Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Jam Jam

NPM · @JAM-JAM/CONVERT-MCP

Convert music files to chord sheets and manage your Jam Jam songbook from an AI assistant.

57 Trust /100

Last scanned (7 hours ago)

Scores higher than 36% of npm servers

Category Entertainment and Games

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 1.30.0, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 31 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
Schema Quality & AI Usability70
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3802 tokens (~190/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "jj_delete_song" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 15 Oct 26 57

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 18 Oct 2026 · Analysed npm/@jam-jam/convert-mcp@0.2.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-6qxp-vccf-f47h CVE-2026-104850 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 93 packages
Packages resolved 93
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 20 exposed · ~3,802 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
jj_check_usage ~159

Returns, in one call, what the calling Jam Jam identity is allowed to do and how much of each allowance is left. THREE INDEPENDENT COUNTERS, they never borrow from one another: `conversion` (10 per week on a free account, 500 per calendar month on Premium, 3 per 24h anonymous), `read` (2000 per UTC day free, 20000 Premium, spent by the notebook and social listing tools) and `write` (200 per UTC day free, 5000 Premium, spent by the notebook writing tools). `scopes` lists the permissions of the API key in use. Call this before a batch, and after a quota error to learn when it resets. Costs nothing itself.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

jj_convert_file ~370

Uploads a local file (path, or base64 content) to the Jam Jam API, waits for the conversion to finish, and returns the result: embedded text for small text formats (ChordPro, .lrc, .lab...), or a local file path for binary formats (PDF, MIDI, MP4...). Call jj_list_formats first to find valid "output" ids for your input. Consumes one unit of the conversion quota (10/week free, 500/month Premium, see jj_check_usage), which is a different counter from notebook reads and writes.

NameTypeReqDescription
contentBase64string–Base64-encoded file content. Mutually exclusive with path. Requires "filename".
deliverstring–"download" (default) returns the artifact; "carnet" saves it to the caller's Jam Jam notebook instead (requires an account).
filenamestring–File name (with extension). Required with contentBase64; defaults to the basename of "path".
inputFormatstring–Input format id from jj_list_formats (e.g. "pdf-songbook", "audio-file"). Omit to let the server detect it.
maxWaitMsinteger–Maximum time to wait for the job to finish, in milliseconds (default 120000, hard cap 600000). If exceeded, the job keeps running server-side; poll it with jj_get_job.
optionsobject–Extra per-format options, see jj_list_formats for the target format.
outputstringyesOutput format id from jj_list_formats (e.g. "pdf-songbook", "midi", "songbook").
pathstring–Absolute or relative local path to the file to convert. Mutually exclusive with contentBase64.

No output schema declared.

No examples provided.

jj_convert_text ~280

Sends plain text or ChordPro (pasted lyrics and chords, no file) to the Jam Jam API, waits for the conversion to finish, and returns the result: embedded text for small text formats, or a local file path for binary formats (PDF, MIDI...). Call jj_list_formats first to find valid "output" ids. Consumes one unit of the conversion quota.

NameTypeReqDescription
deliverstring–"download" (default) returns the artifact; "carnet" saves it to the caller's Jam Jam notebook instead (requires an account).
inputFormatstring–Input format id from jj_list_formats (e.g. "chordpro", "text-lyrics"). Omit to let the server detect it.
maxWaitMsinteger–Maximum time to wait for the job to finish, in milliseconds (default 120000, hard cap 600000). If exceeded, the job keeps running server-side; poll it with jj_get_job.
optionsobject–Extra per-format options, see jj_list_formats for the target format.
outputstringyesOutput format id from jj_list_formats (e.g. "pdf-songbook", "midi", "songbook").
textstringyesPlain text or ChordPro to convert (up to 262144 characters).

No output schema declared.

No examples provided.

jj_create_playlist ~156

Creates a playlist in the calling account's notebook. Playlists are flat and allow multi-membership: a song can be in several of them. `songIds` is the ordered content and every id must be a live song of this account. Consumes one unit of the daily write quota.

