--- sidebar_position: 6 title: Public MCP Server description: Connect your AI assistant or any MCP client to TrackForge's public, no-auth MCP server. It checks a catalogue's MLC registration and unclaimed shares, up to 50 ISRCs a request, looks up a song's ISWCs, writers and publishers, and validates CWR files. keywords: - MLC registration check - catalogue registration check - ISWC lookup - songwriter and publisher IPI - CWR validation - ISRC lookup - MCP server - Model Context Protocol - remote MCP server - Claude connector --- # Public MCP Server TrackForge runs a public remote MCP (Model Context Protocol) server, named TrackForge. It gives an AI assistant four tools: - **`check_catalogue`**: up to 50 ISRCs a request, checked against The MLC's data. A verdict for each recording (registered, partial, nobody, conflict or unknown), any unclaimed share, and a count of each verdict. - **`lookup_recording`**: one ISRC, Spotify link, title or YouTube link. The recording's MLC verdict and, from MusicBrainz, the song's ISWCs, writers and publishers with IPI numbers, and its first release. - **`validate_cwr`**: a CWR 2.1 file, up to 256 KB. Each error and warning with its line, the rule and how to fix it. - **`request_full_report`**: records a request for a person at TrackForge to follow up. It generates nothing. The server is unauthenticated. There is no account, API key or OAuth flow. It is built for any assistant or app that can add a remote MCP server; the ones it has been tested with are under [Tested clients](#tested-clients). For example questions and answers and a short setup guide, see [trackforge.studio/mcp](https://trackforge.studio/mcp). :::note[Findings, not advice] Every answer is a finding from registration data as of the date shown. It is not legal advice and not a statement of who owns a song or who may use a recording. ::: ## Connect Any MCP client needs these settings and nothing else. | Setting | Value | |---|---| | Server URL | `https://api.trackforge.studio/api/v1/mcp` | | Transport | Streamable HTTP (JSON-RPC over `POST`; `GET` and `DELETE` return 405) | | Authentication | None. Leave any OAuth or API key field empty | | Server name | `trackforge`, with the title TrackForge | | Protocol versions | `2025-11-25`, `2025-06-18`, `2025-03-26`, `2024-11-05`. A client that opens with revision `2026-07-28` gets a 400 and falls back to `initialize`; Claude does this on its own. | | Registry entry | `studio.trackforge/music-registration-check` ([server.json](https://trackforge.studio/.well-known/mcp/server.json)) | ### Any MCP client Add the URL as a remote Streamable HTTP server with no authentication. - **Sessions.** `initialize` returns an `Mcp-Session-Id` header; send it on later requests. A session id the server does not recognise returns 404: send `initialize` again without it. - **Batches.** A JSON-RPC batch may hold at most 10 messages; a larger batch is refused with error `-32600` and none of it runs. - **User agent.** Send a `User-Agent` header that names your client. Cloudflare sits in front of the server and refuses Python `urllib`'s default user agent (`Python-urllib/3.x`) with HTTP 403 and error code 1010, before the request reaches the server (checked on 5 October 2026). - **Browsers.** A request that carries an `Origin` header is accepted only from trackforge.studio, so a page on another site cannot call the server from the browser. Call it from a server or a desktop app. ### Tested clients A client is listed here once it has been tested against the live server, with the date of the test. Other clients have not been tried. | Client | Tested | How to add it | |---|---|---| | Claude, as a custom connector on claude.ai | 3 October 2026 | The steps under [Claude](#claude) | | ChatGPT, in Developer mode on chatgpt.com | 5 October 2026 | The steps under [ChatGPT](#chatgpt) | | Claude Code | 3 October 2026 | `claude mcp add --transport http trackforge https://api.trackforge.studio/api/v1/mcp` | | Codex CLI | 5 October 2026 | `codex mcp add trackforge --url https://api.trackforge.studio/api/v1/mcp` | | MCP Inspector | 3 October 2026 | Enter the server URL and choose the Streamable HTTP transport | ### Claude On Free, Pro and Max plans (checked on a Max plan on 3 October 2026; Claude's screens can differ and change): 1. Open **Customize → Connectors** in Claude. 2. Select **Add**, then **Add custom connector**. 3. Give it a name, such as TrackForge, and enter `https://api.trackforge.studio/api/v1/mcp`, then select **Continue**. Claude marks **No sign-in** as detected; leave any OAuth fields empty. Select **Add**. 