# withPICA Directory (remote · directory.withpica.com)

Public music-rights directory: who wrote and owns a song, its ISWC/ISRC/IPI, and licensing asks

- Trust score: 68/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `directory.withpica.com`: 68/100 (this document), [markdown](https://verifymcp.io/servers/withpica-pica-directory/directory.md), [page](https://verifymcp.io/servers/withpica-pica-directory/directory)

## Channel facts

- Endpoint: `https://directory.withpica.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.13.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: this server exposes a tool marked destructive (directory_send_licensing_enquiry) and its handshake is open, but we could not confirm whether a tool call is gated, so we do not assert it is callable unauthenticated.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 78/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 4942 tokens (~260/item across 19 items; 13 tools + 6 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 3/100
  - Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the withPICA Directory MCP server?

withPICA Directory is a hosted endpoint at https://directory.withpica.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http withpica-pica-directory 'https://directory.withpica.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "withpica-pica-directory": {
      "url": "https://directory.withpica.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "withpica-pica-directory": {
      "type": "http",
      "url": "https://directory.withpica.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.withpica-pica-directory]
url = "https://directory.withpica.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "withpica-pica-directory": {
      "type": "remote",
      "url": "https://directory.withpica.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add withpica-pica-directory --url 'https://directory.withpica.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  withpica-pica-directory:
    url: "https://directory.withpica.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "withpica-pica-directory": {
      "Transport": "http",
      "Url": "https://directory.withpica.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add withpica-pica-directory -t streamable-http -u 'https://directory.withpica.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "withpica-pica-directory": {
      "type": "http",
      "url": "https://directory.withpica.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 68, +1)

- [functional improvement] Stability: unverified → 0.03

### 2026-11-04 (score 67)

First indexed and scored.

## MCP tools (13)

### `directory_list_works` (~400 tokens)

List works

Use when the user asks: 'list works in PICA', 'works starting with B', 'find works by publisher X', 'browse the catalog', 'a song about love', 'songs about X'. For a theme or subject, search its plain word in q ('love', 'home', 'summer'): titles carry the theme. Start here before any mood or sound search, which only narrows. Browse and filter musical works their owners have listed in the PICA public directory. Filter by free-text (q), ISWC, ISRC, publisher, label, or starting letter (A–Z, or '#' for numeric). Sort by title (default) or recent. Returns paginated results. Each work carries ai_origin: whether the OWNER declared it human-made, AI-assisted or AI-generated (or 'not stated' — never assume human-made), with ACRCloud's AI detection beside it. Set human_made_only to keep only works the owner declared human-made that ACRCloud does not call likely AI. → then: directory_lookup_work (full details with credits and audio)

Input parameters:

- `human_made_only` (boolean): Only works the owner declared human-made, leaving out any ACRCloud calls likely AI-generated.
- `isrc` (string): Filter by ISRC (exact match, cross-table recording lookup)
- `iswc` (string): Filter by ISWC (e.g. T-123.456.789-0)
- `label` (string): Filter by record label (partial match)
- `letter` (string): Filter by title starting letter (A–Z), or '#' for numeric
- `page` (number): Page number (default: 1, 20 results per page)
- `publisher` (string): Filter by publisher name (partial match)
- `q` (string): Text search across work titles and identifiers
- `sort` (string): Sort order (default: title)

### `directory_lookup_work` (~251 tokens)

Look up a work

Use when the user asks: 'what's the ISWC for X?', 'who wrote X?', 'tell me about song X', 'is this song registered?'. Get the details of a single listed work by ISWC or work UUID. Returns the credits, one per person with each role marked confirmed or not confirmed by that person, and the person's IPI; each writer's share of the work, only when the owner chose to show shares AND that writer confirmed it themselves (with how many writers have); the recordings' ISRCs, audio analysis (BPM, key, energy) when the audio has been analysed, streaming links (Spotify, Apple Music, YouTube), AI origin (what the owner declared, with ACRCloud's detection beside it), the work's PICA score, and whether the owner is taking licensing enquiries, as a markdown summary. Fields with no data are omitted. → then: directory_lookup_person (a credited writer, by the credit's global_creator_id or IPI), directory_search_recordings (find similar tracks by audio)

Input parameters:

- `identifier` (string, required): ISWC (e.g. T-123.456.789-0) or work UUID

### `directory_lookup_isrc` (~109 tokens)

Look up a work by ISRC

Use when the user asks: 'lookup ISRC X', 'what's the work for ISRC X?', 'find the work for this recording'. Shortcut: look up the work(s) associated with a recording identifier (ISRC). Equivalent to directory_list_works with an isrc filter, pinned for recording-first discovery. → then: directory_lookup_work (full details on the matched work)

Input parameters:

- `isrc` (string, required): ISRC code (e.g. USABC1234567)