NameTypeReqDescription
coverEmoji––Single emoji used as the cover, or null for none.
namestringyesPlaylist name as the user will see it.
songIdsarray–Ordered content of the playlist; the order is what the user will see and is never re-sorted. Every id must be a live song of this account, otherwise the whole call fails: a half-created playlist woul…

No output schema declared.

No examples provided.

jj_create_song ~354

Adds a song to the calling account's PRIVATE notebook. `song` is the canonical pivot payload: exactly the object returned by jj_get_song (`song`) or by a conversion whose output is "songbook", so converting then filing is a copy with no transformation. The id is DERIVED, never random: `song.id` if given, otherwise an "artist-title" slug. That means posting the same song twice REPLACES it instead of creating a duplicate, and it is also how you rewrite a song wholesale (read it with jj_get_song, edit the payload, post it back with its id). Adding NEVER publishes anything on the public profile. Consumes one unit of the daily WRITE quota (200/day free, 5000 Premium).

NameTypeReqDescription
playlistIdsarray–COMPLETE target state of playlist membership, not a delta: the song joins the playlists listed and LEAVES every other one. [] removes it from all of them. Omit to leave memberships untouched.
publishboolean–NOT ACCEPTED HERE, and passing it is an error rather than a no-op. Adding a song and publishing it on a public profile are two different decisions: publish afterwards with jj_update_song, once the pe…
songobjectyesCanonical pivot payload. `title` is required and non-empty; `artist`, `sections[].lines[].lyrics`, `sections[].lines[].chords[] = { offset, chord }`, `detectedKey { tonic, scale }` and `metadata { ca…

No output schema declared.

No examples provided.

jj_delete_playlist ~70

Deletes a playlist, and ONLY the playlist: its songs stay in the notebook and in their other playlists. Idempotent, and an unknown id succeeds too. If the playlist was published on the profile, that published copy disappears.

NameTypeReqDescription
playlistIdstringyesStable playlist id ("pl_...").

No output schema declared.

No examples provided.

jj_delete_song ~115

Deletes a song from the calling account's notebook. Idempotent: deleting twice succeeds twice, and an unknown id succeeds too (saying "no such song" would leak whether it exists in someone else's notebook). Side effects are the same as deleting in the app: the song leaves all its playlists, its published copy disappears from the profile, and accounts that had imported it are notified. This cannot be undone from the API: confirm with the person before calling it.

NameTypeReqDescription
songIdstringyesStable notebook song id.

No output schema declared.

No examples provided.

jj_get_job ~105

Fetches the current state of a conversion job by id: phase (queued/running/done/failed/cancelled), per-step progress, and the list of artifacts once done. Use this to check on a job after jj_convert_file or jj_convert_text stopped waiting for it.

NameTypeReqDescription
idstringyesJob id returned by jj_convert_file or jj_convert_text (e.g. "jb_9f2a1c7e4b6d8801").

No output schema declared.

No examples provided.

jj_get_playlist ~130

Returns one playlist of the calling account's notebook with its songs in summary form, in playlist order, paginated by the same opaque cursor. A song the playlist still references but that has since been deleted from the notebook is simply skipped.

NameTypeReqDescription
cursorstring–Opaque cursor from a previous call's `nextCursor`. Replay it verbatim; never build one.
limitinteger–Page size, default 30, hard cap 100 (25 when fields="full").
playlistIdstringyesStable playlist id ("pl_..."), as returned by jj_list_playlists.

No output schema declared.

No examples provided.

jj_get_profile ~130

Returns the profile card of a Jam Jam account designated by its public @handle, seen from the calling account: display name, bio, avatar, visibility (public/private), follower and following counts, and `relation` (none / following / follower / mutual / requested / self). A PRIVATE account the caller does not follow returns a closed card without bio or counts. An unknown handle returns not-found. Jam Jam is a host: this never ranks or recommends anyone, and never exposes somebody else's audience figures.

NameTypeReqDescription
handlestringyesPublic username of the account, with or without the leading "@".

No output schema declared.

No examples provided.

jj_get_song ~121

Returns one song of the calling account's notebook in full: the summary fields AND `song`, the canonical pivot payload (sections, lines, chords with their offsets, lyrics, detectedKey, metadata). That payload is exactly what jj_create_song and jj_update_song accept, so reading then writing back is a copy, not a translation. An unknown id and an id belonging to another account both return the same not-found error.

