sonos-ts-mcp (Tommertom/sonos-ts-mcp) is an MCP server listed on the M8ven Trust Index. It scores 50 out of 100, grade D. It declares 119 tools. No publisher has claimed this listing.
Enables AI assistants to control Sonos audio devices over a local network using UPnP/SOAP protocols, supporting playback, volume, queue management, zone grouping, and music library browsing.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Tommertom
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
sonos_discoverActively scan the network for Sonos devices using SSDP. Always call this when the sonos_list_devices tool returns empty or you are missing a device. Returns device UUID, IP address, room name, model, and firmware version. Use room name to communicate with the user.
sonos_add_deviceManually add a Sonos device by IP address. Use when SSDP discovery fails due to network restrictions or firewall rules. Device must be network-accessible on port 1400.
sonos_list_devicesList devices currently in the registry. Note: Call sonos_discover first to populate the registry if a device is not found in the current registry. Returns UUID, IP address, room name, model, and software version of registered devices. Use room name to communicate with the user.
sonos_playStart or resume playback on a Sonos device. Continues from current queue position and respects volume settings. If device is in a group, affects entire group.
sonos_pausePause playback on a Sonos device. Maintains current position in track and queue for quick resume. If device is in a group, affects entire group.
sonos_stopStop playback on a Sonos device. Clears playback state, unlike pause which maintains position.
sonos_nextSkip to next track in the queue.
sonos_previousSkip to previous track or restart current track if played more than a few seconds.
sonos_get_transport_infoGet current transport state (playing, paused, stopped) and playback speed.
sonos_get_position_infoGet current track information, position, and duration. Includes track metadata like title, artist, album.
sonos_get_queueRetrieve the current playback queue with track information. Supports pagination for large queues.
sonos_add_to_queueAdd a track URI to the playback queue. Supports music library URIs and streaming service URIs. Optional metadata in DIDL-Lite XML format.
sonos_remove_from_queueRemove a track from the queue at the specified position.
sonos_clear_queueRemove all tracks from the queue. Does not stop current playback.
sonos_play_from_queueStart playing from the queue at a specific position.
sonos_save_queueSave the current queue as a Sonos playlist with the specified title.
sonos_set_shuffleEnable or disable shuffle mode for queue playback.
sonos_set_repeatSet repeat mode for queue playback. Options: off (no repeat), all (repeat entire queue), one (repeat current track).
sonos_set_crossfadeEnable or disable crossfade between tracks. Crossfade creates smooth transitions between songs.
sonos_get_playback_stateGet current playback settings including shuffle, repeat, crossfade, transport state, and speed.
sonos_set_volumeSet volume level on a Sonos device. Range: 0 (silent) to 100 (maximum). Affects entire group if device is grouped.
sonos_get_volumeGet current volume level from a Sonos device.
sonos_set_muteMute or unmute a Sonos device. Mute preserves volume level for quick unmute.
sonos_set_bassSet bass EQ level. Range: -10 (reduced bass) to +10 (enhanced bass).
sonos_set_trebleSet treble EQ level. Range: -10 (reduced treble) to +10 (enhanced treble).
sonos_set_loudnessEnable or disable loudness compensation. Loudness boosts bass and treble at low volumes for better sound quality.
sonos_get_eqGet current EQ settings including bass, treble, and loudness.
sonos_set_night_modeSet night mode for home theater devices. Reduces loud sounds and enhances quiet sounds for late-night viewing.
sonos_set_dialog_modeSet dialog enhancement for home theater devices. Enhances speech clarity in movies and TV shows.
sonos_get_zone_groupsGet zone group topology showing which devices are grouped together and their coordinator.
sonos_join_groupJoin a device to another device's group for synchronized multi-room playback. The device will follow the master's playback.
sonos_unjoinRemove a device from its current group, making it a standalone player.
sonos_party_modeJoin all discovered devices to the specified device to create a whole-house audio experience.
sonos_browse_artistsBrowse artists in the music library. Supports pagination for large collections.
sonos_browse_albumsBrowse albums in the music library. Supports pagination for large collections.
