Every guitarist has done this: you learn the notes to a song, play it back, and it still doesn't sound like the record. The tab was right. The tone was wrong.
The usual fix is a YouTube tutorial or a forum thread — except those give you settings for someone else's rig. A JCM800 breaks up nowhere near where a Twin does. A bridge humbucker hits the front end differently than a single coil. Copy the knob positions from a video and you get a rough approximation at best.
So we built ToneMirror.
You add your guitar, amp, and pedals once. Then you pick a song, and it gives you a full recipe adapted to what you actually own:
- Amp settings — knob-by-knob, calibrated to your amp's headroom and EQ taper
- Pickup position — bridge, neck, in between
- Pedal config — which to engage, in what order, at what settings. Don't own the same overdrive? It maps to the closest thing on your board
- Technique notes — pick attack, palm muting, where on the string to play
- Match confidence — an honest score for how close your gear can realistically get
The library currently has thousands of songs across rock, metal, blues, indie, country, funk, and jazz.
Part of it is open source — repo here:
→ github.com/tonemirror/ToneMirror
If you've got a rig that trips it up, an amp model that's missing, or a tone you want added, that's what the discussions board is for:
Genuinely curious what breaks. Especially interested in hearing from anyone running modelers or unusual pickup configs.
Top comments (1)
"Any song, any rig" is a bold matching claim — and outputting actual amp settings and pickup position per guitar (not just a generic EQ curve) is what makes it credible.
One finding from a quick header scan of tonemirror.so: HSTS is set with a strong max-age — good. Missing are Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. The one I'd close first is CSP: a matching tool lives on user input (song titles, rig descriptions), and if any of that is ever rendered back into the page, an injected payload that slips past escaping executes with full page trust. CSP is the backstop for exactly that.
You're Next.js on Vercel, so it's a
headers()block in next.config.js — no edge config needed. Start CSP in report-only mode so the origins you actually load (analysis libs, embeds, analytics) surface in the violation reports before you enforce.Happy to re-scan once it's live.