withPICA Directory
io.github.withpica/pica-directorywithpicastreamable-httpv1.13.0Scanned
Public music-rights directory: who wrote and owns a song, its ISWC/ISRC/IPI, and licensing asks
13 tools: 1 can delete or cancel things, 3 change things and 9 only read.
- Reads private data · 9
- Reads text others write · 3
- Can send data out · 1
- No findings
Anlyon alternative
4 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
13 tools
Deletes or cancels 1Claude Code: deny
directory_send_licensing_enquiryUse when the user asks: 'ask the owner if I can license this', 'send a licensing enquiry for X', 'contact the rights holder about using this song'.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "directory_send_licensing_enquiry" says "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "directory_send_licensing_enquiry" says "send": it sends or publishes something to other people.
Description, as the server wrote it Use when the user asks: 'ask the owner if I can license this', 'send a licensing enquiry for X', 'contact the rights holder about using this song'. Side effect: this SENDS AN EMAIL. It records a licensing enquiry for a work listed in the public directory and emails it to the work's owner, who can reply to the user by email (the user's address is shared with them); a confirmation email to the user is usually sent but not guaranteed. Nothing is agreed or priced: it only opens the conversation. This is the ONLY way to reach a listed work's owner: PICA never shares the owner's email address, so never draft the enquiry as an email for the user to send, and never guess an address. Sending through this tool is also what records the enquiry for the owner. ONLY call after the user has explicitly asked to send it and has given their own name, email and a description of the project. Never invent these, and never send on their behalf without asking. Get work_id from directory_lookup_work, directory_list_works or directory_chain. A 403 means the owner is not taking enquiries; a 404 means the work is not publicly listed; an unknown outcome means it may already have been sent, so never resend without asking. MORE WORKS FROM THE SAME OWNER: before sending, you may call directory_similar_from_owner and offer the user the owner's similar works. Put a work in also_work_ids ONLY if the user explicitly said yes to adding that work; never add works on your own judgement. All works go to the one owner in one enquiry (at most 10 in all); a work from another owner is refused. NOT FOR: looking up who owns a work (use directory_lookup_work). → first: directory_similar_from_owner (optional, to offer more of the owner's works) → then: directory_lookup_work (the work page and credits, to share with the user)
Annotations the server declares
- title: Send a licensing enquiry
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
Changes things 3Claude Code: ask
directory_chainUse when the user asks: 'show me the rights chain for X', 'give me everything on this song', 'what's the full picture for X?', 'trace the chain from this writer to that work'.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Use when the user asks: 'show me the rights chain for X', 'give me everything on this song', 'what's the full picture for X?', 'trace the chain from this writer to that work'. Graph lookup — resolves a query, ISWC, or ISRC to its full rights chain in one call. Each result bundles the work, its writers and publishers (names + roles, no IPIs or splits), the linked recording (ISRC, DSP presence, duration), and audio characteristics (BPM, key, energy). Prefer over stitching list_works + lookup_work + lookup_person when you want the whole graph around a track in a single round-trip. Supports audio-only queries (min_bpm, key, mood, etc.) when you don't have a text query. Work results carry programmable_since (every owner confirmed a locked split) and ready_to_license (composition and a master confirmed, with audio, ISRC and ISWC); filter to either with programmable_only / ready_to_license. → then: directory_lookup_work (deeper work detail), directory_list_people (research a named writer by name)
Annotations the server declares
- title: Rights chain for a work
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
directory_release_notesUse when the user asks: 'what's new in the directory mcp', 'what changed in the directory', 'directory release notes', 'what version is the directory on'.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Use when the user asks: 'what's new in the directory mcp', 'what changed in the directory', 'directory release notes', 'what version is the directory on'. Returns recent releases of the PICA directory MCP server — what shipped in the public catalogue surface itself. NOT for catalogue content searches (use directory_search / directory_list_works / directory_chain for those). Returns { package, current_version, releases: [{ version, date, sections, markdown }], resource_uri }. Defaults to the last 3 releases; use `since_version` to bound the output or `sections` to filter to Added/Fixed/etc. → then: directory_search (explore anything a release note mentions)
Annotations the server declares
- title: Release notes
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
directory_similar_from_ownerUse when the user asks: 'does this owner have anything similar?', 'any other songs like this from them?'.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Use when the user asks: 'does this owner have anything similar?', 'any other songs like this from them?'. Typically while they are asking about licensing one song. Returns up to 9 of the SAME owner's other listed works that share this work's topics, genre or tempo, each with the reasons, and how many listed works the owner has in all. Never another owner's works. Nothing is sent: offer them to the user, and add any to directory_send_licensing_enquiry's also_work_ids only if the user explicitly says yes. Empty when the work is not listed or the owner is not taking enquiries. → then: directory_send_licensing_enquiry (with the user's go)
Annotations the server declares
- title: More works from the same owner
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
Only reads 9Show 9 read-only tools
directory_list_peopleUse when the user asks: 'list creators in PICA', 'people starting with B', 'browse the people directory'.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "directory_list_people" says "list": a word for reading.