NameTypeReqDescription
songIdstringyesStable notebook song id (an "artist-title" slug), as returned by jj_list_songs.

No output schema declared.

No examples provided.

jj_list_followers ~134

Lists the calling account's own followers, newest first. status="requested" lists the follow requests it has not accepted yet. Only the caller's own relations are readable; reading somebody else's followers is not offered by this API.

NameTypeReqDescription
cursorstring–Opaque cursor from a previous call's `nextCursor`. Replay it verbatim.
limitinteger–Page size, default 30, hard cap 100.
statusstring–"accepted" (default) for established follows, "requested" for pending requests. Closed list: any other value is refused, the two states never mix.

No output schema declared.

No examples provided.

jj_list_following ~136

Lists the accounts the calling account follows, newest first. status="requested" lists the requests it has sent to private accounts and that are still pending. Following and un-following are done in the Jam Jam application, never by API.

NameTypeReqDescription
cursorstring–Opaque cursor from a previous call's `nextCursor`. Replay it verbatim.
limitinteger–Page size, default 30, hard cap 100.
statusstring–"accepted" (default) for established follows, "requested" for pending requests. Closed list: any other value is refused, the two states never mix.

No output schema declared.

No examples provided.

jj_list_formats ~161

Lists the input and output formats actually served by the Jam Jam API right now (GET /formats), with their limits (maxBytes, maxPages, maxDurationS) and whether they require an account or Premium. Call this FIRST, before jj_convert_file or jj_convert_text, to know which output ids are valid for a given input. Pass "input" to get the exact list of possible outputs for that one input format. Needs no API key.

NameTypeReqDescription
inputstring–Restrict the response to the possible outputs from this input format id (as returned by a previous call without "input"). Adds `possibleOutputs` to the result.
localestring–BCP-47 locale for any localized labels, e.g. "fr".

No output schema declared.

No examples provided.

jj_list_playlists ~173

Lists the playlists of the calling account's notebook. Playlists are FLAT and allow multi-membership: `songIds` is the ORDERED list of song ids, and one song can appear in several playlists. Same cursor pagination and same updatedSince incremental filter as jj_list_songs. Consumes one unit of the daily read quota.

NameTypeReqDescription
cursorstring–Opaque cursor from a previous call's `nextCursor`. Replay it verbatim; never build one.
limitinteger–Page size, default 30, hard cap 100 (25 when fields="full").
updatedSincestring–ISO 8601 date. Returns only objects STRICTLY newer (updatedAt > updatedSince). Keep the largest updatedAt you received and pass it back next time for an incremental export.

No output schema declared.

No examples provided.

jj_list_profile_playlists ~120

Lists the playlists an account has published on its profile. Same visibility rules as jj_list_profile_songs. `songCount` already counts only what the caller is allowed to see: a published playlist hides the songs its author did not publish.

NameTypeReqDescription
cursorstring–Opaque cursor from a previous call's `nextCursor`. Replay it verbatim.
handlestringyesPublic username of the account, with or without the leading "@".
limitinteger–Page size, default 30, hard cap 100.

No output schema declared.

No examples provided.

jj_list_profile_songs ~164

Lists the songs an account has chosen to publish on its profile, newest first, with cursor pagination. `hasAudio` and `audioPlayable` are only ever true between accounts that follow each other MUTUALLY: without that link the very existence of a backing track is withheld, and no endpoint serves audio at all. A private account you do not follow refuses the call; an unknown handle returns not-found. Consumes one unit of the daily read quota.

NameTypeReqDescription
cursorstring–Opaque cursor from a previous call's `nextCursor`. Replay it verbatim.
handlestringyesPublic username of the account, with or without the leading "@".
limitinteger–Page size, default 30, hard cap 100.

No output schema declared.

