Skip to content

Audora

by audora.music · remote · no sign-in to list tools · v0.1.0 · published by music.audora

Fills in an artist's Audora profile, tracks, albums, credits and release drafts.

Deletes · 1Final · 3Changes · 29

51 tools: 1 can delete or cancel things, 3 do something that can't be undone, 29 change things and 18 only read.

Scanned Oct 21, 2026

5 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http audora https://audora.music/mcp

Findings

Matches of fixed checks, with the text they matched.

5 warn
  • The server marks "report_gap" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "call": a word for a change.

    What this check looks for
  • The server marks "send_feedback" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "send_feedback" says "send": a word for sending, and what is sent cannot be taken back.

    What this check looks for
  • The server marks "promo_results" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "post": a word for a change.

    What this check looks for
  • The server marks "cancel_event" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancel_event" says "cancel": a word for removing or ending something.

    What this check looks for
  • The server marks "catalog_import_status" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "catalog_import_status" says "import": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

51 tools

Deletes or cancels 1Claude Code: deny
  • cancel_eventCancel one of the artist's events.1 finding

    Why it is in this group

    • The name "cancel_event" says "cancel": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "cancel_event" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancel_event" says "cancel": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Cancel one of the artist's events. Everyone invited or coming is told. Artist connections only.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Can't be undone 3Claude Code: ask
  • answer_release_questionSend the ARTIST'S answer to a question Audora asked about their release (see get_release_questions).Can send data outNo findings

    Why it is in this group

    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe description's first verb is "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send the ARTIST'S answer to a question Audora asked about their release (see get_release_questions). Ask the artist and relay what they say. Never answer for them and never guess: an answer can be a statement about rights or ownership that Audora relies on. Audora is told it came through their assistant. The release status does not change; Audora reads the answer and moves the release on.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • finalize_uploadAudora reads the file you uploaded (the file itself, not its name) and attaches it only if it meets the upload spec.No findings

    Why it is in this group

    • The name "finalize_upload" says "finalize": a word for a change that another call does not undo.
    Description, as the server wrote it
    Audora reads the file you uploaded (the file itself, not its name) and attaches it only if it meets the upload spec. A master that is secretly an MP3, or a cover that is not square or is under 3000 pixels, is refused here and the file is removed. Passing here is not the same as being releasable: a release also needs a stereo master and a square RGB JPG cover of 3000–6000 px, which check_readiness reports on.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • send_feedbackSend Audora feedback it will read, as one of these kinds.Can send data out1 finding

    Why it is in this group

    • The name "send_feedback" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe name "send_feedback" says "send": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "send_feedback" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "send_feedback" says "send": a word for sending, and what is sent cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Send Audora feedback it will read, as one of these kinds. missing_capability: a change you would need to do what the artist wants. connector_improvement: how this connector could work better for an assistant, such as a confusing tool, a missing field or a result that did not tell you enough. product_improvement: how Audora itself could serve artists better. bug: something that looks broken. other: anything else. It goes into Audora's support inbox and shows in the artist's Settings › Support, so write it for a person: what you were trying to do, what got in the way and what would have helped. Use it when you notice something worth fixing. You do not need the artist's permission, but set artist_asked to true when the artist asked for it. For a plain "there is no tool for that", report_gap is enough.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 29Claude Code: ask
  • add_postAdd a post to a campaign on one lane and day, as Promo's + does, with its words, the angle they take and a picture or video from the Library if you have them.Can send data outNo findings

    Why it is in this group

    • The name "add_post" says "add": a word for a change.

    What it can reach

    • outboundThe name "add_post" says "add" and "post": it writes something other people read.
    Description, as the server wrote it
    Add a post to a campaign on one lane and day, as Promo's + does, with its words, the angle they take and a picture or video from the Library if you have them. It is a post on its own, not part of a moment, and a draft until it is scheduled.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • catalog_import_statusThe latest import (or the one named): how many records are in, and each record's outcome.1 finding

    Why it is in this group

    • The name "catalog_import_status" says "import": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "catalog_import_status" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "catalog_import_status" says "import": a word for a change.

