
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
Model Context Protocol (MCP) server for the Lacuna Music API — generate AI music from MCP-compatible clients like Claude Desktop and Claude Code.
Model Context Protocol server for the Lacuna Music API. Lets MCP-compatible clients (Claude Desktop, Claude Code, Cursor, Zed, Continue, etc.) generate AI music as part of an agent loop.
Looking for the SDK or CLI? See
lacuna-sdkandlacuna-toolkit.
The server is published as a single npm package and runs over stdio. No install step is needed — your MCP client launches it via npx.
npx lacuna-mcp
The server reads its configuration from environment variables:
| Variable | Required | Description |
|---|---|---|
LACUNA_API_KEY | yes | API key from your profile dashboard. Begins with lyr_live_. |
LACUNA_BASE_URL | no | Override the API base URL (e.g. for staging). |
Music API access requires the Pro plan or above.
Add an entry to claude_desktop_config.json:
{
"mcpServers": {
"lacuna": {
"command": "npx",
"args": ["-y", "lacuna-mcp"],
"env": {
"LACUNA_API_KEY": "lyr_live_..."
}
}
}
}
The config file lives at:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonclaude mcp add lacuna -- npx -y lacuna-mcp
Then export the key in your shell or set it via your client's MCP settings.
Any client that speaks the Model Context Protocol over stdio can run npx -y lacuna-mcp as the command and pass LACUNA_API_KEY as an env var. Refer to your client's MCP setup docs for the exact JSON shape.
| Tool | Description |
|---|---|
generate_music | Create a music generation task. Returns a pending task immediately. |
get_generation | Retrieve the current state of a generation task by id. |
wait_for_generation | Poll a task until it reaches a terminal state (ready or failed) or the timeout elapses. |
generate_music| Parameter | Type | Description |
|---|---|---|
style | string (required) | Style description, e.g. "pop, female vocal, 120 bpm, energetic". |
title | string (required) | Track title. |
lyrics | string | Required unless instrumental is true. |
instrumental | boolean | Generate an instrumental track. Default false. |
model | "aether" | "echo" | Generation model. Defaults to aether (Lacuna Aether). |
vocal_gender | "m" | "f" | Lead vocal hint (aether only). |
negative_tags | string | Style tags to avoid (aether only). |
style_weight | number (0–1) | aether only. |
weirdness_constraint | number (0–1) | aether only. |
audio_weight | number (0–1) | aether only. |
Credits are deducted on creation and refunded automatically if the upstream provider fails.
get_generation| Parameter | Type | Description |
|---|---|---|
id | string | Generation task id, returned by generate_music. |
wait_for_generation| Parameter | Type | Description |
|---|---|---|
id | string | Generation task id. |
poll_interval_seconds | number | Polling interval. Default 5. |
timeout_seconds | number | Total timeout. Default 600 (10 minutes). |
MIT © Louis Tsang
FAQs
Model Context Protocol (MCP) server for the Lacuna Music API — generate AI music from MCP-compatible clients like Claude Desktop and Claude Code.
The npm package lacuna-mcp receives a total of 161 weekly downloads. As such, lacuna-mcp popularity was classified as not popular.
We found that lacuna-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.