Back to Home
hbuddenberg icon

TTS-Notify

Verified Safe

by hbuddenberg

Overview

A modular Text-to-Speech notification system for macOS, offering CLI, MCP, and REST API interfaces powered by the native 'say' command.

Installation

Run Command
tts-notify --mode mcp

Environment Variables

  • TTS_NOTIFY_VOICE
  • TTS_NOTIFY_RATE
  • TTS_NOTIFY_LANGUAGE
  • TTS_NOTIFY_QUALITY
  • TTS_NOTIFY_PITCH
  • TTS_NOTIFY_VOLUME
  • TTS_NOTIFY_ENABLED
  • TTS_NOTIFY_CACHE_ENABLED
  • TTS_NOTIFY_STREAMING
  • TTS_NOTIFY_AUTO_SAVE
  • TTS_NOTIFY_CONFIRMATION
  • TTS_NOTIFY_LOG_LEVEL
  • TTS_NOTIFY_MAX_CONCURRENT
  • TTS_NOTIFY_TIMEOUT
  • TTS_NOTIFY_CACHE_TTL
  • TTS_NOTIFY_MAX_TEXT_LENGTH
  • TTS_NOTIFY_OUTPUT_FORMAT
  • TTS_NOTIFY_OUTPUT_DIR
  • TTS_NOTIFY_SAMPLE_RATE
  • TTS_NOTIFY_CHANNELS
  • TTS_NOTIFY_CLI_FORMAT
  • TTS_NOTIFY_API_PORT
  • TTS_NOTIFY_API_HOST
  • TTS_NOTIFY_MCP_TOOLS
  • TTS_NOTIFY_PROFILE
  • TTS_NOTIFY_DEBUG_MODE
  • TTS_NOTIFY_VERBOSE
  • TTS_NOTIFY_EXPERIMENTAL

Security Notes

The project uses `subprocess.run` and `asyncio.create_subprocess_exec` to invoke the native 'say' command, passing arguments as a list, which is generally safer than using `shell=True` with user input. File outputs use `TextNormalizer.sanitize_filename` to prevent path traversal. However, the FastAPI server (`api/server.py`) uses `allow_origins=["*"]` for CORS, which is a security risk in a production environment if not properly restricted. The documentation mentions this should be configured appropriately for production. No hardcoded secrets or 'eval' usage found.

Similar Servers

Stats

Interest Score0
Security Score8
Cost ClassLow
Stars0
Forks0
Last Update2025-11-27

Tags

Text-to-SpeechmacOSNotificationsCLIMCPREST APIPython