### `directory_list_people` (~191 tokens)

List creators

Use when the user asks: 'list creators in PICA', 'people starting with B', 'browse the people directory'. Browse and filter creators in the PICA public directory. Filter by free-text (q), ISNI, IPI, or starting letter (A–Z, or '#' for numeric). Returns paginated results. Each result carries global_creator_id, the ID directory_lookup_person takes. → then: directory_lookup_person (identifiers, roles, listed-work count and collaborators for one creator)

Input parameters:

- `ipi` (string): Filter by IPI number
- `isni` (string): Filter by ISNI identifier
- `letter` (string): Filter by last name starting letter (A–Z), or '#' for numeric
- `page` (number): Page number (default: 1, 20 results per page)
- `q` (string): Text search across creator names

### `directory_lookup_person` (~271 tokens)

Look up a creator

Use when the user asks: 'lookup IPI 12345', 'lookup ISNI X', 'find creator by MusicBrainz ID'. Also use it for the profile of a creator already found with directory_list_people or directory_search. Looks up ONE creator in the PICA public directory by an identifier: global_creator_id (UUID, from directory_list_people or directory_search), ISNI, IPI number, or MusicBrainz ID. It does not accept a name: to find a creator by name, or to choose between several people with the same name, use directory_list_people (q) or directory_search first. Returns the creator's name, identifiers (IPI, ISNI, MusicBrainz), roles, the number of their works listed in the directory, their PICA profile grade, and up to five collaborators on those listed works. It does not list the works themselves: use directory_list_works or directory_search with the creator's name for those. An unknown identifier returns not found. → then: directory_list_works (their listed works, by name)

Input parameters:

- `id` (string, required): global_creator_id (UUID) from directory_list_people or directory_search, an ISNI, an IPI number, or a MusicBrainz ID. Not a name, and not person_id.

### `directory_search` (~185 tokens)

Search the directory

Use when the user asks: 'find me X', 'who or what is X?', 'find any record of X', 'a song about X'. Use when the entity type is not yet known. Convenience fan-out across works and creators — runs list_works and list_people with the same query and returns the union. No cross-type ranking; prefer list_works or list_people when the entity type is known. → then: directory_lookup_work (work details), directory_lookup_person (creator details, by the result's global_creator_id)

Input parameters:

- `human_made_only` (boolean): Works only: keep works the owner declared human-made that ACRCloud does not call likely AI-generated.
- `query` (string, required): Search query — matches work titles, ISWCs, creator names, ISNIs
- `type` (string): Limit results to a specific entity type

### `directory_search_recordings` (~851 tokens)

Find recordings by sound

Use when the user asks: 'find upbeat tracks around 120 BPM', 'find instrumental tracks in C minor', 'find energetic music for sync', 'tracks at X BPM in [key]'. AUDIO-FEATURE search only — for name- or title-shaped queries use directory_lookup_work, directory_lookup_isrc, or directory_list_people, NOT this tool. Not for a theme or subject ('a song about love'): search that in directory_list_works q first, then narrow here. Few recordings carry a mood yet, so an empty mood search does not mean the directory has no such song. Find tracks by BPM, key, energy, danceability, duration, mood, and more. The measured filters (BPM, key, energy, …) match analysed audio only; a mood search also returns works whose owner set the mood, marked mood_note "mood set by the owner, not analysed" — say so when you present them. Only returns recordings of works listed on the directory by their owner or a confirmed writer. → then: directory_lookup_work (credits and licensing details for a matched track)

Input parameters:

- `instrumental_only` (boolean): Only songs or recordings the OWNER marked instrumental (not a measurement).
- `key` (string): Musical key (e.g. 'C', 'F#', 'Bb'). Matches the detected key.
- `key_mode` (string): Key mode — major or minor
- `limit` (number): Max results to return (default: 20, max: 100).
- `max_bpm` (number): Maximum BPM (e.g. 140)
- `max_brightness` (number): Maximum brightness, 0 to 1 (measured).
- `max_danceability` (number): Ignored: danceability is not measured.
- `max_duration` (number): Maximum duration in seconds.
- `max_dynamics` (number): Maximum dynamics, 0 to 1 (see min_dynamics).
- `max_energy` (number): Maximum energy, 0 to 1 (measured loudness).
- `max_rhythmic_density` (number): Maximum rhythmic density, 0 to 1 (see min_rhythmic_density).
- `min_bpm` (number): Minimum BPM (e.g. 100)
- `min_brightness` (number): Minimum brightness, 0 to 1 — measured high-frequency content (spectral rolloff), not a mood. 0 = the darkest 5% of the directory, 1 = the brightest 5%.
- `min_danceability` (number): Ignored: danceability is not measured. Use min_rhythmic_density or min_energy.
- `min_duration` (number): Minimum duration in seconds.
- `min_dynamics` (number): Minimum dynamics, 0 to 1 — measured loudness range (EBU R128). Not yet calibrated: accepted and ignored until it is (the result's ignored_filters says so).
- `min_energy` (number): Minimum energy, 0 to 1 — measured loudness (ITU-R BS.1770 integrated loudness on a quiet-to-loud scale), not a mood. Higher = louder.
- `min_rhythmic_density` (number): Minimum rhythmic density, 0 to 1 — measured onsets per second. Not yet calibrated: accepted and ignored until it is.
- `mood` (string): Mood — one of: aggressive, ambient, calm, contemplative, dark, dramatic, dreamy, energetic, epic, ethereal, hopeful, intense, melancholic, nostalgic, passionate, playful, romantic, sad, tender, tense…
- `vocals_only` (boolean): Ignored: vocals are not measured and owners do not mark them.

