Lacuna Music

It requires LACUNA_API_KEY and LACUNA_BASE_URL. The API key is a sensitive credential; if exposed in client logs, config files, or repositories, it could be used to access the related service. However, the materials do not show explicit credential-stealing or abuse behavior.

Its function inherently depends on the Lacuna Music API, so user prompts/content are expected to be sent to the remote service specified by LACUNA_BASE_URL. No fixed host is listed in the materials, meaning the actual egress target is configurable; users should verify that this URL points to a trusted Lacuna service endpoint.

System checks indicate that this MCP executes code/spawns processes, which is a normal property for this type of tool. The available materials do not show requests for unusual system privileges unrelated to music generation, nor obvious signs of malicious execution.

Based on the materials, its main data handling likely involves receiving user input and interacting with the remote API; there is no README evidence of broad local file access or extra sensitive resource access. Because documentation is missing, the exact local data access boundary is not fully transparent and should be confirmed via source review or runtime permission checks.

It comes from an official registry and has an open-source repository with updates within the last year, which are positive trust signals that lower risk. While community stars are low and no license is declared, the current facts do not show concrete high-risk supply-chain red flags.