musicopyapp.pages.dev
_{Free, no account, no key, nothing to install.}

Paste a Spotify playlist, get a per-track answer to the only question that matters before you press record: will this music get me claimed, muted or taken down, and where can I actually use it?

Not legal advice. It is an estimate built from public signals, and it says which signal it used for every single verdict.

It costs nothing to use and nothing to run. Every piece sits on a free tier and no part of it asks anyone to sign up for anything: no account to visit it, no API key to run it locally, and the one optional key it can use in production is free too. The Docs tab explains the copyright side in plain language, and the scanner points at freely licensed music you can actually use rather than at anything you have to buy.

Status: working end to end, deployed and in use. Decision engine, playlist reading, licence catalogue and the web interface are all done and covered by 38 tests. See CHANGELOG.md.

Why this exists

The usual advice is "upload the song to YouTube as private and check the Copyright tab". That works by hand, and it cannot be automated reliably:

• There is no API that reads Content ID claims on your own videos. The Content ID API is partner only. The public Data API only exposes status.rejectionReason, which shows up when YouTube rejects an upload. A monetization claim, the normal case, rejects nothing and is invisible to the API.
• Reading the Copyright tab therefore means driving a browser inside YouTube Studio, which breaks whenever Google reshuffles the panel.
• Uploading somebody else's catalogue in bulk, private or not, is a good way to lose a Google account.

So MusiCopy does not upload anything. It reads signals that are already public.

How it decides

Signal	Where it comes from	What it means
Art Track exists	YouTube Music	A distributor delivered that exact recording to YouTube, and that delivery is what switches Content ID on. Strongest signal available without uploading.
Provided to YouTube by ...	the Art Track description	Names the distributor, which is who would claim you.
Album label and copyright lines	Spotify	A major label means the whole catalogue is in Content ID.
Permissive catalogue match	packages/motor/datos/libres.json, checked by hand	You hold a licence, with its conditions and a ready-to-paste credit. Entries carry their official source and the date it was verified, and only licences that allow commercial use get in: a CC BY-NC entry would paint green exactly what a monetized channel cannot do.

The result is a traffic light plus a verdict for six different uses: YouTube video, YouTube live, Twitch, Instagram/TikTok, podcast, and background music in a physical business. They differ more than people expect. Twitch has no revenue share, so there is no claim to absorb the hit, only takedowns. A podcast has no detection system at all, so nothing warns you before the removal. And background music in a Spanish business is governed by collecting societies, not by any platform, so a track that is green for YouTube can still need a licence for a bar.

One case deserves its own note, because it is the one that fools people: a track you have a licence for can also be in Content ID. You are allowed to use it and the claim can still land. MusiCopy calls that amber, never green. It is not a corner case either: run Kevin MacLeod, the go-to "free music" name, and almost every track comes back amber, because The Orchard delivered that catalogue to YouTube years ago.

Green needs two things, not one: a licence and a completed check that found no Art Track. A licence alone is not enough, because a failed lookup is not good news, and green is the one colour nobody re-checks before hitting publish.

Layout

packages/motor      the traffic light, the platform rules and the licence catalogue.
                    Pure TypeScript, no network, so it tests without credentials.
apps/api            finds the Art Track and reads its description. No API key needed
                    locally; on Workers it also caps usage per IP.
apps/web            the interface and the Docs tab: Vite, React and Tailwind.
marca/              logo files. Design tokens in docs/MARCA.md.

Platform rules live in packages/motor/datos/plataformas.json, each one with its source and the date it was checked, because they change without notice and must not be buried in code. The same discipline governs packages/motor/datos/libres.json, the only source that can turn the light green: entries carry their official source and verification date, only licences allowing commercial use get in, and candidates that failed verification stay listed with the reason so nobody redoes the work.

The site also carries a Docs tab at #docs: ten pieces on how music copyright actually works, from the two rights inside every song to what happens when a video gets claimed, plus an honest account of where this scanner can be wrong. Bilingual, with sources on every date and figure.