### `directory_chain` (~616 tokens)

Rights chain for a work

Use when the user asks: 'show me the rights chain for X', 'give me everything on this song', 'what's the full picture for X?', 'trace the chain from this writer to that work'. Graph lookup — resolves a query, ISWC, or ISRC to its full rights chain in one call. Each result bundles the work, its writers and publishers (names + roles, no IPIs or splits), the linked recording (ISRC, DSP presence, duration), and audio characteristics (BPM, key, energy). Prefer over stitching list_works + lookup_work + lookup_person when you want the whole graph around a track in a single round-trip. Supports audio-only queries (min_bpm, key, mood, etc.) when you don't have a text query. Work results carry programmable_since (every owner confirmed a locked split) and ready_to_license (composition and a master confirmed, with audio, ISRC and ISWC); filter to either with programmable_only / ready_to_license. → then: directory_lookup_work (deeper work detail), directory_list_people (research a named writer by name)

Input parameters:

- `identifier` (string): ISWC or ISRC — direct identifier lookup
- `key` (string): Musical key (e.g. 'C', 'F#', 'Bb')
- `key_mode` (string): Key mode
- `limit` (number): Max results (default 10, max 20)
- `max_bpm` (number): Maximum BPM
- `max_energy` (number): Maximum energy, 0 to 1 (measured loudness)
- `min_bpm` (number): Minimum BPM
- `min_energy` (number): Minimum energy, 0 to 1 — measured loudness, not a mood
- `mood` (string): Mood — one of: aggressive, ambient, calm, contemplative, dark, dramatic, dreamy, energetic, epic, ethereal, hopeful, intense, melancholic, nostalgic, passionate, playful, romantic, sad, tender, tense…
- `programmable_only` (boolean): Only programmable works — every owner confirmed a locked split, so a licence fee is paid to each without chasing sign-off. Drops people from text results.
- `q` (string): Free-text query (work title, creator name, etc.). Minimum 2 characters.
- `ready_to_license` (boolean): Only works ready to license — composition and a master confirmed by every owner, that recording has audio and an ISRC, and the work has an ISWC. Audio results are the ready recordings themselves. Dro…

### `directory_skill_list` (~79 tokens)

List directory skills

Use when the user asks: 'what skills do you have?', 'what can you do?', 'show me your methodologies', 'how do I find music here?'. Returns the list of downloadable directory skill methodologies — name, description, trigger phrases. Cheap to call. → then: directory_skill_get (load a specific skill's full methodology body)

### `directory_skill_get` (~153 tokens)

Get a directory skill

Use when the user asks: 'load a directory skill', 'use the sync brief method'. Call after directory_skill_list, to load the one skill the user's request matches (e.g. find-music-for-sync-brief). Returns the full methodology body for one directory skill — markdown with step-by-step instructions and tool chains. Call directory_skill_list first to see available skill names, then directory_skill_get to load one. Read once at the start of the workflow; do not re-fetch on every step. → then: directory_search (run the loaded methodology against the catalogue)

Input parameters:

- `name` (string, required): Kebab-case skill name from directory_skill_list (e.g. 'find-music-for-sync-brief').

### `directory_release_notes` (~238 tokens)

Release notes

Use when the user asks: 'what's new in the directory mcp', 'what changed in the directory', 'directory release notes', 'what version is the directory on'. Returns recent releases of the PICA directory MCP server — what shipped in the public catalogue surface itself. NOT for catalogue content searches (use directory_search / directory_list_works / directory_chain for those). Returns { package, current_version, releases: [{ version, date, sections, markdown }], resource_uri }. Defaults to the last 3 releases; use `since_version` to bound the output or `sections` to filter to Added/Fixed/etc. → then: directory_search (explore anything a release note mentions)

Input parameters:

- `limit` (number): Maximum number of releases to return. Default 3, max 20.
- `sections` (array): Filter each release's sections to only these names (e.g. ['Added', 'Fixed']). Sections not in the list are omitted from output.
- `since_version` (string): If set, returns only releases strictly greater than this version (semver-compared). Versions equal to since_version are excluded.

