqDescription
company_idstring–Optional O-mega/Founden company id; pulls the real business brief to ground the fit.
company_namestring–The business name (suggest-extensions), or for suggest-names a natural-language brief: any ordering or limit it states (for example "shortest" or "renewal under $15") is read and applied beneath your…
descriptionstring–What the business does; grounds the fit (suggest-* modes).
domainsarray–Full domains to check, e.g. ["brewhaven.com"] (check-availability).
exact_extensionboolean–search-extensions: check ONLY the typed extension.
modestring–Which domain capability to run.
offsetnumber–search-extensions: pagination offset into the catalog.
purposestring–What the domain is for (suggest-names / suggest-extensions): website (the site address), cold (a dedicated cold-email domain, kept apart from the site) or extra. Context the model weighs when judging…
querystring–An exact name to check across extensions (search-extensions).
search_optionsobject–Search options, only the fields you set (suggest-names / search-extensions / suggest-extensions): priorities (objective keys in priority order: total_length, annual_price, renewal_price, registration…
tldsarray–Extensions to price (pricing), to check the name across (search-extensions), or to restrict name ideas to (suggest-names).

No output schema declared.

No examples provided.

email-verify ~106

Check if an email is deliverable, catch-all, or disposable. Returns the status (such as valid, invalid or catch-all) with a sub-status, whether it is a free mailbox, a suggested correction, the domain's age and its mail servers. Use before emailing an address you were given or found. To find an address from a person's name use emails. Cost: 1 credit, charged only when a call succeeds.

NameTypeReqDescription
emailstringyesEmail to verify.

No output schema declared.

No examples provided.

emails ~112

Find professional email addresses. Returns the address with its confidence (0 to 1) and verification status. Use to find a named person's work email at a company. To check an address you already have use email-verify; for the person's background use profiles. Cost: 2 credits, charged only when a call succeeds.

NameTypeReqDescription
companystring–Company name (optional).
domainstringyesCompany domain.
first_namestringyesFirst name.
last_namestringyesLast name.

No output schema declared.

No examples provided.

file-convert ~198

Convert documents, web pages, spreadsheets and images between formats. Returns a download URL of the converted file with its name, size and formats. Use to change a file's format, for example Word to PDF or PDF to Markdown. To extract specific fields use documents; to read a web page's text use scrape. Cost: 2 credits, charged only when a call succeeds.

NameTypeReqDescription
file_urlstringyesURL of the file to convert (for source_format web, the page itself).
source_formatstringyesFormat of the file: pdf, docx, pptx, xlsx, csv, html, web (a page, from its HTML without JavaScript), txt, epub, svg, png, jpg, webp, gif, bmp, tiff or heic.
target_formatstring–Format to convert to. The conversion table's pairs convert in-house; other pairs go to ConvertAPI.

No output schema declared.

No examples provided.

images ~103

Generate images from text prompts. Returns a hosted URL of the PNG and the same image as base64 (b64_json), with the aspect ratio and size used. Use to create a new picture from a description. To cut the background out of an existing image use bg-remove; to capture a web page use screenshot. Cost: 3 credits, charged only when a call succeeds.

NameTypeReqDescription
aspect_ratiostring–Aspect ratio.
promptstringyesImage description.

No output schema declared.

No examples provided.

invoice-parse ~91

Extract structured data from invoices and receipts. Returns the invoice number, dates, supplier and customer, currency, subtotal, tax, total and every line item. Use for an invoice or receipt given as a PDF or image URL. For any other document use documents with your own schema. Cost: 3 credits, charged only when a call succeeds.

NameTypeReqDescription
document_urlstringyesURL to invoice PDF/image.

No output schema declared.

No examples provided.

profiles ~155

Find and enrich professional profiles. Returns the person's name, headline, current company and title, location, summary, experience, education, skills, photo URL and LinkedIn URL. Use to learn who a professional is and what they have done. For their work email use emails; for a company rather than a person use companies. Pass linkedin_url, or first_name and last_name; company helps find the right person. Cost: 3 credits, charged only when a call succeeds.

NameTypeReqDescription
companystring–Company name.
first_namestring–First name.
include_imageboolean–Fetch profile image.
last_namestring–Last name.
linkedin_urlstring–LinkedIn profile URL.

No output schema declared.

