ACE-Step 1.5: Make Full Songs With Vocals Locally (GitHub, Scanned)

ACE-Step 1.5 generates complete songs, vocals included, from a text description and optional lyrics. A language model plans the song (structure, lyrics, BPM, key and captions) and a diffusion transformer renders the audio, from 10 seconds to 10 minutes long, with lyrics in more than 50 languages. Beyond text to music it can make covers from existing audio, repaint one section, separate stems, add accompaniment to a vocal track, and train a LoRA on your own songs, which the README puts at 8 songs and about an hour on an RTX 3090.

The selling point is speed on ordinary hardware: under 10 seconds per song on an RTX 3090 by the README's numbers, with the 2B turbo model fitting in under 6 GB of VRAM through quantization and CPU offload, and support for NVIDIA, AMD, Intel and Apple Silicon. The authors place its quality between Suno v4.5 and v5, which is their own claim rather than an independent test. A 4B XL series added in April 2026 raises quality on GPUs with 12 GB or more.

It is co-led by ACE Studio and StepFun, MIT-licensed along with its model weights, and has about 13,000 stars; YouTube walkthroughs present it as a free, local Suno alternative. It ships a Gradio web UI, a REST API and a CLI, and a separate VST3 plugin brings it into music software.

• Repository: github.com/ace-step/ACE-Step-1.5
• Licence: MIT (MIT License)
• Language: Python. Stars: 13K. Forks: 1,670. Last push: Oct 1, 2026.
• Scan: safe, Aug 29, 2026, commit ca1e85f

Who it is for

Musicians, producers and video creators who want backing tracks or song drafts without a subscription, and developers building music features who need a model they can run and fine-tune themselves.

Getting started

1. Install uv (Windows: the README has a PowerShell line)

curl -LsSf https://astral.sh/uv/install.sh | sh

2. Clone the repository and install

git clone https://github.com/ACE-Step/ACE-Step-1.5.git && cd ACE-Step-1.5 && uv sync

3. Start the web UI; models download on first run (uv run acestep-api starts the REST API on port 8001)

uv run acestep

4. Open it in your browser

open http://localhost:7860

Python 3.11 or 3.12 is required, and the first launch downloads several gigabytes of model weights. The UI picks a model and offload settings for your VRAM automatically. Portable Windows and macOS packages with dependencies included are linked from the README, and acemusic.ai offers a hosted version if you have no suitable GPU.

Safety scan

We cloned ace-step/ACE-Step-1.5 at commit ca1e85f on Aug 29, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets and no bare-IP URLs across 1,222 files and about 178,000 lines, mostly Python.
• All 18 pattern hits are the same command: astral.sh's uv installer piped to sh. Two are the actual install in install_uv.sh, which the launch scripts call only after asking Install uv now?; the other 16 are echo lines telling you how to install it yourself. The sudo and shell-profile flags on install_uv.sh come from messages it prints, not commands it runs.
• The 12 installer scripts are the Windows, Linux, macOS and ROCm launchers. They check GitHub for a newer commit at startup and ask before updating (CHECK_UPDATE=false turns this off), and fetch PyTorch wheels from download.pytorch.org. External AI hosts in the code (OpenAI, Anthropic, Z.AI, ElevenLabs) are optional providers for lyric and text tasks and for LoRA data preparation, used only with your keys.
• 134 known advisories (1 critical, 63 high). uv.lock has 104, the critical being anyio 4.12.1 over TLS name checks for internationalised domains. 30 sit in a package-lock.json under .claude/skills, a Node helper for a Claude Code skill that is not part of the music app; the rest are repeats in the requirements files for ROCm and Intel GPUs.
• Four workflows, none using pull_request_target; the 4 third-party actions are pinned to tags. Security policy, CodeQL, licence and contributing guide present; no Dependabot. The latest tagged release, 0.1.8, is from May 2026, while the scanned main branch is from August 29.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 125.3K, Markdown 32.3K, Shell 6,865, JSON 6,129, Batch 4,773, JavaScript 965.

Questions

Is ACE-Step free?

Yes. The code and the published model weights are MIT-licensed, and it runs locally with no account or usage fee. The authors also run acemusic.ai, a hosted version they describe as free, for people without a suitable GPU.

What GPU does ACE-Step 1.5 need?

It runs in as little as 6 GB of VRAM with the 2B turbo model, the planning language model off and CPU offload on. 8 to 16 GB adds the language model; the 4B XL models want 12 GB with offload or 20 GB without. NVIDIA CUDA works best, with AMD ROCm, Intel XPU, Apple Silicon and CPU also supported.

Can I use songs made with ACE-Step commercially?

The MIT licence places no restriction on what you do with the output. The authors ask users to check that generated songs are not too close to existing works, to disclose AI involvement, and to get permission before imitating protected material, and copyright rules for AI-generated music vary by country.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.