The browser app coordinates 3 local processes
ACE-Step UI wraps the separate ACE-Step 1.5 model with a React front end and an Express server backed by SQLite. A normal session therefore involves 3 processes: the Python model service, the Node backend, and Vite. The payoff is a much more familiar music workspace. Generated tracks land in a searchable library with likes, playlists, reusable settings, a bottom player, and optional access from another device on your LAN.
The interface covers more than text-to-song generation. It exposes 30 to 240 second durations, lyrics, instrumentals, reference audio, repainting, seed control, batches, and a queue. AudioMass supplies browser editing, Demucs handles stem separation, and FFmpeg supports processing. A Pexels key adds stock footage for videos, while procedural gradient covers work without that service. These extras explain the project's 96,740 source lines, but each integration creates another place where an upstream model or media tool can change underneath it.
The 5-second install covers only the Node side
Our clean sandbox installed 172 npm packages in 5 seconds and used 147 MB. The Vite build then succeeded in 3 seconds. Those figures make the web code easy to fetch and compile. They do not include ACE-Step's Python environment, model weights, CUDA setup, FFmpeg, or a generated song. The README says the Windows portable package and automatic first-run models are each about 5 GB, so the complete workstation is much larger than our measured Node dependency tree.
Hardware also decides which controls are realistic. The README lists an NVIDIA GPU with at least 4 GB of VRAM for operation without the language model and recommends 12 GB when that model is enabled. PT is the default backend, while its table assigns about 1.6 GB of VRAM to PT and about 9.2 GB to VLLM. Batch size defaults to 1 for broad GPU compatibility. Open issue 16 remains a request for Vulkan or ROCm, so AMD users do not get an equivalent documented route here.
What happened when we ran it
In our sandbox, installation succeeded in 5 seconds with 172 packages, and the build finished in 3 seconds. The installed packages occupied 147 MB. Npm audit reported 13 known vulnerabilities: 1 critical, 9 high, 2 moderate, and 1 low. The measurement describes commit a1fdf91 in a fresh unprivileged container with 3 CPUs and 8 GB of RAM. It does not say that the separate music model started or that a GPU generation completed.
The repository had 209 files and no CI workflow, Dockerfile, or tests directory. Its package files contain build, development, database, and storage commands, but no tests script or target for our harness to run. We therefore skipped tests instead of recording a pass. A production-minded fork needs checks for request mapping, database migrations, media paths, queue behavior, and Gradio responses. Those are precisely the seams described in current user reports.
Gradio failure sends jobs through a second execution path
The server first tries ACE-Step through Gradio, then falls back to spawning a bundled Python script. Open issue 87 shows a running API returning 404 for configuration endpoints, after which every request falls back to Python. Issue 61 reports a slider value arriving as a boolean, the fallback producing audio, and an unhandled training call then killing the Node process. These are user reports from specific installations, but the source confirms that both Gradio and Python execution paths exist.
Two paths sound reassuring until they disagree about parameters, environments, or output locations. The Python route searches several virtual-environment directory names and has a 600-second timeout. Setup scripts place ACE-Step beside the UI and write an ACESTEP_PATH, while issue 76 documents a Linux install that still looked for Python and output beneath the UI directory. If you adopt the project, test the exact ACE-Step commit you will use and verify that every visible control reaches both paths with the same value.
LAN access is a convenience, not an internet deployment plan
The README advertises ports 3000 and 3001 for LAN use. Its sample server environment sets JWT_SECRET to ace-step-ui-local-secret, and the source describes the 365-day token as simplified local session management. That is acceptable context for a trusted personal machine. It is a poor basis for forwarding the app through a public router. Uploaded references, generated songs, user accounts, and model controls deserve stronger authentication before anyone outside the household can reach them.
The project also has a licensing mismatch that businesses should settle before reuse. The README displays an MIT badge and says the project is MIT licensed, yet commit a1fdf91 contains no LICENSE file and GitHub returns no detected license. A sentence in documentation does not provide the full grant and conditions that a standard license file would. Ask the maintainer to add the intended text before distributing a modified version or building a service around it.
June code and September reports point in different directions
GitHub showed 4,924 stars and 56 combined open issues and pull requests. The default branch was last pushed on June 27, 2026, and GitHub returned no latest release. Issue and pull-request activity continued into September, including compatibility reports and proposed fixes, but that did not move the default branch after June. The queue also contains many posts unrelated to software support, which makes the raw open count a weak proxy for maintained bug triage.
ACE-Step UI earns a trial for someone who already has ACE-Step running and wants a better library around it. Our 3-second build shows the browser layer is approachable. The 13 audit findings, missing test target, split execution paths, and absent license file make it harder to recommend as a dependable shared service. Keep it local, pin both repositories, and prove one complete generation workflow before spending time on playlists, videos, or training.