No examples provided.

research ~259

Multi-step deep research: search, scrape, enrich entities, and synthesize into a cited report. Returns a report (title, summary, sections, key findings, confidence) with numbered sources and the people and companies it found, enriched. Use for a question that needs many sources and a synthesized, cited answer. It takes far longer and costs more than search, which suits a quick fact. Cost: standard 10 credits, deep 20 credits, comprehensive 35 credits, charged only when a call succeeds. Options change it: include_analysis true +5, academic in source_types +2, enrich_entities false -3, synthesis false -5.

NameTypeReqDescription
depthstring–Research depth.
enrich_entitiesboolean–Enrich detected people and companies with profile and firmographic data.
freshnessstring–Time filter for search results.
include_analysisboolean–Generate computational analysis with charts.
max_sourcesnumber–Maximum number of sources to collect.
querystringyesThe research question or objective.
source_typesstring–Comma-separated source types: web, news, academic.
synthesisboolean–Generate a synthesized report. Set false for raw mode (sources + entities only).

No output schema declared.

No examples provided.

scrape ~221

Extract content from any URL as Markdown or HTML. Returns the page's content in the chosen format (Markdown by default) with its title, description and links. Use when you have a URL and need what the page says. Start with fast; use standard for pages that need JavaScript and thorough only for sites that block scrapers. To pull specific fields into JSON use documents; to see the page as an image use screenshot. Cost: fast 1 credit, standard 2 credits, thorough 5 credits, charged only when a call succeeds.

NameTypeReqDescription
modestring–Mode: fast (Raw HTTP, no JS. <1s), standard (Full JS rendering. 2-5s), thorough (Anti-bot proxies + JS rendering. 10-30s).
outputstring–Content format.
timeoutnumber–Seconds the page may take to load (up to 55).
urlstringyesURL to scrape.
wait_forstring–CSS selector to wait for (standard and thorough modes).

No output schema declared.

No examples provided.

screenshot ~111

Capture a rendered screenshot of any webpage. Returns the image as base64 with its format, dimensions and size in bytes. Use to see how a page looks. To read its text use scrape. Cost: 1 credit, charged only when a call succeeds.

NameTypeReqDescription
formatstring–Output format.
full_pageboolean–Capture full scrollable page.
heightnumber–Viewport height.
urlstringyesURL to capture.
widthnumber–Viewport width.

No output schema declared.

No examples provided.

search ~212

Search the web with SERP, AI synthesis, or both. Returns, by mode: serp the organic results (title, url, snippet, position) with any knowledge graph and featured snippet; ai a written answer with the URLs it cites; deep both. Use for current facts, news and finding pages. To read one page in full use scrape; for a report built from many sources use research. Cost: serp 1 credit, ai 2 credits, deep 3 credits, charged only when a call succeeds.

NameTypeReqDescription
countrystring–ISO country code of the Google results (serp and deep modes).
freshnessstring–Only sources from this window, in every mode.
modestring–Mode: serp (Raw Google SERP results), ai (AI-synthesized answers with citations), deep (SERP + AI synthesis combined).
num_resultsnumber–Maximum number of organic results (serp and deep modes).
querystringyesThe search query.

No output schema declared.

No examples provided.

site-intel ~171

Get comprehensive domain intelligence: WHOIS, DNS, SSL, tech stack, email security, hosting. Returns, by mode, the registration (WHOIS) data, DNS records with email security, the technology stack, a security grade from A to F, or the subdomains; overview combines registration, DNS, SSL and hosting. Use for technical facts about a domain. For business facts about the company behind it use companies; to find a name you can register use domains. Cost: overview 2 credits, whois 1 credit, dns 1 credit, tech-stack 2 credits, security 2 credits, subdomains 2 credits, charged only when a call succeeds.

NameTypeReqDescription
domainstringyesDomain to analyze (e.g. stripe.com).
modestring–Intelligence depth.

No output schema declared.

No examples provided.

sms ~172

Send SMS or WhatsApp messages. Default channel is SMS (reliable delivery). WhatsApp requires recipient opt-in: they must have messaged your Business number within 24 hours. Returns the message id, channel, recipient, sender number and send status. Sends a real message to a phone number: a sent message cannot be recalled, and every call sends a new one. Use it to text a number the user gave you. Cost: 1 credit, charged only when a call succeeds.

NameTypeReqDescription
channelstring–Delivery channel. Auto sends via SMS. WhatsApp requires opt-in: recipient must have messaged your Business number in the last 24 hours, otherwise the message is silently dropped by Meta.
messagestringyesMessage text.
tostringyesPhone number (E.164).

No output schema declared.

