B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · General
nuclear
Streaming music player that finds free music for you
Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 48/100
- Rank
- #159 of 500
- GitHub stars
- 18.7k
What it does
Nuclear is a streaming music player that automatically discovers and plays free music from various sources across the internet. It aggregates tracks from multiple platforms, allowing users to build playlists and listen without requiring premium subscriptions.
Who it’s for
Music enthusiasts and casual listeners seeking free streaming alternatives. Builders integrating music discovery into applications may find its backend useful, though the MCP connector status and current maintenance level is unclear.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/nukeop/nuclear (opens external site) for current MCP server setup instructions, as this connector's active maintenance status and npm availability cannot be confirmed from available signals.
Risks
- Unknown or potentially unmaintained status—0 weekly npm downloads suggests limited active adoption or availability as an MCP connector
- Free music aggregation may pull from sources with unclear licensing or copyright compliance, creating legal exposure for integrators
- Data exfiltration risk if the connector transmits user listening history or search queries to third-party music sources without transparent privacy controls
- Prompt injection vulnerability if music metadata or track titles are rendered without sanitization in agent workflows
- Supply-chain risk from external music source dependencies; upstream API changes or takedowns could break functionality
How to stay secure
Least-privilege permissions
- Restrict the connector to read-only access; disable write, delete, or configuration modification capabilities
- Limit API credentials to only music search and retrieval functions; revoke access to user profile, history, or account management endpoints
- Run the connector in a sandbox environment with no access to local file system, clipboard, or system environment variables
- Disable or proxy any outbound network calls; whitelist only known music source domains explicitly
Network isolation
- Deploy the connector behind a proxy or VPN that logs all outbound requests to music sources and third-party APIs
- Block direct DNS resolution; use a DNS allowlist to prevent the connector from reaching unexpected domains
- Implement egress filtering to prevent transmission of user session tokens, search queries, or metadata to unapproved destinations
- Disable automatic updates; require manual review and testing before upgrading to new versions
Monitoring
- Log all music source queries, API calls, and responses; alert on unusual request patterns or data volumes
- Track which metadata fields are extracted and rendered; flag any unrecognized or suspicious track title or artist information
- Monitor for failed authentication attempts or API rate-limit errors that may indicate upstream service degradation or compromise
- Audit connector memory and network usage; spike detection can reveal data exfiltration attempts
Red flags to watch for
- Connector requests user credentials or session tokens; legitimate music APIs should use API keys only
- Metadata rendering causes template injection, code execution, or unescaped HTML in agent output (e.g., malicious track titles)
- Copyright takedown notices or legal complaints linked to music sources accessed by the connector
- Upstream music source APIs become unavailable, change terms of service, or shift to paid-only models; evaluate alternative connectors immediately
Alternatives
- Spotify API – Licensed, well-maintained streaming integration with clear ToS and active developer support
- YouTube Music API – Broader catalog with transparent authentication and rate-limiting
- MusicBrainz MCP – Open-source music metadata connector with community governance
- Last.fm API – Lightweight scrobbling and recommendation engine with established privacy policies