What it can reach
- private-dataThe name "directory_list_people" says "list" and "directory": it reads files.
- private-dataThe description's first sentence says "directory": it reads files.
- untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
Description, as the server wrote it Use when the user asks: 'list creators in PICA', 'people starting with B', 'browse the people directory'. Browse and filter creators in the PICA public directory. Filter by free-text (q), ISNI, IPI, or starting letter (A–Z, or '#' for numeric). Returns paginated results. Each result carries global_creator_id, the ID directory_lookup_person takes. → then: directory_lookup_person (identifiers, roles, listed-work count and collaborators for one creator)
Annotations the server declares
- title: List creators
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
directory_list_worksUse when the user asks: 'list works in PICA', 'works starting with B', 'find works by publisher X', 'browse the catalog', 'a song about love', 'songs about X'.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "directory_list_works" says "list": a word for reading.
What it can reach
- private-dataThe name "directory_list_works" says "list" and "directory": it reads files.
- untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
Description, as the server wrote it Use when the user asks: 'list works in PICA', 'works starting with B', 'find works by publisher X', 'browse the catalog', 'a song about love', 'songs about X'. For a theme or subject, search its plain word in q ('love', 'home', 'summer'): titles carry the theme. Start here before any mood or sound search, which only narrows. Browse and filter musical works their owners have listed in the PICA public directory. Filter by free-text (q), ISWC, ISRC, publisher, label, or starting letter (A–Z, or '#' for numeric). Sort by title (default) or recent. Returns paginated results. Each work carries ai_origin: whether the OWNER declared it human-made, AI-assisted or AI-generated (or 'not stated' — never assume human-made), with ACRCloud's AI detection beside it. Set human_made_only to keep only works the owner declared human-made that ACRCloud does not call likely AI. → then: directory_lookup_work (full details with credits and audio)
Annotations the server declares
- title: List works
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
directory_lookup_isrcUse when the user asks: 'lookup ISRC X', 'what's the work for ISRC X?', 'find the work for this recording'.Reads private dataNo findings
Why it is in this group
- The name "directory_lookup_isrc" says "lookup": a word for reading.
What it can reach
- private-dataThe name "directory_lookup_isrc" says "lookup" and "directory": it reads files.
Description, as the server wrote it Use when the user asks: 'lookup ISRC X', 'what's the work for ISRC X?', 'find the work for this recording'. Shortcut: look up the work(s) associated with a recording identifier (ISRC). Equivalent to directory_list_works with an isrc filter, pinned for recording-first discovery. → then: directory_lookup_work (full details on the matched work)
Annotations the server declares
- title: Look up a work by ISRC
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
directory_lookup_personUse when the user asks: 'lookup IPI 12345', 'lookup ISNI X', 'find creator by MusicBrainz ID'.Reads private dataNo findings
Why it is in this group
- The name "directory_lookup_person" says "lookup": a word for reading.
