vr000m/pipecat-local-tts-server

Review signals: 175 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. 11 distinct locations. 175 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The reference client speaks the wire protocol and writes the synthesized audio to a WAV file: Real input produced the expected result: wrote <guest-path> (24000 Hz, 1ch, 14400 bytes)

  Source: the wire protocol directly and writes the reassembled audio to a WAV.

  Input: Hello from the local server.

  Expected: a WAV file is written at the --out path at 24000 Hz

  Command: uv run python examples/reference_client.py --socket-path <guest-path> --text 'Hello from the local server.' --out <guest-path>

  Observed: wrote <guest-path> (24000 Hz, 1ch, 14400 bytes) hello: backend={'name': 'tone', 'model': None} rate=24000 caps={'streaming': False, 'binary_audio': False, 'text_formats': ['plain'], 'languages': ['en'], 'voice_count': 1, 'extras': ['speed'], 'ideal_words': 40, 'max_text_chars': 2000} done: response_id=resp_1c6504ab26594512 frames=15 bytes=14400 (~300 ms)

• The server advertises an exact, stable audio rate of 24000 Hz: Real input produced the expected result: audio: pcm16 @ 24000 Hz / 1ch

  Source: 1. **An exact, stable advertised rate.** `server.hello.audio.rate` is the true

  Input: status against the running tone server

  Expected: status reports pcm16 at 24000 Hz

  Command: uv run python -m tts_server status --socket-path <guest-path>

  Observed: …audio: pcm16 @ 24000 Hz / 1ch capabilities: streaming=False binary_audio=False voice_count=1 session_id: session_f000b09756904a70 queue_depth: 0 voices (1): tone buffered_chars: 0 session_uptime: 0.0s pid: 2257

Examples

• Synthesize text through the running server with the documented reference client and write a WAV: command completed successfully

  Source: README.md Examples: examples/reference_client.py

  Input: --text Hello from the local server.

  Expected: WAV written at 24000 Hz

  Command: uv run python examples/reference_client.py --socket-path <guest-path> --text 'Hello from the local server.' --out <guest-path>

  Observed: wrote <guest-path> (24000 Hz, 1ch, 14400 bytes) hello: backend={'name': 'tone', 'model': None} rate=24000 caps={'streaming': False, 'binary_audio': False, 'text_formats': ['plain'], 'languages': ['en'], 'voice_count': 1, 'extras': ['speed'], 'ideal_words': 40, 'max_text_chars': 2000} done: response_id=resp_cd6bd8128d0f4c02 frames=15 bytes=14400 (~300 ms)

• Check server health with the documented status command: command completed successfully

  Source: README.md Checking server health

  Input: --socket-path <guest-path>

  Expected: status prints backend tone and the advertised rate

  Command: uv run python -m tts_server status --socket-path <guest-path>

  Observed: tts_server: ok protocol_version: 0.1 backend: tone (model: None) audio: pcm16 @ 24000 Hz / 1ch capabilities: streaming=False binary_audio=False voice_count=1 session_id: session_692e72f3d7cd46fd queue_depth: 0 voices (1): tone buffered_chars: 0 session_uptime: 0.0s pid: 2257

Local or hosted: local

Start the local WebSocket TTS server with the tone backend, check its status, and synthesize speech to a WAV file through the documented reference client