4. On the connector's page, select **Connect**. **Tool permissions** lists three read-only tools and one write tool. 5. In a new conversation the connector is already on (**+ → Connectors** shows it). The first time each tool is used, Claude asks whether to allow it. On Team and Enterprise plans, an Owner adds it first under **Organization settings → Connectors → Add → Custom → Web**; members then select **Connect** under **Customize → Connectors**. Free plans allow one custom connector. ### ChatGPT In Developer mode (tested on a Free plan on 5 October 2026; OpenAI's documentation lists Developer mode for Plus, Pro, Business, Enterprise and Education accounts, and ChatGPT's screens can change): 1. Open **Settings → Security and login** and turn on **Developer mode**. 2. Open **Plugins**, select the plus button, then **Create custom MCP server**, then **Create MCP App**. 3. Give it a name, such as TrackForge, enter `https://api.trackforge.studio/api/v1/mcp` as the server URL and set **Authentication** to **No Auth**. 4. Tick **I understand and want to continue**, select **Create**, then **Connect**. The app's page lists the four tools. 5. In a new conversation, select the plus button, type TrackForge and choose it. The read-only tools ran without a prompt under the default permission, **Allow low-risk tools**. Given three ISRCs, ChatGPT called `lookup_recording` once for each. Named in the question, `check_catalogue` was called once for the whole list. ## Tools ### `check_catalogue` Checks up to 50 ISRCs in one call; split a larger catalogue into several calls. Each row gives the recording's verdict and confidence, its MLC song code, any unclaimed share, and the ISWCs and writer names of the works MusicBrainz links to it. The summary counts each verdict, gives the next step for each verdict found, and carries the snapshot date. A row does not repeat the evidence or the next step: `lookup_recording` gives the evidence for one recording. Measured on 5 October 2026: six calls for 300 recordings took 34 seconds in one run and 47 in another, 4 to 9.5 seconds a call, with 18 to 29 KB returned per call. Invalid ISRCs are listed and skipped, and duplicates are removed. A call has about 45 seconds; ISRCs whose lookup has not finished by then are marked `checked: false` and listed in `summary.not_checked_isrcs`. Nothing is known about them, they are not counted as any verdict, and they should be sent again in a smaller call. If none finishes, the tool returns an error. ### `lookup_recording` Finds one recording and reports its MLC registration and the song's rights data. Give exactly one of: | Input | Notes | |---|---| | `isrc` | 12 characters, e.g. `USIR20400274`; hyphens and spaces are accepted | | `spotify_url` | A Spotify track link or `spotify:track:` URI; album and playlist links are refused | | `title` | With optional `artist` | | `youtube_url` | Resolved from the video title, so matches are low confidence | It returns the candidate recordings and MLC works, how each was matched and how confidently, and a verdict for each recording. When several matches are equally likely, `ambiguous` is true and all of them are returned for the user to choose from. For each recording it also returns what MusicBrainz records: - the works linked to the recording, with their ISWCs; - each work's writers and publishers, with IPI and ISNI numbers where MusicBrainz has them; - the earliest release: album, date, label and catalogue number; - how many releases carry the recording, and its page on musicbrainz.org. Set the optional `full_record` to `true` to add MusicBrainz's full record: every release with its label, catalogue number, country and date, the performer and producer credits, related recordings, links and aliases. That answer runs to tens of kilobytes, so leave it out unless the detail is needed. It applies to an ISRC, or to a Spotify link that resolves to one recording. ### `validate_cwr` Checks the text of a CWR 2.1 (Common Works Registration) file, up to 256 KB (262,144 characters) of ASCII text; upload larger files to the [CWR validation tool](https://trackforge.studio/cwr-tool). An optional `filename` such as `CW260001TF_000.V21` lets the society receiver code select that society's rules; `recipient_profile` sets them directly, and `cisac_base` is the default. It returns whether the file is valid, error and warning counts, and each issue with its line, rule, a plain-language explanation and how to fix it. The file is not stored. A valid result does not guarantee that a society will accept the file. ### `request_full_report` Records a request for a person at TrackForge to follow up by email about a catalogue review. It takes a contact name and email, an optional organisation, and the catalogue's ISRCs (up to 200), a description (up to 2,000 characters), or both. `consent_to_contact` must be `true`: an assistant should call this tool only after the user has asked for a follow-up and agreed to be contacted. No report is generated or sent automatically. ## Reading the answers Each recording gets one verdict. When several apply, the first in this table wins. | Verdict | Meaning | |---|---| | `unknown` | TrackForge's copy of The MLC's data could not be read. It is never a negative