sonos_browse_tracksBrowse all tracks in the music library. Supports pagination for large collections.
sonos_browse_genresBrowse music genres in the library. Supports pagination for large collections.
sonos_browse_playlistsBrowse Sonos playlists. Supports pagination for large collections.
sonos_get_favorite_radio_stationsGet favorite radio stations from Sonos favorites. Returns a list of saved radio stations with their metadata and streaming URIs.
sonos_search_librarySearch the music library by artist, album, track, or genre. Returns matching items.
sonos_browse_itemBrowse a specific library item to get its children. For example, get albums for an artist or tracks for an album.
sonos_list_alarmsList all configured alarms including their schedule, enabled status, and room assignments.
sonos_create_alarmCreate a new alarm with specified time, days, music source, and settings. Returns the alarm ID.
sonos_update_alarmUpdate an existing alarm. Only specified fields will be changed.
sonos_delete_alarmDelete an existing alarm permanently.
sonos_set_sleep_timerSet a sleep timer to automatically stop playback after the specified duration. Format: HH:MM:SS (e.g., "00:30:00" for 30 minutes).
sonos_get_sleep_timerGet remaining sleep timer duration. Returns empty if no timer is active.
sonos_cancel_sleep_timerCancel the active sleep timer.
sonos_snapshotTake a snapshot of current device state including playback, volume, and EQ settings. Returns snapshot data for later restoration.
sonos_restore_snapshotRestore a previously saved snapshot to return device to its captured state. Optionally fade in volume.
sonos_subscribe_eventsSubscribe to real-time events from a Sonos device service to receive automatic notifications of state changes.
sonos_unsubscribe_eventsUnsubscribe from a specific event subscription to stop receiving notifications.
sonos_unsubscribe_allUnsubscribe from all active event subscriptions for a specific device.
sonos_list_subscriptionsList all active event subscriptions for a device including subscription IDs and services.
sonos_list_music_servicesList all available music services (Sonos Radio, TuneIn, Spotify, etc.) registered with the Sonos system. Returns service details including name, ID, and authentication type. IMPORTANT: Most services require authentication (authType: DeviceLink or AppLink) and will not work unless the user has linked…
sonos_browse_music_serviceBrowse content from a music service. WARNING: Most services (especially Sonos Radio, Spotify, Apple Music) require authentication and will return empty results or errors if not authenticated. Check authType from sonos_list_music_services first. Only "Anonymous" services (like SomaFM Radio) are guara…
sonos_search_music_serviceSearch for content within a music service. WARNING: Requires authentication for most services. Will return errors if the service requires DeviceLink or AppLink authentication and the user has not linked their account in the Sonos app. Prefer sonos_get_favorite_radio_stations for radio content.
sonos_play_music_service_itemPlay a specific item from a music service such as a radio station, track, album, or playlist. Use the item ID from browse or search results.
sonos_get_music_service_item_uriGet the playable streaming URI for a specific music service item. This is useful for debugging or inspecting the actual stream URL.
sonos_agentAn AI-powered assistant that can take natural language instructions and autonomously control the Sonos system. Use this when you need to solve complex multi-step tasks or when you're unsure which specific tools to use. The agent can discover devices, control playback, manage groups, browse music, an…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files
GOOGLE_GENERATIVE_AI_API_KEYFor Gemini modelsOPENAI_API_KEYFor OpenAI models (gpt-4o, gpt-4o-mini, etc.)SONOS_AGENT_MODELSet a default model (optional)SONOS_LISTENER_IPSONOS_LISTENER_PORTTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
119/119 tools missing one or more hints — sonos_discover (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); sonos_add_device (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); sonos_list_devices (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +116 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
Only 0/119 tools referenced in tests (0%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
1 child_process/subprocess call in production code — runs shell commands (src/cli/sonos-agent-cli.ts:86)
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Secrets not logged
2 secret values sent to console.log
Redact or omit secret values from log output.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.20.0 (high), @modelcontextprotocol/sdk@1.20.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Dependency freshness
1/8 production deps stale: xml2js@2024-05-31 (2.2y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/tommertom/sonos-ts-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check