      What this check looks for
    Description, as the server wrote it
    The latest import (or the one named): how many records are in, and each record's outcome.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • check_readinessFor one track or one album: everything Audora still needs before that release could be submitted, and anything worth a second look that does not block it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    For one track or one album: everything Audora still needs before that release could be submitted, and anything worth a second look that does not block it. That includes the stores' intake rules, checked against the uploaded master and cover themselves (a stereo WAV, FLAC or Apple Lossless master at a rate the stores take; square RGB JPG 3000–6000 px). Call this after writing, and again before telling the artist something is ready.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • close_todoClose one to-do the artist does not want to see, exactly as closing it in Audora does: it comes back by itself when what it is about changes.No findings

    Why it is in this group

    • The name "close_todo" says "close": a word for a change.
    Description, as the server wrote it
    Close one to-do the artist does not want to see, exactly as closing it in Audora does: it comes back by itself when what it is about changes. A track's or album's missing details are not closed: they are fixed.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • confirm_my_music"That's me": record the candidates the ARTIST said are theirs (a catalog can be split across pages).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    "That's me": record the candidates the ARTIST said are theirs (a catalog can be split across pages). Only ids find_my_music offered. Ask the artist. Never confirm on a guess.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_albumCreate an album or EP.No findings

    Why it is in this group

    • The name "create_album" says "create": a word for a change.
    Description, as the server wrote it
    Create an album or EP. Put tracks on it afterward with set_album_tracks.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_trackCreate a track from its metadata.No findings

    Why it is in this group

    • The name "create_track" says "create": a word for a change.
    Description, as the server wrote it
    Create a track from its metadata. The audio and the cover art are uploaded separately. Pass idempotency_key if you might retry, so a timeout does not leave two tracks.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • design_in_audoraAudora can design a logo, cover art, brand colors and typefaces, artist photos, and promotion posts and short videos for the artist.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Audora can design a logo, cover art, brand colors and typefaces, artist photos, and promotion posts and short videos for the artist. Those are made inside Audora, not through this connection: call this to get the exact page to send the artist to, with a sentence on what they will find there. Use it whenever the artist wants a logo, artwork, a cover, visuals, photos or promo video made.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • find_onlineRuns Audora's own lookup of what the artist has already published (streaming profiles, releases, their site and social profiles), or reads where one is and what it found.Reads text others writeNo findings

    Why it is in this group

    • The name "find_online" says "find": a word for reading.
    • The description's first verb is "run": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Runs Audora's own lookup of what the artist has already published (streaming profiles, releases, their site and social profiles), or reads where one is and what it found. Use it only when you cannot search the web yourself: otherwise look the artist up with your own search, check with them that you found the right artist, and fill their page with update_profile. With action "start" it begins one, which takes 1–2 minutes; the artist gets a few a day, shared with Soundcheck in Audora. The account's first lookup is free and each later one costs credits and needs the artist's spend permission: start with dry_run: true to read the price, tell the artist, then start with confirm_cost_credits. With action "status" (the default) it reads the newest lookup, or the one named by run_id. Every fact comes with the pages it was read on. It never changes the artist's profile: when it is done, call propose_profile so the artist keeps what is theirs in Audora.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • import_catalogStart bringing the chosen records into the catalog, within the plan's room.No findings

    Why it is in this group

    • The name "import_catalog" says "import": a word for a change.
    Description, as the server wrote it
    Start bringing the chosen records into the catalog, within the plan's room. Covers come in only when the artist said they are theirs to use (rights_confirmed: true, their own words, recorded as their consent); otherwise every record comes in with its codes and the cover is left to upload.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • keep_postBring a skipped post, or one that did not go out, back as a draft to schedule.Can send data outNo findings

    Why it is in this group

    • The name "keep_post" says "post": a word for a change.

