MCP server for text-to-speech and audio playback using Deepgram API
Both tools have minimal descriptions (under 50 chars) and lack parameter descriptions entirely. text_to_speech has no input schema visible in the decorator, only inferred from function signature. play_audio similarly lacks explicit schema. No output schemas documented. Error handling is minimal (only file-not-found check in play_audio). No security considerations for API key injection or command injection in play_audio. Naming is acceptable (verb_noun pattern), but overall quality is well below production baseline.
Play the audio file using afplay
Convert text to speech using Deepgram API
No input schemas visible in tool definitions. Both tools use function signatures only; FastMCP may infer schemas, but explicit JSON Schema with type and description for each parameter is not visible in source code.
Parameter descriptions missing entirely. 'text' and 'path' parameters have no descriptions explaining format, constraints, or expected values. LLMs cannot infer parameter meaning from names alone.
Tool descriptions are too short (15-20 chars). 'Convert text to speech using Deepgram API' and 'Play the audio file using afplay' lack context on WHEN to use, prerequisites, or return value structure. Baseline is 194 chars.
Command injection vulnerability in play_audio. os.system(f'afplay {path}') passes user input directly to shell without sanitization. Malicious path like 'file.mp3; rm -rf /' would execute arbitrary commands.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 29 | 2026-07-28+ | v2 |
No output schema documented. text_to_speech returns TextContent with a success message, but LLMs cannot plan downstream calls without knowing the response structure (e.g., does it return the file path, duration, or just a status string?).