ableton-copilot-mcp (xiaolaa2/ableton-copilot-mcp) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 40 tools. No publisher has claimed this listing.
An MCP server built on ableton-js that enables AI assistants to control Ableton Live in real-time, providing capabilities for song management, track control, MIDI editing, and audio recording through a standardized protocol interface.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
xiaolaa2
Source: mcp.so · also listed on github_topic
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
get_application_infoGet Ableton Live application information. To get specific properties, set the corresponding property name to true in the properties parameter. If no properties are specified, returns all available information.
list_resourcesList Ableton live Browser resources of specified type
load_deviceLoad a resource which is loadable (audio effect/instrument/plugin/drums/midi effect/sounds) into a track. If track_id is not provided, will load to currently selected track. If no track is selected, instruments will be loaded to the last MIDI track, and audio effects will be…
get_clip_propertiesGet clip properties by clip id. To get specific properties, set the corresponding property name to true in the properties parameter.
get_clip_notesGet clip notes by clip id. Returns NoteExtended array for Live 11+ and Note array for Live 10 and below. Field abbreviations in returned data: - id: note_id - p: pitch (MIDI note 0-127, 60=C3) - t: start_time (beats) - d: duration (beats) - v: velocity (0-127) - m: mute (boolean) - pr: probability …
remove_clip_notesRemove clip notes by clip id
remove_notes_by_idsRemove notes by clip id and note ids
add_notes_to_clipAdd notes to clip by clip id
modify_clip_notesModify clip notes by clip id
replace_clip_notesReplace all notes in the clip with new notes
write_notes_to_clipsBatch-write notes to multiple clips in one call instead of one add_notes_to_clip/replace_clip_notes round-trip per clip. mode: 'add' (default) mirrors add_notes_to_clip; mode: 'replace' mirrors replace_clip_notes. Each entry is isolated - one bad clip_id or write failure doesn't fail the rest of the…
read_notes_from_clipsBatch-read all notes from multiple clips in one call instead of looping get_clip_notes. Always reads the whole clip (no from_pitch/from_time/time_span/pitch_span filtering). Each entry is isolated - one bad clip_id doesn't fail the rest of the batch.
set_clips_propertybatch set clip property
crop_clipCrops the clip. The region that is cropped depends on whether the clip is looped or not. If looped, the region outside of the loop is removed. If not looped, the region outside the start and end markers is removed.
duplicate_clip_loopMakes the loop twice as long and duplicates notes and envelopes. Duplicates the clip start/end range if the clip is not looped.
duplicate_clip_regionDuplicates the notes in the specified region to the destination_time. Only notes of the specified pitch are duplicated if pitch is not -1. If the transposition_amount is not 0, the notes in the region will be transposed by the transposition_amount of semitones. …
get_device_propertiesget device properties. To get specific properties, set the corresponding property name to true in the properties parameter
modify_device_parameter_valueset device parameter value, only support built-in Live devices
get_operation_historiesget mcp tools operation histories by page
get_snapshot_by_history_idget snapshot by history id
rollback_by_history_idrollback to the state before the operation corresponding to the history_id was executed, currently supports Note operations
get_song_propertiesget song properties. To get specific properties, set the corresponding property name to true in the properties parameter.
get_song_view_propertiesget song view properties. To get specific properties, set the corresponding property name to true in the properties parameter.
set_song_propertyset song basic properties
set_song_view_propertyset song view properties
create_trackcreate track and return raw track
delete_trackdelete track by index
duplicate_trackduplicate midi or audio track by index
record_by_time_rangeOpens Ableton's audio record button and starts playback from start_time to end_time. Before recording, please: ENSURE: 1. Set the recording track to record mode 2. Set the recording track's input routing to Resample or a specific audio track/input ro…
get_track_propertiesget track properties. To get specific properties, set the corresponding property name to true in the properties parameter
create_midi_clipCreates an empty MIDI clip on the track and returns the created clip information
set_tracks_propertybatch set tracks property
duplicate_clip_to_trackduplicate clip to track and return the duplicated clip information
delete_clipdelete clip by id
delete_devicedelete device by index, start from 0
get_track_overviewOne-call summary of what's actually on one or more tracks: name, type (midi/audio), mute/solo, loaded device names, and every arrangement clip's id/name/start_time/end_time/length/note_count - sorted by start time. Omit track_ids for every track in the song. Use this first when picking up a session,…
create_clips_batchBatch version of create_midi_clip - creates multiple empty MIDI clips across one or more tracks in one call. Each entry is isolated - one failure doesn't fail the rest of the batch.
get_track_sendsGet a track's send levels to each return track. Returns one entry per return track (index 0 = Return A, 1 = Return B, ...), with the send's device parameter properties (including 'value', the raw 0-1 float - see set_track_send's description for how that maps to dB).
set_track_sendSet a track's send level to a return track. 'value' is the raw 0-1 float the underlying device parameter uses, not a dB value directly - the mapping is non-linear and much steeper than it looks (roughly dB ~= 52.93 * log10(value) - 3.39), so e.g. 0.2 is already down around -40dB, not a gentle touch …
create_audio_clipCreate audio clip on track. Given an absolute path to a valid audio file in a supported format, creates an audio clip that references the file at the specified position in the arrangement view. Prints an error if: - The track is not an audio track - The track…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update
BASE_PATHYou can specify a custom data storage location using the environment variable:Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
40/40 tools missing one or more hints — get_application_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_resources (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); load_device (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +37 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
Only 1/40 tools referenced in tests (3%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 4 high severity in production deps — @modelcontextprotocol/sdk@1.10.2 (high), @modelcontextprotocol/sdk@1.10.2 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Dependency freshness
2/10 production deps stale: async-mutex@2024-03-11 (2.4y), reflect-metadata@2024-03-29 (2.4y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/xiaolaa2/ableton-copilot-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check