    What it can reach

    • outboundThe name "keep_post" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Bring a skipped post, or one that did not go out, back as a draft to schedule. A draft is already kept.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • promo_resultsThe posts that went out, best first, with their latest reach, likes, comments, shares, saves and views, the totals over the window, and the followers on each connected account.Can send data out1 finding

    Why it is in this group

    • The description's first verb is "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe description's first verb is "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "promo_results" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    The posts that went out, best first, with their latest reach, likes, comments, shares, saves and views, the totals over the window, and the followers on each connected account. A missing number is not reported yet, never zero. what_works: per platform, the angles and posting hours that have beaten the artist's usual most often, from their own posts only, with how many posts each rests on.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • promo_this_weekWhat goes out in the next days across every campaign, what in that time is not scheduled yet (and so will not go out unless it is), and what did not go out lately and needs the art…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    What goes out in the next days across every campaign, what in that time is not scheduled yet (and so will not go out unless it is), and what did not go out lately and needs the artist.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • propose_profilePuts a finished find_online lookup in front of the artist in Audora and returns the link to it.No findings

    Why it is in this group

    • The description's first verb is "put": a word for a change.
    Description, as the server wrote it
    Puts a finished find_online lookup in front of the artist in Audora and returns the link to it. The artist confirms it is them and keeps what is right there. This call writes nothing to their profile, and you should not copy the findings into update_profile yourself. Their Home says their assistant found something to look at.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • report_gapCall this whenever the artist asks for something there is no tool for, or a tool refuses in a way you cannot work around.1 finding

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "report_gap" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "call": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Call this whenever the artist asks for something there is no tool for, or a tool refuses in a way you cannot work around. It files the ask in Audora's support inbox, where a person reads it, and it shows in the artist's Settings › Support. Call it before you tell the artist no. It changes nothing in their catalog, and it is the only way the ask reaches anyone.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • request_uploadAsk for a one-time address to upload a master, cover art, a logo or an artist photo to.No findings

    Why it is in this group

    • The name "request_upload" says "request": a word for a change.
    Description, as the server wrote it
    Ask for a one-time address to upload a master, cover art, a logo or an artist photo to. You need the file's NAME, nothing else. Never ask the artist how big a file is. PUT the file to the address you get back, then call finalize_upload, which reads the file itself and checks the size, the format and the account's storage against it.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • save_eventSave the artist's own show, release party or listening party, or change one (pass event_id).No findings

    Why it is in this group

    • The name "save_event" says "save": a word for a change.
    Description, as the server wrote it
    Save the artist's own show, release party or listening party, or change one (pass event_id). It is saved as a DRAFT that only the artist sees, with whatever is known (only kind is needed), unless you pass post: true. Posting puts it on Scene for artists on Audora (and on the public page when is_public) and needs a title, starts_at and a place: a city and a country, and/or an online link. Post only when the artist asked for it to go out. An event already posted stays posted, so its changes need the same. Inviting artists or Audora stays the artist's to do in Audora; an edit keeps what they chose. Artist connections only.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • save_release_draftWrite the release details for a track or album as a DRAFT.No findings

    Why it is in this group

    • The name "save_release_draft" says "save": a word for a change.
    Description, as the server wrote it
    Write the release details for a track or album as a DRAFT. A draft costs nothing, can be changed and goes nowhere until the artist says so. Returns a draft_hash identifying exactly what you prepared, and release_rules: everything the track or album still needs to meet the stores' rules (master format, cover, sub-genre, languages, countries, performer roles) before it can be submitted. An older track or album usually needs some of it. A draft saves even when it is unfinished: a release date sooner than the stores take is saved and comes back in `warnings`, and submitting refuses it until it is changed.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • set_album_tracksPut these tracks on this album, in this order.No findings

    Why it is in this group

    • The name "set_album_tracks" says "set": a word for a change.
    Description, as the server wrote it
    Put these tracks on this album, in this order. Replaces whatever was on it. A track left out is taken off the album, not deleted.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • set_first_listenSwitch a release on or off the list other artists on Audora see on release day, to give it a first listen.No findings

