B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · General
FunASR
Open-source speech recognition toolkit for training, inference, streaming ASR, VAD, punctuation, speaker diarization pipelines, and OpenAI-compatible/MCP serving.
Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 48/100
- Rank
- #153 of 500
- GitHub stars
- 20.7k
What it does
FunASR is an open-source speech recognition toolkit that handles training, inference, and streaming ASR (automatic speech recognition), plus VAD (voice activity detection), punctuation restoration, and speaker diarization. It can be deployed as an MCP server with OpenAI-compatible endpoints, enabling AI agents to transcribe and analyze audio workloads.
Who it’s for
ML engineers and builders integrating speech-to-text pipelines into AI agents; teams needing on-premises or self-hosted ASR to avoid third-party API dependencies. Executives should evaluate this for compliance-sensitive workflows (healthcare, finance) where audio data handling must remain internal.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/modelscope/FunASR (opens external site) for latest MCP server setup instructions. Typical installation: pip install funasr + configure model paths and streaming endpoints. For MCP server deployment, check the official docs for environment variables (model selection, hardware acceleration) and Docker/systemd deployment patterns.
Risks
- Audio data residency: Ensure training/inference doesn't log or cache raw audio to disk unencrypted; verify data handling policies in config.
- Model supply chain: Models are fetched from ModelScope; audit pinned model versions and checksums to prevent model tampering or poisoning.
- Inference resource exhaustion: Streaming ASR and diarization are CPU/GPU-intensive; unbounded requests can starve agent processes or trigger DoS.
- Prompt injection via transcription: Malicious audio (e.g., adversarial examples) or poisoned punctuation models could inject text payloads into downstream LLM prompts.
- Credential/API scope: If exposed as an HTTP endpoint, ensure MCP authentication and rate-limiting are enforced to prevent unauthorized transcription access.
How to stay secure
Least-privilege permissions
- Run FunASR process under a dedicated non-root service account with read-only access to models and audio input directories; deny write to
/tmp,/var/log, and system paths. - Restrict ModelScope model downloads to a pinned, read-only model cache; use file permissions (0555) to prevent accidental overwrites or injection.
- Limit MCP connector credentials to transcription-only scope; revoke any unused API keys or credentials used for model fetching.
Network isolation
- Deploy FunASR behind a reverse proxy or API gateway with rate-limiting (e.g., max requests/minute per agent ID) and strict input size caps (e.g., max audio duration).
- Disable direct HTTP/socket exposure; use only authenticated MCP transport (TLS + mutual auth) and firewall inbound traffic to trusted agent subnets.
- Isolate GPU/CPU resources via containerization (cgroups, memory limits) to prevent resource exhaustion attacks affecting other processes.
Monitoring
- Log all transcription requests (agent ID, audio duration, model version, latency) to immutable audit storage; alert on anomalies (oversized uploads, repeated failures, unusual punctuation patterns).
- Monitor ModelScope model fetch operations for unexpected versions, checksums, or network destinations; implement checksums in config and verify before load.
- Track CPU/GPU utilization and queue depth per agent; alert if usage spikes or streaming sessions hang indefinitely.
Red flags to watch for
- Audio files with unusual entropy, spectral anomalies, or extreme lengths; adversarial examples may trigger injection-prone transcription output.
- Transcription output containing command syntax, code, or unexpected structured payloads (JSON, XML) unusual for spoken language; validate before forwarding to LLM prompts.
- Model checksum mismatches, modified timestamps, or unauthorized model downloads from ModelScope; implement signed model manifests.
- Repeated 429/timeout errors or requests from single agent ID; indicative of resource exhaustion or scanning attempts.
Alternatives
- Whisper (OpenAI): Cloud-hosted or self-hosted via openai-python; simpler setup, lighter touch, but outbound API dependency.
- Deepgram MCP: Commercial ASR MCP connector with built-in compliance certifications (SOC2, HIPAA); managed security but vendor lock-in.
- Vosk: Lightweight, offline-first speech recognition; lower accuracy and fewer features than FunASR, better for ultra-constrained environments.
- Azure Speech Services: Enterprise-grade ASR with compliance; cloud-hosted (data residency concerns) and commercial licensing.