Tunova Sdk — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Tunova Sdk (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Tiny, zero-dependency clients + MCP manifest for the Tunova music API — generate music with Suno models (v4.5 / v5 / v5.5) over a simple REST or MCP interface. Generation is async and billed only on success: a failed render refunds itself.
python/tunova.py — stdlib only, Python 3.8+.node/tunova.ts — Node 18+ (fetch built in).server.json — hosted Streamable-HTTP server at https://api.tunova.ai/mcp.Get a key (50 free tokens, no card) at <https://tunova.ai>. Full reference: <https://api.tunova.ai/docs> · live status: <https://tunova.ai/status>.
Tunova is an independent service, not affiliated with or endorsed by Suno. Tracks come from paid Suno plans; review Suno's terms for your use case.
from tunova import Tunova
t = Tunova("sk_live_…")
job = t.generate("warm lo-fi piano to study to", model="v5")
print(job["clips"][0]["audio_url"] if job["status"] == "complete" else job["error"])import { Tunova } from "./tunova";
const t = new Tunova(process.env.TUNOVA_API_KEY!);
const job = await t.generate("warm lo-fi piano to study to", { model: "v5" });
console.log(job.status === "complete" ? job.clips[0]?.audio_url : job.error);Both generate() calls submit a job and poll until the track is delivered. Prefer fire-and-forget? Use submit() with a callback_url and take an HMAC-signed webhook instead.
claude mcp add --transport http tunova https://api.tunova.ai/mcp \
--header "X-API-Key: sk_live_…"Tools: generate_song · wait_for_song · check_song. Same API key, same billed-on-success rule.
If you pass callback_url, Tunova POSTs the terminal job with X-Webhook-Signature: sha256=<hmac> over <X-Webhook-Timestamp>.<rawBody>, keyed with your whsec_… secret (view/rotate it on the dashboard's API-keys page). Verify against the raw body before parsing — both SDKs ship a verifier (Tunova.verify_webhook / verifyWebhook).
MIT — see LICENSE. The SDK code is yours to use freely; your use of the Tunova API is governed by the terms.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.