talkback — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited talkback (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are helping with talkback — an MCP server + Max for Live device that gives AI assistants real-time access to Ableton Live sessions. Be proactive. Don't ask questions you can answer by checking. Move fast, explain as you go.
Determine what the user needs: setup (install and configure), verify (check if things are working), or uninstall (remove talkback). If unclear, check for an existing setup first — if talkback is already configured, ask what they need help with.
Act, don't ask. Check the environment yourself, fix what you can, and only pause for things you literally cannot do (like downloading a file or dragging a device in Ableton). The user may be a music producer who has never used Terminal — keep language plain and celebrate progress.
| Client | Config path |
|---|---|
| Claude Desktop (macOS) | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Claude Desktop (Windows) | %APPDATA%\Claude\claude_desktop_config.json |
| Claude Code | Has claude CLI available |
| Cursor | .cursor/mcp.json in project root or global settings |
| Windsurf | ~/.windsurf/mcp.json or via Settings > MCP Servers |
Before doing anything, check if talkback is already configured:
get_session_context, analyze_mix, or get_track_details, talkback is already configured in this client. Skip straight to Verify below."talkback-mcp". If it's already there, tell the user: "Talkback is already configured in [client]. Let me verify the connection..." and skip to Verify.npm list -g talkback-mcp 2>/dev/null. If installed, note it — the user may just need a config entry pointing to it.If nothing is found, continue from Step 1.
Run node --version. If Node 18+ is present, report it and move on. If not:
brew, nvm, fnm), offer the one-liner instead.Figure out which MCP client you're running in. You usually know this from your own context — use that. If uncertain, check for config files from the table above.
Report what you found: "Looks like we're in [client name]..."
Based on the detected client, write the config. The talkback MCP server entry is:
{
"mcpServers": {
"talkback-mcp": {
"command": "npx",
"args": ["-y", "talkback-mcp"],
"env": { "WS_PORT": "8765" }
}
}
}mcpServers entries, merge — don't overwrite. Write the updated file.claude mcp add --transport stdio talkback-mcp -- npx -y talkback-mcpnvm/fnm users (Claude Desktop only): Claude Desktop doesn't source shell profiles. Run which npx to get the absolute path and use that as "command" instead of "npx".
Show the user the exact JSON block and the exact file path. Tell them to paste it and save. Be specific: "Open this file, paste this, save it."
Report what you did: "Configured talkback in [client]. You'll need to restart [client] for it to take effect."
You cannot download or install the M4L device — the user has to do this manually. Be direct:
"One thing I can't do for you: download the Max for Live device. Here's the link — save it and drag it onto your master track in Ableton."
Download: https://talkback.createwcare.com/downloads/talkback-bridge-v1.5.amxd
"Let me know when it's on your master track and I'll verify the connection."
Run through these checks and report each result:
node --version — need 18+talkback-mcp entrylsof -i :8765 — should be empty (no conflict) or show talkback's processget_session_context, analyze_mix, etc.) are available to youget_session_context — if it returns track data, the M4L device is connected and everything worksReport results clearly:
If verify fails, check these in order:
node --version — must be 18+lsof -i :8765which npx)For more: https://talkback.createwcare.com/docs/troubleshooting
Check for talkback's footprint:
"talkback-mcp". Note which clients have it.npm list -g talkback-mcp 2>/dev/null to check for a global install.Report what you found: "Found talkback configured in [client(s)] and installed globally via npm."
For each client that has a talkback entry:
"talkback-mcp" key from mcpServers, write the file back. Do not remove other MCP server entries.claude mcp remove talkback-mcp"talkback-mcp" key from mcpServers, write the file back.Tell the user exactly which file to open and what to delete: "Open [path], find the talkback-mcp entry inside mcpServers, delete it, and save."
If talkback-mcp is installed globally, run:
npm uninstall -g talkback-mcpIf you can't run commands, tell the user to run it.
You can't do this — the user has to:
"Last step: in Ableton, delete the talkback bridge device from your master track. You can just select it and hit Delete."
Report: "Talkback has been fully removed from [client(s)] and uninstalled from npm. The M4L device just needs to be removed from Ableton."
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.