    Why it is in this group

    • The name "set_first_listen" says "set": a word for a change.
    Description, as the server wrote it
    Switch a release on or off the list other artists on Audora see on release day, to give it a first listen. Refused for a release out more than four weeks ago or released elsewhere.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • set_todo_doneMark one checklist item done, or not done again: the tick in Audora.No findings

    Why it is in this group

    • The name "set_todo_done" says "set": a word for a change.
    Description, as the server wrote it
    Mark one checklist item done, or not done again: the tick in Audora.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • set_track_artistsReplace the OTHER artists a track is billed to: the "Artist & Guest feat.No findings

    Why it is in this group

    • The name "set_track_artists" says "set": a word for a change.
    Description, as the server wrote it
    Replace the OTHER artists a track is billed to: the "Artist & Guest feat. Guest" line on every store. The account's own artist is always billed first and cannot be removed. Do not send it (a name equal to it is dropped, never printed twice). Send the others in billing order. `primary` and `with` join the main credit after the account's artist; `featured` and `remixer` become the "feat." part. Another `primary` artist is a collaboration: ask the artist whether they have all the rights needed for it, and send rights_confirmed: true only when they say yes. Without it the call is refused and nothing is written. `featured`, `with` and `remixer` need no confirmation. Optional: a track with none is billed to the artist profile's own name. The songwriter, performer and producer credits are a different list, set with set_track_credits.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • set_track_creditsReplace a track's song credits with this list.No findings

    Why it is in this group

    • The name "set_track_credits" says "set": a word for a change.
    Description, as the server wrote it
    Replace a track's song credits with this list. Every track needs at least one songwriter, one performer and one producer before its release can be submitted. These are real people: ask the artist, and never invent a name to satisfy the requirement.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • skip_postSkip a post so it does not go out.Can send data outNo findings

    Why it is in this group

    • The name "skip_post" says "post": a word for a change.

    What it can reach

    • outboundThe name "skip_post" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Skip a post so it does not go out. It stays on the campaign and keep_post brings it back. Skipping a post that is already scheduled takes it out of the queue and returns its posting credit, and needs the schedule permission.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • start_campaignStart a campaign for an upcoming release, or a month between releases (between_releases: true, from tomorrow; none starts by itself, so start the next month the same way when one e…No findings

    Why it is in this group

    • The name "start_campaign" says "start": a word for a change.
    Description, as the server wrote it
    Start a campaign for an upcoming release, or a month between releases (between_releases: true, from tomorrow; none starts by itself, so start the next month the same way when one ends). A release already out gets no campaign of its own: its start is made between releases with its song first (the answer says between_releases: true). Audora writes the campaign (every post's day, time, words and what picture or video it needs) at a price that grows with its size (2 a week is the least, Every day the most; the dry run's quote.plan says it), charged when it starts and returned if the plan fails; starting it needs the artist's spend permission. Nothing is made: fill each post from the artist's Library with update_post, or have Audora make one with make_posts (priced then). A campaign is planned in moments: one video or picture posted the same day on every connected account it fits, with words for each account. Each moment costs 1 credit to go out, all its accounts included, only when it is scheduled. The answers about the song (the_story, key_lyrics, key_moments, what_works, sonic_references, note) are the Start panel's: optional, filled from what Audora knows when left out, and they turn on posts that use them. A release (or the time between releases) can run several campaigns at once, each with its own language, lead market and accounts; one that would copy a live campaign in all three is refused (a dry run's quote.duplicate_of names it, quote.live_campaigns lists them). Planned posts fit around the posts other campaigns already have on the same accounts: one video and one picture a day per account. Use dry_run first to see the posts, the price and those answers (quote.answers), tell the artist, then start with confirm_cost_credits.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • update_albumAmend an album's details.No findings

    Why it is in this group

    • The name "update_album" says "update": a word for a change.
    Description, as the server wrote it
    Amend an album's details. Refused once its release has been submitted.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • update_postChange a post's words, hashtags, link, day, time, its picture or video (from the Library), or the angle its words take.Can send data outNo findings

    Why it is in this group

    • The name "update_post" says "update": a word for a change.