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; python3 --version; id -u; cat /etc/os-release | head -2
cd <guest-path> && cat README.md 2>/dev/null | head -c 7000
cd <guest-path> && grep -n '^#' README.md; grep -n -i 'linux\|tone\|--once\|--now\|cron\|webhook\|schedul' README.md | head -60
cd <guest-path> && sed -n 199,275p README.md
cd <guest-path> && sed -n 338,366p README.md; echo ----; sed -n 721,760p README.md
cd <guest-path> && grep -n 'requires-python\|^name\|^version' pyproject.toml | head; which uv; uv --version 2>&1; python3 -m pip --version; ls .coldpass; echo "CDP: $CDP_URL"; curl -sS -m 10 "$CDP_URL/json/version"; echo " rc=$?"
cd <guest-path> && timeout 900 uv sync --extra client 2>&1 | tail -15; echo "rc=${PIPESTATUS[0]}"
mkdir -p <guest-path> && cd <guest-path> && (setsid nohup uv run python -m tts_server serve --backend tone --socket-path <guest-path> > <guest-path> 2>&1 &) ; sleep 6; cat <guest-path>; ls -la <guest-path>
cd <guest-path> && uv run python -m tts_server status --socket-path <guest-path>; echo rc=$?; sed -n 1,40p examples/reference_client.py
mkdir -p <guest-path> && cd <guest-path> && uv run python examples/reference_client.py --socket-path <guest-path> --text "Hello from the local server." --out <guest-path>; echo rc=$?; ls -la <guest-path>; python3 -I -c "import wave,sys; w=wave.open('<guest-path>'); print(w.getframerate(), w.getnchannels(), w.getsampwidth(), round(w.getnframes()/w.getframerate(),2))"
cd <guest-path> && rm -f <guest-path> && grep -n 'writes the reassembled audio to a WAV\|exits non-zero if no\|(none (synthetic sine)\|synthetic sine\|Useful$\|advertised rate\|Unix domain socket (recommended' README.md
cd <guest-path> && grep -rn -i 'cron\|schedul\|--once\|--now\|while True\|call_later\|interval' tts_server/*.py | head -20; ls tts_server; grep -n 'def main\|add_parser\|add_argument("--' tts_server/cli.py 2>/dev/null | head -30
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["uv","run","python","examples/reference_client.py","--socket-path","<guest-path>","--text","Hello from the local server.","--out","<guest-path>"],"cwd":"<guest-path>","expected_text":"wrote <guest-path> (24000 Hz, 1ch, 14400 bytes)"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"The reference client speaks the wire protocol and writes the synthesized audio to a WAV file","source":"the wire protocol directly and writes the reassembled audio to a WAV.","input":"Hello from the local server.","expected":"a WAV file is written at the --out path at 24000 Hz","probe_kind":"cli","argv":["uv","run","python","examples/reference_client.py","--socket-path","<guest-path>","--text","Hello from the local server.","--out","<guest-path>"],"expected_text":"wrote <guest-path> (24000 Hz, 1ch, 14400 bytes)","cwd":"<guest-path>"},{"kind":"claim","claim":"The server advertises an exact, stable audio rate of 24000 Hz","source":"1. **An exact, stable advertised rate.** `server.hello.audio.rate` is the true","input":"status against the running tone server","expected":"status reports pcm16 at 24000 Hz","probe_kind":"cli","argv":["uv","run","python","-m","tts_server","status","--socket-path","<guest-path>"],"expected_text":"audio: pcm16 @ 24000 Hz / 1ch","cwd":"<guest-path>"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: README and tts_server CLI (serve, status, prefetch) contain no cron, schedule, --once or --now trigger. The server runs a per-connection request loop that synthesizes only when a client sends input_text.commit, so there is no product cycle to trigger.","checks":[]}
EOF
python3 -I -c "import json;[json.load(open(f)) for f in ['probe.json','claims.json','cycles.json']];print('json ok')"
cd <guest-path> && cat > examples.json <<'EOF'
[{"kind":"example","claim":"Synthesize text through the running server with the documented reference client and write a WAV","source":"README.md Examples: examples/reference_client.py","input":"--text Hello from the local server.","expected":"WAV written at 24000 Hz","argv":["uv","run","python","examples/reference_client.py","--socket-path","<guest-path>","--text","Hello from the local server.","--out","<guest-path>"],"cwd":"<guest-path>","expected_text":"wrote <guest-path> (24000 Hz, 1ch, 14400 bytes)"},{"kind":"example","claim":"Check server health with the documented status command","source":"README.md Checking server health","input":"--socket-path <guest-path>","expected":"status prints backend tone and the advertised rate","argv":["uv","run","python","-m","tts_server","status","--socket-path","<guest-path>"],"cwd":"<guest-path>","expected_text":"backend: tone (model: None)"}]
EOF
python3 -I -c "import json;json.load(open('examples.json'));print('ok')"; cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo rc=$?
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Start the local WebSocket TTS server with the tone backend, check its status, and synthesize speech to a WAV file through the documented reference client","operation_scope":"Linux x86_64 guest, Ubuntu 24.04, Python 3.12.3, uv 0.13.5. Only the base tone backend (synthetic sine, no model weights) was exercised. Kokoro, Voxtral, Pocket, dia, Qwen3, Fish and Phonon need Apple Silicon mlx-audio and were not run. The macOS menu bar app and launchd recipes were not run. Server was on a Unix socket at <guest-path> and is left running until guest teardown.","steps":["uv sync --extra client","uv run python -m tts_server serve --backend tone --socket-path <guest-path>","uv run python -m tts_server status --socket-path <guest-path>","uv run python examples/reference_client.py --socket-path <guest-path> --text \"Hello from the local server.\" --out <guest-path>"],"deviations":["Checked CDP_URL/json/version first: HTTP 200 with Chrome/155 JSON. The product needs no browser, so nothing else was done with it.","Used the README's uv-based client install (uv sync --extra client) instead of Apple Silicon extras; kokoro and other mlx backends are unsupported on this Linux guest.","The git pin step (git init, remote add, fetch PINNED_COMMIT, reset) was not run: the workspace has no .git and no command needed Git metadata. The snapshot was used as delivered; the pin was not verified.","Ran the server by hand with the README serve command so the CLI probes could reach it; the checker did not start it.","Used uv run python for the reference client as the README's run-through-uv rule requires."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"No fix needed for the tested path. To verify the Apple Silicon backends, run this on a Mac with the kokoro extra."}
EOF
python3 -I -c "import json;print(json.load(open('report.json'))['outcome'])"; ls -la <guest-path>; ls <guest-path> 2>&1 | tail -1
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c "import json,sys; d=json.load(sys.stdin); print('valid=',d['valid'],'problems=',d['problems'],'replay=',d['replay']['status'])"; echo rc=$?