What it can reach
- private-dataThe name "directory_lookup_person" says "lookup" and "directory": it reads files.
Description, as the server wrote it Use when the user asks: 'lookup IPI 12345', 'lookup ISNI X', 'find creator by MusicBrainz ID'. Also use it for the profile of a creator already found with directory_list_people or directory_search. Looks up ONE creator in the PICA public directory by an identifier: global_creator_id (UUID, from directory_list_people or directory_search), ISNI, IPI number, or MusicBrainz ID. It does not accept a name: to find a creator by name, or to choose between several people with the same name, use directory_list_people (q) or directory_search first. Returns the creator's name, identifiers (IPI, ISNI, MusicBrainz), roles, the number of their works listed in the directory, their PICA profile grade, and up to five collaborators on those listed works. It does not list the works themselves: use directory_list_works or directory_search with the creator's name for those. An unknown identifier returns not found. → then: directory_list_works (their listed works, by name)
Annotations the server declares
- title: Look up a creator
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
directory_lookup_workUse when the user asks: 'what's the ISWC for X?', 'who wrote X?', 'tell me about song X', 'is this song registered?'.Reads private dataNo findings
Why it is in this group
- The name "directory_lookup_work" says "lookup": a word for reading.
What it can reach
- private-dataThe name "directory_lookup_work" says "lookup" and "directory": it reads files.
Description, as the server wrote it Use when the user asks: 'what's the ISWC for X?', 'who wrote X?', 'tell me about song X', 'is this song registered?'. Get the details of a single listed work by ISWC or work UUID. Returns the credits, one per person with each role marked confirmed or not confirmed by that person, and the person's IPI; each writer's share of the work, only when the owner chose to show shares AND that writer confirmed it themselves (with how many writers have); the recordings' ISRCs, audio analysis (BPM, key, energy) when the audio has been analysed, streaming links (Spotify, Apple Music, YouTube), AI origin (what the owner declared, with ACRCloud's detection beside it), the work's PICA score, and whether the owner is taking licensing enquiries, as a markdown summary. Fields with no data are omitted. → then: directory_lookup_person (a credited writer, by the credit's global_creator_id or IPI), directory_search_recordings (find similar tracks by audio)
Annotations the server declares
- title: Look up a work
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
directory_searchUse when the user asks: 'find me X', 'who or what is X?', 'find any record of X', 'a song about X'.Reads private dataNo findings
Why it is in this group
- The name "directory_search" says "search": a word for reading.
What it can reach
- private-dataThe name "directory_search" says "search" and "directory": it reads files.
Description, as the server wrote it Use when the user asks: 'find me X', 'who or what is X?', 'find any record of X', 'a song about X'. Use when the entity type is not yet known. Convenience fan-out across works and creators — runs list_works and list_people with the same query and returns the union. No cross-type ranking; prefer list_works or list_people when the entity type is known. → then: directory_lookup_work (work details), directory_lookup_person (creator details, by the result's global_creator_id)
Annotations the server declares
- title: Search the directory
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
directory_search_recordingsUse when the user asks: 'find upbeat tracks around 120 BPM', 'find instrumental tracks in C minor', 'find energetic music for sync', 'tracks at X BPM in [key]'.Reads private dataNo findings
Why it is in this group
- The name "directory_search_recordings" says "search": a word for reading.
What it can reach
- private-dataThe name "directory_search_recordings" says "search" and "directory": it reads files.
Description, as the server wrote it Use when the user asks: 'find upbeat tracks around 120 BPM', 'find instrumental tracks in C minor', 'find energetic music for sync', 'tracks at X BPM in [key]'. AUDIO-FEATURE search only — for name- or title-shaped queries use directory_lookup_work, directory_lookup_isrc, or directory_list_people, NOT this tool. Not for a theme or subject ('a song about love'): search that in directory_list_works q first, then narrow here. Few recordings carry a mood yet, so an empty mood search does not mean the directory has no such song. Find tracks by BPM, key, energy, danceability, duration, mood, and more. The measured filters (BPM, key, energy, …) match analysed audio only; a mood search also returns works whose owner set the mood, marked mood_note "mood set by the owner, not analysed" — say so when you present them. Only returns recordings of works listed on the directory by their owner or a confirmed writer. → then: directory_lookup_work (credits and licensing details for a matched track)
Annotations the server declares
- title: Find recordings by sound
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
directory_skill_getUse when the user asks: 'load a directory skill', 'use the sync brief method'.Reads private dataNo findings
Why it is in this group
- The name "directory_skill_get" says "get": a word for reading.