    What it can reach

    • outboundThe name "update_post" says "update" and "post": it writes something other people read.
    Description, as the server wrote it
    Change a post's words, hashtags, link, day, time, its picture or video (from the Library), or the angle its words take. Send only what changes. Returns the post with schedule_check: what Schedule would decide now. A post already scheduled can be changed only with the schedule permission; one already handed to its platform's own schedule (Facebook, YouTube) or one that went out cannot be changed here.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • update_profileSet artist details: name, country, genre, tone, description, main markets, Promo's post language, the three bios and links.No findings

    Why it is in this group

    • The name "update_profile" says "update": a word for a change.
    Description, as the server wrote it
    Set artist details: name, country, genre, tone, description, main markets, Promo's post language, the three bios and links. Send only the fields you are changing. Call get_requirements first for the exact limits. An over-long value is refused with the number it got.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • update_trackAmend a track's metadata.No findings

    Why it is in this group

    • The name "update_track" says "update": a word for a change.
    Description, as the server wrote it
    Amend a track's metadata. Refused once its release has been submitted: a submitted release carries a frozen copy, and changing the catalog underneath it is the artist's own decision, because it costs credits.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 18Claude Code: allow
  • find_my_musicFind which artist on Deezer (and Apple Music) is this artist, to bring their released records in: the confirmed one, or candidates to show the artist.No findings

    Why it is in this group

    • The name "find_my_music" says "find": a word for reading.
    Description, as the server wrote it
    Find which artist on Deezer (and Apple Music) is this artist, to bring their released records in: the confirmed one, or candidates to show the artist. A link to their music (Deezer, Spotify or Apple, artist or record) searches from that instead of the name.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_campaignOne campaign as Promo's calendar: every post by day and lane, with its words, hashtags, picture or video, status, and schedule_check: exactly what Audora's Schedule would decide ab…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_campaign" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "calendar": it reads calendars.
    • untrusted-inputThe description's first sentence says "post": it reads posts, which other people can write.
    Description, as the server wrote it
    One campaign as Promo's calendar: every post by day and lane, with its words, hashtags, picture or video, status, and schedule_check: exactly what Audora's Schedule would decide about it now, and in the artist's words what it still needs.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_limitsThe plan, whether distribution is included, credits remaining, and the track, album and storage allowances.No findings

    Why it is in this group

    • The name "get_limits" says "get": a word for reading.
    Description, as the server wrote it
    The plan, whether distribution is included, credits remaining, and the track, album and storage allowances. Check before uploading or preparing a submission.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_profileThe artist profile as Audora holds it.No findings

    Why it is in this group

    • The name "get_profile" says "get": a word for reading.
    Description, as the server wrote it
    The artist profile as Audora holds it.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_release_questionsQuestions Audora's reviewers asked about the artist's releases (for example, whether the rights to a remix are cleared), with the whole conversation.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_release_questions" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "conversation": it reads messages.
    • untrusted-inputThe description's first sentence says "conversation": it reads messages, which other people can write.
    Description, as the server wrote it
    Questions Audora's reviewers asked about the artist's releases (for example, whether the rights to a remix are cleared), with the whole conversation. A release with an unanswered question does not go out until the artist answers. Omit release_id for every open question.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_requirementsEvery field Audora needs, with its exact limit in characters or words, the closed list to choose from where there is one, and the accepted file formats and sizes.Reads private dataNo findings

    Why it is in this group

    • The name "get_requirements" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    Description, as the server wrote it
    Every field Audora needs, with its exact limit in characters or words, the closed list to choose from where there is one, and the accepted file formats and sizes. Call this BEFORE filling anything in. The limits differ per field: some are refused when exceeded and some only flagged. What blocks a release is set by Audora, and it changes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_statsStreams, saves and growth per track, which stores and playlists the listening comes from, TikTok use, the audience's age and gender, how the artist's promotion posts performed, and…Reads text others writeNo findings

