
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
@jam-jam/convert-mcp
Advanced tools
Official MCP server for Jam Jam: turn audio, PDF, photos, links and text into chord sheets (ChordPro, PDF, MIDI, MusicXML) and manage your songbook from Claude, Cursor or VS Code.
Turn audio, PDFs, photos, links and pasted text into chord sheets, and manage your Jam Jam songbook, straight from Claude, Cursor, VS Code or any MCP client.
This is the official Model Context Protocol server for the
public Jam Jam API. It gives your assistant 20 typed tools, so you ask in plain language instead of
pasting curl commands:
Listed in the official MCP Registry as org.jam-jam/convert-mcp. Every tool maps to a real route
of https://jam-jam.org/api/v1.
jj_live_...) is shown only once: copy it right away. Give the
key only the scopes you need (see Scopes).npx downloads and runs it. Node.js 18.17 or later is required.If something does not work, ask the assistant to call jj_check_usage: it reports what the key is
allowed to do and how much quota is left.
~/Music/rehearsal.mp3 into a chord sheet and save it in my Jam Jam songbook."~/Downloads/lead-sheet.pdf into my songbook."The exact formats the API serves right now, with their limits, are returned by jj_list_formats;
some outputs need an account or Premium, and that tool says which.
Every client below launches the same command, npx -y @jam-jam/convert-mcp, with your key in the
JAM_JAM_API_KEY environment variable.
claude mcp add --env JAM_JAM_API_KEY=jj_live_... --transport stdio jam-jam -- npx -y @jam-jam/convert-mcp
Add --scope user to make it available in every project. This writes the key on a command line,
so it ends up in your shell history. To avoid that, declare the server in a .mcp.json file that
reads the key from your environment, and export JAM_JAM_API_KEY yourself:
{
"mcpServers": {
"jam-jam": {
"command": "npx",
"args": ["-y", "@jam-jam/convert-mcp"],
"env": {
"JAM_JAM_API_KEY": "${JAM_JAM_API_KEY}"
}
}
}
}
Open Settings > Developer > Edit Config, which opens claude_desktop_config.json
(macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), and add:
{
"mcpServers": {
"jam-jam": {
"command": "npx",
"args": ["-y", "@jam-jam/convert-mcp"],
"env": {
"JAM_JAM_API_KEY": "jj_live_..."
}
}
}
}
Add the same mcpServers block as for Claude Desktop to .cursor/mcp.json (one project) or
~/.cursor/mcp.json (all projects). Cursor expands ${env:JAM_JAM_API_KEY} in the env values,
so you can keep the key out of the file.
Create .vscode/mcp.json (or run MCP: Add Server from the Command Palette). VS Code uses a
servers key and can prompt for the key and store it for you:
{
"inputs": [
{
"type": "promptString",
"id": "jam-jam-api-key",
"description": "Jam Jam API key (jj_live_...)",
"password": true
}
],
"servers": {
"jam-jam": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@jam-jam/convert-mcp"],
"env": {
"JAM_JAM_API_KEY": "${input:jam-jam-api-key}"
}
}
}
}
Open the MCP config file from the Cascade panel (see the
Windsurf MCP documentation) and add the same
mcpServers block as for Claude Desktop. Windsurf expands ${env:JAM_JAM_API_KEY} in the env
values.
Command npx -y @jam-jam/convert-mcp, with the environment variable JAM_JAM_API_KEY set by the
client. Never pass the key as a command-line argument (see Privacy).
For clients that connect to a URL instead of launching a command, run the server yourself in Streamable HTTP mode:
JAM_JAM_API_KEY=jj_live_... JAM_CONVERT_MCP_MODE=http npx -y @jam-jam/convert-mcp
# MCP endpoint: http://127.0.0.1:3466/mcp
# Health and per-tool counters: http://127.0.0.1:3466/healthz
The server listens on the loopback interface only by default. It holds a single API key, so
anything that can reach its port acts as the owner of that key; it is not a multi-user server.
Binding another address without JAM_CONVERT_MCP_HTTP_TOKEN makes startup fail. With the token
set, clients must send it as Authorization: Bearer <token>. DNS-rebinding protection is active:
the Host and Origin headers must match the address being served.
At startup the server asks the API what your key may do and exposes only the matching tools. A key
with carnet:read alone never shows jj_delete_song to the assistant. 20 tools exist in total.
Your songbook is called the "notebook" in the tool descriptions and carnet in the scope names.