No examples provided.

jj_list_songs ~243

Lists the songs in the calling account's PRIVATE Jam Jam notebook, page by page, oldest update first. fields="summary" (default) gives id, title, artist, key, capo, bpm, playlistIds and updatedAt; fields="full" adds the complete pivot payload (chords, lyrics, sections) and lowers the page cap to 25. Use the returned nextCursor to get the next page, and stop when it is null. Consumes one unit of the daily READ quota (2000/day free, 20000 Premium), never a conversion.

NameTypeReqDescription
cursorstring–Opaque cursor from a previous call's `nextCursor`. Replay it verbatim; never build one.
fieldsstring–"summary" (default) or "full" to include the complete song payload.
limitinteger–Page size, default 30, hard cap 100 (25 when fields="full").
updatedSincestring–ISO 8601 date. Returns only objects STRICTLY newer (updatedAt > updatedSince). Keep the largest updatedAt you received and pass it back next time for an incremental export.

No output schema declared.

No examples provided.

jj_update_playlist ~231

Changes one or more fields of a playlist: `name`, `coverEmoji` (null removes it), and `songIds`, which REPLACES the whole content and its order. Only the fields you pass move. To reorder, read the playlist with jj_get_playlist first and send the full list back in the new order.

NameTypeReqDescription
coverEmoji––New cover emoji; null removes it.
ifMatchstring–The `updatedAt` you last read for this object. When set, the write is refused with a conflict error if anything changed it since (another device, or the Jam Jam app). Without it, last writer wins. Us…
namestring–New name.
playlistIdstringyesStable playlist id ("pl_...").
songIdsarray–Ordered content of the playlist; the order is what the user will see and is never re-sorted. Every id must be a live song of this account, otherwise the whole call fails: a half-created playlist woul…

No output schema declared.

No examples provided.

jj_update_song ~450

Changes some fields of one song of the calling account's notebook. Only the fields you pass move; a field set to null erases its value. `key` is the DISPLAYED key ("G", "Am"). `playlistIds` is the complete target membership, so it is idempotent. `publish: true` puts the song on the account's public profile and requires `publishDeclaration` the first time, plus a public username; `publish: false` removes it and has no conditions. Publishing is a deliberate act by the account holder: never publish unless they asked. To rewrite lyrics, chords or structure, use jj_create_song with the song's id instead.

NameTypeReqDescription
artist––New artist; null erases it.
bpm––Tempo; null erases it.
capo––Capo fret; null erases it.
ifMatchstring–The `updatedAt` you last read for this object. When set, the write is refused with a conflict error if anything changed it since (another device, or the Jam Jam app). Without it, last writer wins. Us…
key––Displayed key ("G", "Am"); null erases it.
playlistIdsarray–COMPLETE target state of playlist membership, not a delta: the song joins the playlists listed and LEAVES every other one. [] removes it from all of them. Omit to leave memberships untouched.
publishboolean–true publishes on the public profile, false un-publishes. Ask the person first.
publishDeclarationstring–Rights declaration, required ONCE per object the first time it is published. "created": the account holder wrote it. "imported_no_known_restriction": a cover they know of no restriction on. "arrangem…
songIdstringyesStable notebook song id, as returned by jj_list_songs or jj_get_song.
titlestring–New title.

No output schema declared.

No examples provided.

Install

How do I install the Jam Jam MCP server?

Jam Jam runs locally as an npm package, launched with npx -y @jam-jam/convert-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @jam-jam/convert-mcp

# add to Claude Code
claude mcp add org-jam-jam-convert-mcp -- npx -y @jam-jam/convert-mcp
Common questions

What is the Jam Jam MCP server?

Jam Jam is an MCP server listed in the public MCP registry as org.jam-jam/convert-mcp. Convert music files to chord sheets and manage your Jam Jam songbook from an AI assistant. This page covers its npm package (@jam-jam/convert-mcp).

Is the Jam Jam MCP server safe to use?

Jam Jam scores 57 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 18 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Jam Jam MCP server expose?

Jam Jam exposes 20 tools: jj_check_usage, jj_list_formats, jj_convert_file, jj_convert_text, jj_get_job, and 15 more. Their descriptions and schemas cost roughly 3,802 tokens of context every time the server is loaded.

Is the Jam Jam MCP server still maintained?

Jam Jam is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Jam Jam MCP server under?

Jam Jam declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.