What it can reach
- private-dataThe name "directory_skill_get" says "get" and "directory": it reads files.
- private-dataThe description's first sentence says "directory": it reads files.
Description, as the server wrote it Use when the user asks: 'load a directory skill', 'use the sync brief method'. Call after directory_skill_list, to load the one skill the user's request matches (e.g. find-music-for-sync-brief). Returns the full methodology body for one directory skill — markdown with step-by-step instructions and tool chains. Call directory_skill_list first to see available skill names, then directory_skill_get to load one. Read once at the start of the workflow; do not re-fetch on every step. → then: directory_search (run the loaded methodology against the catalogue)
Annotations the server declares
- title: Get a directory skill
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
directory_skill_listUse when the user asks: 'what skills do you have?', 'what can you do?', 'show me your methodologies', 'how do I find music here?'.Reads private dataNo findings
Why it is in this group
- The name "directory_skill_list" says "list": a word for reading.
What it can reach
- private-dataThe name "directory_skill_list" says "list" and "directory": it reads files.
Description, as the server wrote it Use when the user asks: 'what skills do you have?', 'what can you do?', 'show me your methodologies', 'how do I find music here?'. Returns the list of downloadable directory skill methodologies — name, description, trigger phrases. Cheap to call. → then: directory_skill_get (load a specific skill's full methodology body)
Annotations the server declares
- title: List directory skills
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
27 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.
- Reads private data9
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write3
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out1
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__pica-directory__directory_send_licensing_enquiry"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.13.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http pica-directory https://directory.withpica.com/mcpclaude mcp add --transport http pica-directory https://directory.withpica.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__pica-directory__directory_list_works",
"mcp__pica-directory__directory_lookup_work",
"mcp__pica-directory__directory_lookup_isrc",
"mcp__pica-directory__directory_list_people",
"mcp__pica-directory__directory_lookup_person",
"mcp__pica-directory__directory_search",
"mcp__pica-directory__directory_search_recordings",
"mcp__pica-directory__directory_skill_list",
"mcp__pica-directory__directory_skill_get"
],
"ask": [
"mcp__pica-directory__directory_chain",
"mcp__pica-directory__directory_release_notes",
"mcp__pica-directory__directory_similar_from_owner"
],
"deny": [
"mcp__pica-directory__directory_send_licensing_enquiry"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as pica-directory. Review it before you use it.
Capability tags behind 10 rules
- mcp__pica-directory__directory_list_works private-data, untrusted-input
- mcp__pica-directory__directory_lookup_work private-data
- mcp__pica-directory__directory_lookup_isrc private-data
- mcp__pica-directory__directory_list_people private-data, untrusted-input
- mcp__pica-directory__directory_lookup_person private-data
- mcp__pica-directory__directory_search private-data
- mcp__pica-directory__directory_search_recordings private-data
- mcp__pica-directory__directory_skill_list private-data
- mcp__pica-directory__directory_skill_get private-data
- mcp__pica-directory__directory_send_licensing_enquiry untrusted-input, outbound
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.github.withpica/pica-directory/verify?hash=b0e1090cbc18df716e923bd5ab1e769b92c61ddb2bde0b8659ccee10c9cc1f31" | jq -e '.changed == false'Pinned hash b0e1090cbc18, from Nov 4, 2026, 16:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.github.withpica/pica-directory/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.github.withpica/pica-directory)Source: MCP Registry. Synced Nov 4, 2026, 16:18 UTC.