lms-mcp (shermozle/lms-mcp) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 55 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
D
Caution
58/100

lms-mcp

MCP server that provides LLM tools to interact with Lyrion Music Server (LMS), enabling player control, playback management, playlist operations, and music library search.

→ shermozle/lms-mcp· listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

shermozle

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 14 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// tools this server exposes55 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_players

Get all available players from the LMS server

get_player_status

Get the current status of a specific player

play_pause

Play or pause a player

set_volume

Set the volume of a player (0-100)

seek

Seek to a specific position in the current track

play_track

Play a specific track by ID

playlist_action

Perform playlist actions (play, pause, stop, next, previous, shuffle, repeat)

search_tracks

Search for tracks

search_artists

Search for artists

search_albums

Search for albums

get_playlists

Get all available playlists

get_genres

Get all genres available in the music database

search_tracks_by_genre

Search for tracks by genre

get_current_playlist

Get the current playlist for a player

add_to_playlist

Add a track to the current playlist

clear_playlist

Clear the current playlist

sync_players

Synchronize two players (master controls slave)

unsync_player

Remove a player from synchronization (unsync)

get_sync_status

Get synchronization status for a specific player

get_sync_groups

Get all synchronization groups

test_connection

Test connection to the LMS server

play_url

Play a direct URL or stream on a player (internet radio, podcast, etc.)

add_url_to_playlist

Add a direct URL or stream to the current playlist

get_favorites

Get all favorites (often includes radio stations and online streams)

add_favorite

Add a URL or stream to favorites

play_favorite

Play a favorite by item ID on a player

get_radios

Get radio directory categories and apps (TuneIn, etc.)

search_radio

Search TuneIn radio stations and podcasts

play_radio_item

Play a TuneIn radio search result by item ID on a player

get_apps

Get installed online music apps (TIDAL, Spotify, Qobuz, YouTube, etc.)

browse_app

Browse an online music app menu (TIDAL, Spotify, etc.)

search_app

Search within an online music app (TIDAL, Spotify, etc.)

play_app_item

Play an item from an online music app by item ID

set_power

Turn a player on, off, or toggle power

set_sleep_timer

Set a sleep timer on a player in seconds

set_bass

Set bass level on a player (-100 to 100)

set_treble

Set treble level on a player (-100 to 100)

set_balance

Set left/right balance on a player (-100 to 100)

set_loudness

Enable or disable loudness compensation on a player

set_mute

Mute or unmute a player

jump_to_playlist_index

Jump to a specific track index in the current playlist

delete_playlist_item

Delete a track from the current playlist by index

move_playlist_item

Move a track within the current playlist

save_playlist

Save the current player playlist as a named playlist

delete_saved_playlist

Delete a saved playlist

rename_saved_playlist

Rename a saved playlist

get_server_status

Get LMS server status and library statistics

rescan_library

Trigger a library rescan

set_random_play

Start or stop a random play mix

set_shuffle

Set shuffle mode on a player

set_repeat

Set repeat mode on a player

get_years

Get years available in the music library

get_decades

Get decades available in the music library

get_new_music

Get recently added albums

get_random_albums

Get a random selection of albums

// known CVEs in dependencies14 high13 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highaxios@1.6.0GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.6.0GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.6.0GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

highaxios@1.6.0GHSA-4hjh-wcwx-xvwj

Axios is vulnerable to DoS attack through lack of data size check

highaxios@1.6.0GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configLMS_HOSTIP address or hostname of your LMS server (default: localhost)
configLMS_PORTPort number of your LMS server (default: 9000)
configLMS_PROTOCOLProtocol to use (http or https, default: http)
configLMS_TIMEOUTRequest timeout in milliseconds (default: 10000)
// quality suggestions

All four hints declared on every tool

55/55 tools missing one or more hints — get_players (missing: destructiveHint, idempotentHint, openWorldHint); get_player_status (missing: destructiveHint, idempotentHint, openWorldHint); play_pause (missing: destructiveHint, idempotentHint, openWorldHint), +52 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 14 high severity in production deps — axios@1.6.0 (high), axios@1.6.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/shermozle/lms-mcp?variant=verified)](https://m8ven.ai/mcp/shermozle/lms-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 0e7e70e2f9733c5462112a9737350974f30abf9b
code hash: aeec8815e5a439cf9edb20f79e7f3f0165b6708a718fd9fb20af47d0a661da78
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client