No examples provided.

sound-generate ~189

Generate sound effects and short music tracks from text prompts (NOT speech: use tts for spoken voice). Returns the audio as base64 with its format, sample rate and duration. Use for sound effects, ambience and short instrumental music. It produces no spoken words: for speech use tts. Cost: 4 credits, charged only when a call succeeds.

NameTypeReqDescription
duration_secondsnumber–Length of generated audio in seconds (0.5 to 22). Leave unset to let the model auto-decide based on the prompt.
output_formatstring–Audio format and quality.
promptstringyesDescription of the sound effect or music to generate. NOT for speech (use tts for spoken voice).
prompt_influencenumber–How strictly to follow the prompt (0.0 = creative, 1.0 = literal). Default 0.3.

No output schema declared.

No examples provided.

stt ~128

Transcribe audio to text with timestamps. Returns the transcript, its confidence, language and duration, and every word with its start and end time. Use for a short clip whose exact words and timings you need. For a long recording with several speakers use transcribe; for caption files use subtitle. Pass audio_url, or the audio itself as audio_base64. Cost: 2 credits, charged only when a call succeeds.

NameTypeReqDescription
audio_base64string–Base64-encoded audio.
audio_urlstring–URL to audio file.
languagestring–Language code.

No output schema declared.

No examples provided.

subtitle ~102

Generate SRT/VTT subtitles from audio or video. Returns the subtitles as SRT or VTT text with the language, duration and number of cues. Use to caption a video or an audio file. For a plain transcript use stt or transcribe. Cost: 2 credits, charged only when a call succeeds.

NameTypeReqDescription
audio_urlstringyesURL to audio/video.
formatstring–Subtitle format.
languagestring–Language code.

No output schema declared.

No examples provided.

transcribe ~128

Transcribe audio with speaker diarization and timestamps. Returns the full transcript with its confidence, language, duration, word and speaker counts, and the utterances, each with its speaker and start and end time. Use for meetings, interviews and podcasts, where who spoke when matters. For a short clip's word timings use stt; for caption files use subtitle. Cost: 3 credits, charged only when a call succeeds.

NameTypeReqDescription
audio_urlstringyesURL to audio/video file.
languagestring–Language code.
speaker_labelsboolean–Enable speaker diarization.

No output schema declared.

No examples provided.

tts ~111

Convert text to speech audio. Returns the speech as base64 MP3 audio with its sample rate and the voice used. Use for spoken voice or narration, up to 2,000 characters a call. For sound effects or music use sound-generate. Cost: 2 credits, charged only when a call succeeds.

NameTypeReqDescription
providerstring–TTS provider.
textstringyesText to convert (max 2000 chars).
voice_modelstring–Deepgram voice model ID.

No output schema declared.

No examples provided.

video-download ~132

Download video from any URL and return a temporary download link. Returns a download link that expires after one hour, with the file name, size, duration, quality, format, title and thumbnail. Use to get a video, or only its audio, as a file. For its details without downloading use video-info. Cost: video 3 credits, audio 2 credits, charged only when a call succeeds.

NameTypeReqDescription
formatstring–Output format.
qualitystring–Desired video quality (best available up to this resolution).
urlstringyesURL of the video or post containing a video.

No output schema declared.

No examples provided.

video-info ~102

Extract video metadata, available formats, and thumbnail from any URL. Returns the title, duration, thumbnail, uploader, upload date, view count, platform and the available formats with their sizes. Use to inspect a video before downloading it. To get the file use video-download; for what is said in it use transcribe. Cost: 1 credit, charged only when a call succeeds.

NameTypeReqDescription
urlstringyesURL of the video or post containing a video.

No output schema declared.

No examples provided.

Install

How do I install the Suprsonic MCP server?

Suprsonic runs locally as an npm package, launched with npx -y suprsonic-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · suprsonic-mcp

# add to Claude Code
claude mcp add o-mega-enterprise-suprsonic-mcp -- npx -y suprsonic-mcp
Common questions

What is the Suprsonic MCP server?

Suprsonic is an MCP server listed in the public MCP registry as io.github.O-mega-Enterprise/suprsonic-mcp. One API key, dozens of capabilities for your AI agent. Zero provider auth. This page covers its npm package (suprsonic-mcp).

Is the Suprsonic MCP server safe to use?

Suprsonic scores 87 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Suprsonic MCP server expose?

Suprsonic exposes 24 tools: search, scrape, profiles, emails, images, and 19 more. Their descriptions and schemas cost roughly 3,937 tokens of context every time the server is loaded.

Is the Suprsonic MCP server still maintained?

Suprsonic is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Suprsonic MCP server under?

Suprsonic declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.