mr-magic-mcp-server (mrnajiboy/mr-magic-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 11 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Emerging
74/100

mr-magic-mcp-server

Lyrics MCP server connecting LRCLIB, Genius, Musixmatch, and Melon

→ mrnajiboy/mr-magic-mcp-server· npm: mr-magic-mcp-server· listed on npm

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

mrnajiboy

Source: npm · also listed on Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

npmscored separatelyGlamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
3 flows detected: GENIUS_CLIENT_SECRET, AIRTABLE_PERSONAL_ACCESS_TOKEN, UPSTASH_REDIS_REST_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 5 credentials: AIRTABLE_PERSONAL_ACCESS_TOKEN, CF_API_TOKEN, GENIUS_TOKEN_KV_KEY, MUSIXMATCH_TOKEN_KV_KEY, UPSTASH_REDIS_REST_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretAIRTABLE_PERSONAL_ACCESS_TOKENRequired for push_catalog_to_airtable. Generate at [airtable.com/create/tokens](https://airtable.com/create/tokens) with data.records:write scope.
configCF_ACCOUNT_IDCloudflare account ID (Cloudflare KV backend).
🔐 secretCF_API_TOKENCloudflare API token with KV:Edit permission (Cloudflare KV backend).
configCF_KV_NAMESPACE_IDCloudflare KV namespace ID (Cloudflare KV backend).
configGENIUS_TOKEN_CACHE
🔐 secretGENIUS_TOKEN_KV_KEY
configGENIUS_TOKEN_KV_TTL_SECONDS
configHOSTthe platform-assigned PORT. No manual or PORT configuration is needed.
configLOG_LEVELdebug.
configMR_MAGIC_ALLOWED_HOSTSComma-separated extra hostnames allowed for DNS rebinding protection when binding to 0.0.0.0. RENDER_EXTERNAL_HOSTNAME is included automatically on Render. Only needed for custom domains.
configMR_MAGIC_CLI_CONFIG_PATH
configMR_MAGIC_DOWNLOAD_BASE_URLPublic base URL for download links, e.g. https://lyrics.example.com.
configMR_MAGIC_ENV_PATHunless you point to one via . Either pass credentials through the client
configMR_MAGIC_EXPORT_BACKENDredis.
configMR_MAGIC_EXPORT_DIRAbsolute path for local exports. Required when backend is local.
configMR_MAGIC_EXPORT_TTL_SECONDSTTL for local and redis backends (ignored for inline).
configMR_MAGIC_HTTP_TIMEOUT_MSGlobal outbound HTTP timeout in milliseconds.
configMR_MAGIC_INLINE_PAYLOAD_MAX_CHARSCharacter threshold at which build_catalog_payload auto-promotes to reference transport when omitInlineLyrics is true.
configMR_MAGIC_LOG_TOOL_ARGS_CHUNKSSet to 1 to emit chunk-by-chunk MCP tool argument previews for truncation debugging.
configMR_MAGIC_MCP_HTTP_DIAGNOSTICSSet to 1 to log enriched request metadata at the Streamable HTTP & SSE transport boundary.
configMR_MAGIC_QUIET_STDIOSet to 1 to suppress non-error stdout logs (forces LOG_LEVEL=error). Recommended under stdio MCP clients.
configMR_MAGIC_ROOTOverride the project root used for .env and .cache path resolution.
configMR_MAGIC_SESSIONLESSSet to 1 to force sessionless mode on the MCP Streamable HTTP & SSE server — each request is handled by a fresh, temporary server/transport with no in-memory session state. Auto-enabled on Render (see below).
configMR_MAGIC_TOOL_ARG_CHUNK_SIZEChunk size (chars) used when chunk logging is enabled.
configMUSIXMATCH_TOKEN_CACHEPath to the on-disk cache file. Default: .cache/musixmatch-token.json.
🔐 secretMUSIXMATCH_TOKEN_KV_KEYKV key name for the token store. Default: mr-magic:musixmatch-token.
configMUSIXMATCH_TOKEN_KV_TTL_SECONDSToken TTL in the KV store (seconds). Default: 2592000 (30 days).
configRENDER"true"
🔐 secretUPSTASH_REDIS_REST_TOKENyour Upstash token
configUPSTASH_REDIS_REST_URLyour Upstash endpoint
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

11/11 tools missing one or more hints — find_lyrics (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); build_catalog_payload (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); find_synced_lyrics (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +8 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/mrnajiboy/mr-magic-mcp-server)](https://m8ven.ai/mcp/mrnajiboy/mr-magic-mcp-server)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 538811d8d2bfa2de9e29667c554fe6debcc0495d
code hash: 58710ad13391faffc2f056ee7b2574f1a3285a9d3bcfc743746d41c99709026f
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client