finding. | | `conflict` | The recording is linked to more than one MLC work. | | `nobody` | The data was read and no MLC work is linked to the recording. This does not by itself mean the work is unregistered: the next step says whether to match the recording to an existing work or register one. | | `partial` | The recording is linked to one work, and a share is unclaimed or in dispute. | | `registered` | The recording is linked to one work with nothing unclaimed or in dispute. | Each verdict carries a confidence, dated evidence, an `as_of` date and a `next_step` that names who can act. A `nobody` verdict for a recording released within about 60 days of the snapshot date is marked low confidence: The MLC may not have processed it yet. ## Where the data comes from - **The MLC:** TrackForge's copy of The MLC's public bulk data (BWARM), refreshed weekly. The MLC publishes a new snapshot every five days. The server never queries The MLC live, so every MLC answer is true as of the snapshot date it carries. - **MusicBrainz:** TrackForge's copy of MusicBrainz's core data, which MusicBrainz dedicates to the public domain (CC0), refreshed about twice a month. MusicBrainz is edited by its community, so its record of a song's writers and publishers is evidence, not proof. Its tags, genres, ratings, annotations and cover art are licensed for non-commercial use only and are not returned. A title search that The MLC's data cannot answer is sent to musicbrainz.org. - **Discogs:** TrackForge's copy of Discogs's monthly data dumps, which Discogs dedicates to the public domain (CC0), refreshed monthly. It is used for one check only: when MusicBrainz names no writer for a recording, the writers The MLC lists for each linked work are compared with the writers Discogs's users have credited on releases of a track with that title by that artist. The answer says whether a name is shared, and nothing else from Discogs is returned. Discogs is edited by its users and the track is found by title and artist, not by ISRC, so this is evidence, not proof. - **Spotify:** used only to turn a Spotify track link into its ISRC, and to check that an ISRC is a track on Spotify. Spotify's own data (titles, albums, artwork) is not returned to assistants: Spotify's terms do not allow it to be fed into an AI model. - **YouTube:** a YouTube link is resolved from the video's title, which is read from YouTube. ## Example prompts - "Check these ISRCs against The MLC: how many have no linked work, and how many have a share unclaimed? …" - "Is ISRC USIR20400274 registered with The MLC, and is any share unclaimed?" - "Here is the CWR file I'm about to send to The MLC. Is it valid, and what should I fix?" - "Who is registered for the song at this Spotify link: …?" - "Who wrote the song on ISRC GBUM71029604, and what are the writers' IPI numbers and the ISWC?" - "Which label first released this recording, and under what catalogue number?" ## Limits Limits apply to each MCP session. Clients that send no session id are counted by source address and user agent. Each source address and contact email also has a daily allowance across all its sessions; shared ranges used by hosted assistants, such as Claude's connectors, are exempt from the per-address unit allowance. | Limit | Value | |---|---| | Usage units | 60 per 5 minutes and 600 per UTC day | | Unit cost | `lookup_recording` 1; `check_catalogue` 1 per 10 ISRCs; `validate_cwr` 2; `request_full_report` 1 | | CWR validations | 20 per hour | | Report requests | 5 per day | | Per source address | 3,000 units and 10 report requests per UTC day, across all sessions (an IPv6 address counts by its /64) | | Per contact email | 3 report requests per day | At 1 unit per 10 ISRCs, one session can check up to 600 recordings per 5 minutes and 6,000 per UTC day, less the units its other calls use. A call over a limit returns a tool error that says how long to wait. The CWR validator checks only a few files at once: a `validate_cwr` call made while it is busy returns a tool error asking you to try again in a minute. ## Privacy Requests are logged for usage measurement: the method and tool, the client name and version sent at `initialize`, the input kind, the ISRCs requested or resolved, the outcome, and a keyed one-way hash of the client address. The address itself is not stored. Titles, artist names, CWR file content and the contact details given to `request_full_report` are not logged; those contact details are stored only so that a person can follow up. The request log is kept for 12 months, and the address hash is removed after 90 days. Report requests are kept for 24 months, or less if the person who made one asks for it to be deleted. The [privacy policy](https://trackforge.studio/privacy) has the full terms, and [auth.md](https://trackforge.studio/auth.md) gives the same details in a form for automated clients. ## Support Email `hello@trackforge.studio`.