Run it

Two processes: the local API that queries YouTube Music, and the web interface.

pnpm install
pnpm dev    # both processes at once: api on :8787, web on :5173

On Windows, double-clicking abrir-musicopy.bat does the same thing and opens the browser tab for you.

No API keys, no accounts, nothing to sign up for. Three ways to add tracks, all feeding the same list, which survives a page reload:

• One by one: two fields, song and artist, Enter to add.
• In bulk: paste a list, open a .txt, or drop the file on the page. The parser eats list numbering, trailing durations and the separators people actually use (-, en dash, em dash, |, ·, by, tab). Lines it cannot split are reported, never guessed.
• By link: a song or a playlist from Spotify, YouTube, YouTube Music or Deezer. Paste a track link and it reads the title and artist off it, no typing needed.

Artist and title order is impossible to guess, so there is a button that flips the whole list, and the matcher accepts them crossed anyway.

Up to 50 tracks per scan, and when a playlist has more, the interface says how many were left unchecked rather than pretending they came out clean.

SoundCloud is deliberately not supported: its API has been closed to new registrations for years and the only way in is to lift a client_id out of their own web app, which is brittle and against their terms.

Theme and language both read the browser, no toggle: dark or light from prefers-color-scheme, English or Spanish from navigator.language, English being the default for anything that isn't Spanish. Add ?lang=en or ?lang=es to the URL to force one.

Tests and types:

pnpm -r test
pnpm -r typecheck

To see the engine's verdict without any interface:

pnpm --filter @musicopy/motor ver

Playlist reading works without any credentials, but the Spotify route goes through the embed player, so it only sees public playlists and does not return ISRC or label. Wiring the official Web API would improve the data; it needs a registered Spotify app.

Deploy it

Try it live, running on Cloudflare. Two pieces, deployed separately, no server to manage by hand:

• apps/api runs as a Cloudflare Worker (apps/api/src/worker.ts, config in apps/api/wrangler.toml): wrangler deploy from apps/api. Add an optional YOUTUBE_API_KEY secret (wrangler secret put YOUTUBE_API_KEY, a free key from console.cloud.google.com with the YouTube Data API v3 enabled): without it the app reads the Art Track description by fetching the watch page directly, which works fine from a home connection but gets a CAPTCHA from Google when the request comes from a datacenter IP, Cloudflare's included. With the key it calls the official videos.list endpoint first (1 quota unit, 10,000 free a day) and only falls back to the page if that fails. That daily quota belongs to the key, not to the visitor, so everyone using a deployment shares it: wrangler.toml therefore declares two rate limits per IP, 120 songs and 30 requests a minute, charged per song because the quota is spent per song. If the quota does run out, the api answers 503 saying so rather than handing back a screenful of "can't tell". render.yaml at the repo root is an alternative: the same apps/api as a plain Node process on render.com, no rewrite needed, free tier sleeps after 15 minutes idle.
• apps/web is a static build (VITE_API_URL=<api url> pnpm --filter @musicopy/web build), deployed with wrangler pages deploy dist --project-name musicopyapp from apps/web. Any static host works the same way (Vercel, Netlify): point it at apps/web, set VITE_API_URL at build time to the API's public URL so the browser stops looking for it on localhost.

Don't trust it, check it

Open source only helps if somebody actually reads the code, and almost nobody does. So instead of asking you to trust this project, here is the prompt to check it: point your own AI agent at this repository and get a security report, in your language, in a few minutes, even if you do not know how to program.

Open AI-AUDIT.md and paste it into Claude Code, Codex, Cursor, Copilot or whatever you use. It is the same prompt in every public repository here, so you can compare.

ES: No hace falta que te fíes. Abre AI-AUDIT.md, pega ese texto en tu IA y te dirá en tu idioma qué hace este programa de verdad: qué envía por internet, qué toca en tu ordenador y qué ejecuta al instalarse.

Licence

MIT. See LICENSE.