    Why it is in this group

    • The name "get_stats" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Streams, saves and growth per track, which stores and playlists the listening comes from, TikTok use, the audience's age and gender, how the artist's promotion posts performed, and their followers. For the whole catalog, when the artist has connected their own Songstats account, it also gives their numbers across the web (listeners, followers, playlist reach, socials, Shazam, charts), the cities they are listened to in now, the playlists carrying them and dated events. The same numbers the artist sees in Audora. Use it to answer "how is my release doing", to write a pitch or bio from real numbers, or to suggest where to focus next. When a figure is missing, say "not reported yet", never zero.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_trackOne track with its billed artists and its song credits.No findings

    Why it is in this group

    • The name "get_track" says "get": a word for reading.
    Description, as the server wrote it
    One track with its billed artists and its song credits.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_albumsEvery album in this account, newest first.No findings

    Why it is in this group

    • The name "list_albums" says "list": a word for reading.
    Description, as the server wrote it
    Every album in this account, newest first.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_campaignsEvery Promo campaign in this account, with its window, whether it is ahead, running or over, and how many posts are to look at, scheduled, posted or did not go out.Reads text others writeNo findings

    Why it is in this group

    • The name "list_campaigns" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Every Promo campaign in this account, with its window, whether it is ahead, running or over, and how many posts are to look at, scheduled, posted or did not go out. A release's campaign is kind release; between releases a campaign is a month (kind between_releases), and none starts by itself: start_campaign with between_releases plans the next one. Also lists upcoming releases that have no campaign yet, and campaigns being planned right now.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_eventsThe shows, release parties and listening parties the artist has posted, with who is invited and who is coming, and their drafts (saved, not posted, seen by nobody else).No findings

    Why it is in this group

    • The name "list_events" says "list": a word for reading.
    Description, as the server wrote it
    The shows, release parties and listening parties the artist has posted, with who is invited and who is coming, and their drafts (saved, not posted, seen by nobody else). Artist connections only: Scene is between artists.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_mediaThe artist's pictures or videos in Audora's Library, newest first, searchable by name and filterable by category (Brand kit, Logo, Cover art, Promo, a platform, Generated, Uploaded…No findings

    Why it is in this group

    • The name "list_media" says "list": a word for reading.
    Description, as the server wrote it
    The artist's pictures or videos in Audora's Library, newest first, searchable by name and filterable by category (Brand kit, Logo, Cover art, Promo, a platform, Generated, Uploaded, Stock footage). Each has a media_asset_id (what update_post takes) and a preview link valid for an hour.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_release_todosWith release_id: the release's "Around the release" checklist (pitch, pre-save, Canvas, lyrics, release day and the weeks after), each with when it is due, why, where it is done an…No findings

    Why it is in this group

    • The name "list_release_todos" says "list": a word for reading.
    Description, as the server wrote it
    With release_id: the release's "Around the release" checklist (pitch, pre-save, Canvas, lyrics, release day and the weeks after), each with when it is due, why, where it is done and whether it is done. Without: the artist's "Set up once" list (Instagram ready to post, photos and clips for the posts, claiming the store profiles, the bio link).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_releasesEvery release in this account with where it has reached (status_label: Draft, Submitted, Changes asked, Going to the stores, Ready for release day, Live, Rejected, Takedown asked, …No findings

    Why it is in this group

    • The name "list_releases" says "list": a word for reading.
    Description, as the server wrote it
    Every release in this account with where it has reached (status_label: Draft, Submitted, Changes asked, Going to the stores, Ready for release day, Live, Rejected, Takedown asked, Taken down, Released elsewhere), including anything Audora asked about.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_todosEvery open to-do the artist sees on their pages, most urgent first: what it is, how urgent, where it is fixed and the tool that fixes it from here.No findings

    Why it is in this group

    • The name "list_todos" says "list": a word for reading.
    Description, as the server wrote it
    Every open to-do the artist sees on their pages, most urgent first: what it is, how urgent, where it is fixed and the tool that fixes it from here. Each has a key; closable says whether close_todo can close it.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_tracksEvery track in this account, newest first.No findings

