JamRelay (makkiattooo/JamRelay) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 95 tools. No publisher has claimed this listing.

Emerging

74/100

JamRelay

Item: JamRelay
Rating: 74
Author: M8ven

Self-hosted MCP server for Spotify automation, playback, playlists, library management and rate-limit-aware workflows.

→ makkiattooo/JamRelay · listed on github_repo_search

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

makkiattooo

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: ALTERNATE_TRACK_RESOLVER_TOKEN, TOKEN_ENCRYPTION_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes104 tools · 5 behind config

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_connections

List compact provider connection summaries without credentials.

plan_playlist_transfer

Create an explainable cross-provider transfer plan. Dry-run only; performs zero destination writes.

execute_playlist_transfer

Execute a previously validated transfer plan against the explicitly selected destination. Requires confirmation and verifies the resulting playlist.

sync_playlist_transfer

Apply an explicitly confirmed provider-neutral sync policy. Destructive cross-provider conflicts fail closed.

preview_playlist_import

Parse and validate provider-neutral playlist data. This operation never writes to a provider.

import_playlist

Parse and validate provider-neutral playlist data. This operation never writes to a provider.

export_playlist

Export provider-neutral canonical playlist data without credentials or provider calls.

get_capabilities

Describe supported provider operations and explain unavailable capabilities.

search_tracks

Search the selected provider catalog with current pagination.

search_artists

Search the selected provider catalog with current pagination.

search_albums

Search the selected provider catalog with current pagination.

get_track

get_artist

get_artist_top_tracks

Spotify removed the official endpoint in February 2026; this tool returns a structured platform limitation.

get_my_playlists

List compact playlists; all=true fetches all pages up to the server safety cap.

get_playlist

Get playlist metadata.

get_playlist_tracks

Read normalized playlist items using current /items; maximum page size is 50.

create_playlist

Create a playlist; collaborative playlists must be private.

add_tracks_to_playlist

Add tracks sequentially in chunks of at most 100 using /items.

remove_tracks_from_playlist

Remove requested URI occurrences using DELETE /items and return the final snapshot.

reorder_playlist_tracks

Reorder with current PUT /items payload.

replace_playlist_tracks

Replace then append ordered chunks, max 100 per request; rolls back after later chunk failure.

update_playlist_details

Update playlist metadata; collaborative playlists must be private.

get_top_tracks

Read personalized top Spotify items; Spotify maximum is 50.

get_top_artists

Read personalized top Spotify items; Spotify maximum is 50.

get_currently_playing

Get the currently playing track or episode; 204 is returned as inactive playback.

get_playback_state

Get playback state and normalize either a track or episode item.

get_devices

List Spotify Connect devices.

get_recently_played

Read recent history; before and after cannot be combined.

get_saved_tracks

Read saved tracks with pagination.

pause

Pause Spotify playback; verifies the resulting state after a 403 restriction response.

next_track

Control Spotify playback.

previous_track

Control Spotify playback.

play

Start or resume playback; context_uri and uris are mutually exclusive. Verifies the resulting state after a 403 restriction response.

seek

Seek to a non-negative position.

set_volume

Set volume from 0 to 100.

transfer_playback

Transfer playback to a Spotify Connect device.

playlist_health_report

Read-only deterministic playlist health analysis; never mutates a provider.

snapshot_playlist

Persist an ordered playlist snapshot; requires the state database.

semantic_deduplicate_playlist

Conservative deterministic deduplication. dry_run defaults true; execution snapshots and verifies.

smart_shuffle_playlist

Deterministic seeded spacing layout; dry_run defaults true.

balance_artists

Reorder without removing tracks; dry_run defaults true.

restore_playlist_snapshot

Restore exact ordered content from a durable snapshot; creates a PRE-RESTORE safety snapshot.

undo_last_playlist_change

Restore the latest completed JamRelay-managed reversible operation only; dry_run defaults true.

playlist_diff

Read-only linear diff between a playlist and a durable snapshot.

dry_run_playlist_operation

Read-only planner for supported smart playlist operations; performs zero Spotify writes.

verify_playlist_integrity

Read-only verification of playlist readability, count, content and optional snapshot state.

limit_artist_share

Plan or execute deterministic artist-share removals; dry_run defaults true.

smart_insert_tracks

Insert tracks at deterministic distributed positions; dry_run defaults true.

optimize_playlist

Meta-tool composing deterministic playlist primitives; dry_run defaults true and does not snapshot.

save_tracks

Save or remove tracks using current /me/library endpoint in chunks of 40.

remove_saved_tracks

Save or remove tracks using current /me/library endpoint in chunks of 40.

check_saved_tracks

Return an exact input-to-saved mapping using current /me/library/contains.

find_track_exact

Resolve a track by deterministic title/artist/album/year scoring; returns matched, ambiguous, or unmatched.