### `directory_send_licensing_enquiry` (~640 tokens)

Send a licensing enquiry

Use when the user asks: 'ask the owner if I can license this', 'send a licensing enquiry for X', 'contact the rights holder about using this song'. Side effect: this SENDS AN EMAIL. It records a licensing enquiry for a work listed in the public directory and emails it to the work's owner, who can reply to the user by email (the user's address is shared with them); a confirmation email to the user is usually sent but not guaranteed. Nothing is agreed or priced: it only opens the conversation. This is the ONLY way to reach a listed work's owner: PICA never shares the owner's email address, so never draft the enquiry as an email for the user to send, and never guess an address. Sending through this tool is also what records the enquiry for the owner. ONLY call after the user has explicitly asked to send it and has given their own name, email and a description of the project. Never invent these, and never send on their behalf without asking. Get work_id from directory_lookup_work, directory_list_works or directory_chain. A 403 means the owner is not taking enquiries; a 404 means the work is not publicly listed; an unknown outcome means it may already have been sent, so never resend without asking. MORE WORKS FROM THE SAME OWNER: before sending, you may call directory_similar_from_owner and offer the user the owner's similar works. Put a work in also_work_ids ONLY if the user explicitly said yes to adding that work; never add works on your own judgement. All works go to the one owner in one enquiry (at most 10 in all); a work from another owner is refused. NOT FOR: looking up who owns a work (use directory_lookup_work). → first: directory_similar_from_owner (optional, to offer more of the owner's works) → then: directory_lookup_work (the work page and credits, to share with the user)

Input parameters:

- `also_work_ids` (array): More works from the SAME owner to include, from directory_similar_from_owner, and only the ones the user explicitly agreed to add. Omit otherwise.
- `budget_amount` (number): Proposed fee, only if the user named one (optional).
- `budget_currency` (string): Three-letter currency code (default GBP).
- `budget_notes` (string): Anything the user said about budget that isn't a single amount, e.g. a range.
- `company_name` (string): The user's company or production (optional).
- `contact_email` (string, required): The user's own email address. The owner will reply to it.
- `contact_name` (string, required): The user's own name, as they gave it.
- `project_description` (string, required): How the music would be used, in the user's words.
- `project_type` (string, required): The kind of project.
- `term` (string): For how long (optional; omit if the user didn't say).
- `territory` (string): Where it would be used (optional; omit if the user didn't say).
- `work_id` (string, required): The work's UUID from the directory.

### `directory_similar_from_owner` (~185 tokens)

More works from the same owner

Use when the user asks: 'does this owner have anything similar?', 'any other songs like this from them?'. Typically while they are asking about licensing one song. Returns up to 9 of the SAME owner's other listed works that share this work's topics, genre or tempo, each with the reasons, and how many listed works the owner has in all. Never another owner's works. Nothing is sent: offer them to the user, and add any to directory_send_licensing_enquiry's also_work_ids only if the user explicitly says yes. Empty when the work is not listed or the owner is not taking enquiries. → then: directory_send_licensing_enquiry (with the user's go)

Input parameters:

- `limit` (number): How many to suggest (default 9).
- `work_id` (string, required): The work the user is asking about (UUID).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/withpica-pica-directory/directory#diagnostics

## Score history

- 2026-11-05: 68
- 2026-11-04: 67

## Common questions

### What is the withPICA Directory MCP server?

withPICA Directory is an MCP server listed in the public MCP registry as io.github.withpica/pica-directory. Public music-rights directory: who wrote and owns a song, its ISWC/ISRC/IPI, and licensing asks. This page covers its hosted endpoint (https://directory.withpica.com/mcp).

### Is the withPICA Directory MCP server safe to use?

withPICA Directory scores 68 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the withPICA Directory MCP server expose?

withPICA Directory exposes 13 tools: directory_list_works, directory_lookup_work, directory_lookup_isrc, directory_list_people, directory_lookup_person, and 8 more. Their descriptions and schemas cost roughly 4,169 tokens of context every time the server is loaded.

### Does the withPICA Directory MCP server require authentication?

No. We connected to withPICA Directory without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the withPICA Directory MCP server still maintained?

withPICA Directory is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://directory.withpica.com/mcp
- Website: https://withpica.com/docs/directory
- Changelog RSS feed: https://verifymcp.io/servers/withpica-pica-directory/directory.xml
- Changelog JSON feed: https://verifymcp.io/servers/withpica-pica-directory/directory.json
- HTML version of this page: https://verifymcp.io/servers/withpica-pica-directory/directory