    Why it is in this group

    • The name "list_tracks" says "list": a word for reading.
    Description, as the server wrote it
    Every track in this account, newest first.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • preview_catalog_importThe records of the confirmed artist, newest first and 50 a page, with their codes, date and type, matched against the catalog: new, already in the catalog, or in conflict with anot…No findings

    Why it is in this group

    • The name "preview_catalog_import" says "preview": a word for reading.
    Description, as the server wrote it
    The records of the confirmed artist, newest first and 50 a page, with their codes, date and type, matched against the catalog: new, already in the catalog, or in conflict with another account. total says how many there are in all. Also the plan's room for songs and albums.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whoamiReturns the account this connection acts in (an artist's, or a label's with its roster), what this connection is allowed to do, where the result is reviewed, and next_steps: what t…No findings

    Why it is in this group

    • The name "whoami" says "whoami": a word for reading.
    Description, as the server wrote it
    Returns the account this connection acts in (an artist's, or a label's with its roster), what this connection is allowed to do, where the result is reviewed, and next_steps: what to offer the artist next, worked out from the account. Call this first, and again whenever you are unsure whose catalog you are working in. On a label connection, pass `artist` to see one roster artist's account.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

105 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 3 private-data tools breaks every one.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write5
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out7
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__audora__get_campaign",
      "mcp__audora__get_release_questions",
      "mcp__audora__get_requirements"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http audora https://audora.music/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__audora__whoami",
      "mcp__audora__get_requirements",
      "mcp__audora__get_stats",
      "mcp__audora__get_limits",
      "mcp__audora__get_profile",
      "mcp__audora__list_tracks",
      "mcp__audora__get_track",
      "mcp__audora__list_albums",
      "mcp__audora__get_release_questions",
      "mcp__audora__list_releases",
      "mcp__audora__list_campaigns",
      "mcp__audora__get_campaign",
      "mcp__audora__list_todos",
      "mcp__audora__list_release_todos",
      "mcp__audora__list_media",
      "mcp__audora__list_events",
      "mcp__audora__find_my_music",
      "mcp__audora__preview_catalog_import"
    ],
    "ask": [
      "mcp__audora__design_in_audora",
      "mcp__audora__report_gap",
      "mcp__audora__send_feedback",
      "mcp__audora__check_readiness",
      "mcp__audora__find_online",
      "mcp__audora__propose_profile",
      "mcp__audora__update_profile",
      "mcp__audora__create_track",
      "mcp__audora__update_track",
      "mcp__audora__set_track_credits",
      "mcp__audora__set_track_artists",
      "mcp__audora__create_album",
      "mcp__audora__update_album",
      "mcp__audora__set_album_tracks",
      "mcp__audora__request_upload",
      "mcp__audora__finalize_upload",
      "mcp__audora__save_release_draft",
      "mcp__audora__answer_release_question",
      "mcp__audora__promo_this_week",
      "mcp__audora__promo_results",
      "mcp__audora__start_campaign",
      "mcp__audora__update_post",
      "mcp__audora__keep_post",
      "mcp__audora__skip_post",
      "mcp__audora__add_post",
      "mcp__audora__close_todo",
      "mcp__audora__set_todo_done",
      "mcp__audora__set_first_listen",
      "mcp__audora__save_event",
      "mcp__audora__confirm_my_music",
      "mcp__audora__import_catalog",
      "mcp__audora__catalog_import_status"
    ],
    "deny": [
      "mcp__audora__cancel_event"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as audora. Review it before you use it.

Capability tags behind 13 rules
  • mcp__audora__get_requirements private-data
  • mcp__audora__get_stats untrusted-input
  • mcp__audora__send_feedback outbound
  • mcp__audora__find_online untrusted-input
  • mcp__audora__get_release_questions private-data, untrusted-input
  • mcp__audora__answer_release_question outbound
  • mcp__audora__list_campaigns untrusted-input
  • mcp__audora__get_campaign private-data, untrusted-input
  • mcp__audora__promo_results outbound
  • mcp__audora__update_post outbound
  • mcp__audora__keep_post outbound
  • mcp__audora__skip_post outbound
  • mcp__audora__add_post outbound