remember_track

Verify a known Spotify track ID, URI, or public URL and save its safe alias.

find_playlist_by_name

Find all current-user playlists matching a normalized name across all pages.

add_tracks_by_search

Resolve every search entry before writing; strict mode blocks all writes if any is ambiguous or unmatched.

bulk_add_tracks

Add mixed ID/URI/search track inputs in ordered chunks; supports strict, dry_run and skip_existing.

get_playlist_stats

Fetches all playlist items and computes local aggregates.

deduplicate_playlist

Fetches all items, preserves first occurrence and order, and refuses lossless reconstruction when unsupported items exist.

create_playlist_from_tracks

Resolves all tracks before creation in strict mode, then creates and inserts sequential chunks.

chapterize_playlist

Analyze the existing playlist order into deterministic narrative chapters. Read-only for Spotify.

get_playlist_chapters

Read the latest saved chapter set and report whether the playlist order has changed.

play_playlist_chapter

Start Spotify playback at a chapter offset; playback may continue after the chapter ends.

resume_playlist_chapter

Resume a previously started chapter from its first saved position.

playlist_rules_engine

Read-only deterministic rule evaluation; never mutates Spotify.

playlist_recipe

Create, read, list, update or delete a persistent versioned playlist recipe.

apply_playlist_recipe

Apply a persistent recipe; dry_run defaults true, execution creates one safety snapshot.

playlist_trim_to_duration

Plan or trim a playlist without exceeding the target; dry_run defaults true.

filter_playlist

Filter by typed deterministic predicates; dry_run defaults true.

clone_playlist

Clone ordered playlist content; dry_run defaults true and never creates a playlist.

estimate_operation_cost

Read-only conservative Spotify API request estimate; no financial pricing.

merge_playlists_smart

Merge source playlists without mutating them; dry_run defaults true.

split_playlist_balanced

Split a playlist into deterministic groups; dry_run defaults true.

sync_playlists

Plan or apply deterministic playlist synchronization; dry_run defaults true.

extend_playlist_to_duration

Resolve a local candidate pool, append only needed tracks, snapshot and verify.

replace_percentage

freshen_playlist

bulk_edit_playlists

batch_playlist_jobs

session_history

Read locally observed playback history with provenance; does not claim complete Spotify history.

rank_playlist_tracks

Read-only explainable local affinity/freshness ranking; no Spotify popularity fallback.

sort_by_personal_affinity

Plan or reorder using local evidence only; dry_run defaults true and snapshots on execution.

personalize_playlist

Deterministic local personalization combining affinity and artist spacing; dry_run defaults true.

avoid_recently_played

Uses only locally observed history; dry_run defaults true.

compare_playlists

Read-only efficient URI, artist, album and duration comparison.

build_session_queue

Read-only deterministic queue plan from a playlist; never writes Spotify queue.

smart_next

Selects from a supplied playlist using local evidence; does not start playback.

archive_playlist

Persist an immutable local snapshot/version; no provider mutation.

generate_daily_mix

generate_weekly_rotation

rotation_manager

liked_to_playlist_sync

inbox_playlist

playlist_skip_cleanup

create_bulk_jobbehind config

Persist a bulk track operation for later processing.

get_job_statusbehind config

Inspect a durable bulk job with bounded item pagination.

list_jobsbehind config

List bounded durable job summaries.

resume_jobbehind config

Make a durable job eligible for processing.

commit_jobbehind config

Commit a ready durable job with ordered, chunked Spotify writes.

4 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

lowvitest@3.2.7GHSA-82fw-gwwq-j7x9

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configALTERNATE_TRACK_RESOLVER_MAX_RESULTS

configALTERNATE_TRACK_RESOLVER_NAME

configALTERNATE_TRACK_RESOLVER_TIMEOUT_MS

🔐 secretALTERNATE_TRACK_RESOLVER_TOKEN

configALTERNATE_TRACK_RESOLVER_URL

configJAMRELAY_DATA_DIR

configJAMRELAY_DB_PATH

configMCP_OAUTH_CLIENTS_PATH

configMCP_OAUTH_STORE_PATH

configPLAYLIST_READ_CONCURRENCY

configPROVIDER_CREDENTIAL_STORE_PATH

configSPOTIFY_READ_CONCURRENCY

🔐 secretTOKEN_ENCRYPTION_KEY

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

104/104 tools missing one or more hints — get_connections (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); plan_playlist_transfer (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); execute_playlist_transfer (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +101 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

44/104 tools referenced in tests (42%)

Write tests that reference each tool by name so every tool has at least one test.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/makkiattooo/jamrelay)](https://m8ven.ai/mcp/makkiattooo/jamrelay)

Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.

commit: 8df4016a58efd09532e07d69dd338eee2e03b1d1

code hash: c33c8dbea2be8b0712b7741685d7e643713b60fc92881bf88cf2f257b435383a

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client