| Tool | Required scope | What it does |
|---|---|---|
jj_list_formats | none | Lists the input and output formats served by the API, with their limits and whether an account or Premium is required. Call it before any conversion. |
jj_convert_file | convert:write | Converts a local file (path or base64). Returns text directly for small text formats, or a local file path for binary results (PDF, MIDI, MP4...). Can save the result to your songbook with deliver: "carnet". |
jj_convert_text | convert:write | Same for pasted text or ChordPro, no file needed (up to 262144 characters). |
jj_get_job | convert:read | State of a conversion job by id, for a job that outlasted the wait. |
jj_list_songs | carnet:read | Pages through the songs of your private songbook. fields=full includes the complete content; updatedSince plus the cursor gives an incremental export. |
jj_get_song | carnet:read | One complete song (chords, lyrics, structure). |
jj_list_playlists | carnet:read | Your playlists, with their ordered content. |
jj_get_playlist | carnet:read | One playlist and its songs, in order. |
jj_create_song | carnet:write | Adds a song to your songbook. The id is derived (artist-title slug unless given), so posting the same song again replaces it instead of duplicating it. Cannot publish. |
jj_update_song | carnet:write | Changes title, artist, key, capo, tempo, playlist membership, or publishes / unpublishes on your profile. ifMatch refuses the write if the song changed in the meantime. Publishing requires a rights declaration made by you. |
jj_delete_song | carnet:write | Deletes a song. Idempotent, and cannot be undone from the API. |
jj_create_playlist | carnet:write | Creates a playlist with its ordered songs. |
jj_update_playlist | carnet:write | Renames a playlist, changes its cover emoji, replaces or reorders its songs. |
jj_delete_playlist | carnet:write | Deletes the playlist only, never its songs. |
jj_get_profile | social:read | Profile card of an account by @handle, seen from your account. A private account you do not follow returns a closed card. |
jj_list_profile_songs | social:read | Songs an account has published on its profile. |
jj_list_profile_playlists | social:read | Playlists an account has published. |
jj_list_followers | social:read | Your followers (status=requested for pending requests). |
jj_list_following | social:read | Accounts you follow. |
jj_check_usage | none | Scopes of the key and its three independent quota counters. |
A key carries scopes chosen when it is created: convert:read, convert:write, carnet:read,
carnet:write, social:read. The API enforces them; this server additionally hides the tools your
key cannot use. Pick the smallest set for your use:
| Use | Scopes |
|---|---|
| Convert files | convert:read + convert:write |
| Look at the songbook and answer questions | carnet:read |
| Import songs and organise the songbook | convert:write + carnet:write (plus carnet:read to check the result) |
| See what another account published | social:read |
A key created before the songbook API existed carries only convert:read and convert:write:
create a new key rather than widening an old one. JAM_CONVERT_MCP_READ_ONLY=1 hides the write
tools even when the key allows writing.
Three independent counters, as reported by jj_check_usage. A free account is enough to start;
Premium
raises the limits.
| Counter | Free account | Premium |
|---|---|---|
| Conversions | 10 per week | 500 per calendar month |
| Reads (songbook and social listing tools) | 2000 per UTC day | 20000 per UTC day |
| Writes (songbook) | 200 per UTC day | 5000 per UTC day |
Quota errors state when the counter resets.
Uploaded files and conversion results are deleted by the API 24 hours after the job is created.
The only files this server writes to your disk are binary conversion results, in
JAM_CONVERT_MCP_WORKDIR.
| Variable | Purpose | Default |
|---|---|---|
JAM_JAM_API_KEY | Your API key (jj_live_...). Alias: JAM_MCP_API_KEY. | none |
JAM_JAM_API_BASE_URL | API base URL, no trailing slash. Alias: JAM_MCP_API_BASE. | https://jam-jam.org/api/v1 |
JAM_CONVERT_MCP_MODE | stdio or http. Alias: JAM_MCP_MODE. | stdio |
JAM_CONVERT_MCP_HOST, JAM_CONVERT_MCP_PORT | HTTP mode bind address and port (above 1024). Aliases: JAM_MCP_HOST, JAM_MCP_PORT. | 127.0.0.1, 3466 |
JAM_CONVERT_MCP_HTTP_TOKEN | HTTP mode shared secret, required as a Bearer token. Mandatory if the host is not loopback. Alias: JAM_MCP_HTTP_TOKEN. | none |
JAM_CONVERT_MCP_READ_ONLY | 1 / true / yes / on: never expose the write tools. Alias: JAM_MCP_READ_ONLY. | off |
JAM_CONVERT_MCP_SCOPES | Comma-separated scopes to use instead of asking the API at startup. Alias: JAM_MCP_SCOPES. | asked from the API |
JAM_CONVERT_MCP_WORKDIR | Directory for binary conversion results. | jam-convert-mcp in the system temp directory |
JAM_CONVERT_MCP_POLL_INTERVAL_MS | Job polling interval. | 1500 |
JAM_CONVERT_MCP_POLL_TIMEOUT_MS | Maximum wait for one job (hard cap 600000). | 120000 |
An API key is required in practice. On jam-jam.org, every route except /health,
/formats and /openapi.json is stopped by the edge protection when a request carries no
Authorization header. Without a key the server starts and warns on stderr, but only
jj_list_formats will answer.
/healthz in HTTP mode and reset on restart. Only
startup messages and fatal errors go to stderr.JAM_JAM_API_BASE_URL.User-Agent: jam-mcp/<version>, so MCP traffic can be told
apart from browsers and scripts.curl and Python examples.MIT © Jam Jam
FAQs
Official MCP server for Jam Jam: turn audio, PDF, photos, links and text into chord sheets (ChordPro, PDF, MIDI, MusicXML) and manage your songbook from Claude, Cursor or VS Code.
We found that @jam-jam/convert-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.