Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
mbailey
Source: github_topic · also listed on github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
VOICEMODE_MCP_URLVOICEMODE_MCP_TOKENVOICEMODE_DEBUGVOICEMODE_TOOLS_ENABLEDVOICEMODE_TOOLS_DISABLEDVOICEMODE_TOOLSTMUXVOICEMODE_FOCUS_HOLD_SECONDSTMUX_PANEVOICEMODE_DJ_DUCK_AMOUNTVOICE_MODE_AUTO_START_KOKOROVOICEMODE_SESSION_IDCLAUDE_CODE_SESSION_IDCLAUDE_SESSION_IDVOICEMODE_BASE_DIRVOICEMODE_MLX_AUDIO_PORTVOICEMODE_MLX_AUDIO_HOSTOPENAI_API_KEYexport =your-openai-keyDISPLAYVOICEMODE_GITHUB_REMOTEVOICEMODE_VOICES_DIREDITORVISUALVOICEMODE_MODELS_DIRVOICEMODE_VAD_DEBUGVOICEMODE_SAVE_ALLVOICEMODE_SAVE_AUDIOexport =trueVOICEMODE_SAVE_TRANSCRIPTIONSVOICEMODE_AUDIO_FEEDBACKVOICEMODE_SKIP_TTSVOICEMODE_TTS_SPEEDVOICEMODE_METRICS_LEVELVOICEMODE_TIME_IN_RESPONSEVOICEMODE_PREFER_LOCALVOICEMODE_ALWAYS_TRY_LOCALVOICEMODE_AUTO_START_KOKOROVOICEMODE_CONCH_ENABLEDVOICEMODE_CONCH_TIMEOUTVOICEMODE_CONCH_CHECK_INTERVALVOICEMODE_CONCH_LOCK_EXPIRYVOICEMODE_CONCH_HOLD_EXPIRYVOICEMODE_CONCH_MODEVOICEMODE_CONCH_REMOTE_TTLVOICEMODE_CONCH_GRANT_TTLVOICEMODE_CONCH_MCP_WAIT_CAPVOICEMODE_CONTROL_SOCKETVOICEMODE_CONTROL_PAUSE_TIMEOUTVOICEMODE_HISTORY_BUFFER_SIZECARTESIA_API_KEYVOICEMODE_CARTESIA_VOICE_IDVOICEMODE_CARTESIA_MODELVOICEMODE_CARTESIA_FALLBACK_MODELVOICEMODE_STT_MODELVOICEMODE_STT_PROMPTVOICEMODE_STT_RETRY_ATTEMPTSVOICEMODE_STT_RETRY_BACKOFFVOICEMODE_STT_RETRY_BACKOFF_MAXVOICEMODE_WHISPER_MODELVOICEMODE_WHISPER_PORTVOICEMODE_WHISPER_LANGUAGEVOICEMODE_WHISPER_MODEL_PATHVOICEMODE_KOKORO_PORTVOICEMODE_KOKORO_MODELS_DIRVOICEMODE_KOKORO_CACHE_DIRVOICEMODE_KOKORO_DEFAULT_VOICEVOICEMODE_KOKORO_MAX_REQUESTSVOICEMODE_DISABLE_SILENCE_DETECTIONVOICEMODE_VAD_AGGRESSIVENESSVOICEMODE_SILENCE_THRESHOLD_MSVOICEMODE_MIN_RECORDING_DURATIONVOICEMODE_INITIAL_SILENCE_GRACE_PERIODVOICEMODE_DEFAULT_LISTEN_DURATIONVOICEMODE_REPEAT_MAX_LEADING_WORDSVOICEMODE_WAIT_MAX_LEADING_WORDSVOICEMODE_WAIT_DURATIONVOICEMODE_CHIME_LEADING_SILENCEVOICEMODE_CHIME_TRAILING_SILENCEVOICEMODE_AUDIO_FORMATVOICEMODE_TTS_AUDIO_FORMATVOICEMODE_STT_AUDIO_FORMATVOICEMODE_STT_SAVE_FORMATVOICEMODE_STT_COMPRESSVOICEMODE_OPUS_BITRATEVOICEMODE_MP3_BITRATEVOICEMODE_AAC_BITRATEVOICEMODE_STREAMING_ENABLEDVOICEMODE_STREAM_CHUNK_SIZEVOICEMODE_STREAM_BUFFER_MSVOICEMODE_STREAM_MAX_BUFFERVOICEMODE_TTS_TRAILING_SILENCEVOICEMODE_EVENT_LOG_ENABLEDVOICEMODE_EVENT_LOG_DIRVOICEMODE_EVENT_LOG_ROTATIONVOICEMODE_SERVE_HOSTVOICEMODE_SERVE_PORTVOICEMODE_SERVE_ALLOWED_IPSVOICEMODE_SERVE_TRUSTED_PROXIESVOICEMODE_SERVE_SECRETVOICEMODE_SERVE_TOKENVOICEMODE_SERVE_TRANSPORTVOICEMODE_THINKING_STYLEVOICEMODE_CREDENTIAL_STOREVOICEMODE_PRONUNCIATION_LOG_SUBSTITUTIONSVOICEMODE_PRONUNCIATION_ENABLEDVOICEMODE_REMOTE_VOICES_DIRVOICEMODE_AUTO_FOCUS_PANEVOICEMODE_SOUNDFONTS_ENABLEDNO_COLORVOICEMODE_DJ_VOLUMEVOICEMODE_MLX_AUDIO_BASE_URLVOICEMODE_EXPOSE_LOCAL_VOICES_REMOTEVOICEMODE_PROGRESS_STYLETool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
26/26 tools missing one or more hints — conch (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); update_config (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_config_keys (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +23 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Destructive tools are labelled
4 tools perform destructive updates without destructiveHint — kokoro_install deletes at line 313 (shutil.rmtree(install_dir)); kokoro_uninstall deletes at line 68 (plist_path.unlink()); whisper_install deletes at line 550 (shutil.rmtree(install_dir))
Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.
Tool inputs are validated
14/26 tool handlers declare input schemas (54%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
22/26 tool handlers wrap calls in try/catch (85%)
Wrap each tool handler body in try/catch and return a structured error response.
Tests exist
No test files found
Add tests that exercise each declared tool.
No access to sensitive paths
Reads sensitive paths: ~/.config/systemd/user
Remove reads of sensitive system paths. If you genuinely need them, document why in the README.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/mbailey/voicemode)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check