A little further with wireshark. You can add a single song to a playlist


One of the keys holding me back was the undocumented "SetClientType" command. If you don't trick the MMS into thinking you are the tunebridge app a bunch of stuff doesn't work correctly. So the clienttype needs to be set to "iOS+Phone". You also have to browsetitles before browsing activties or you get an empty picklist


So a sample string of commands from the intial connection that actually gets me to a point where I can add a single song to a playlist


// initial setup commands
setEncoding "65001"
SetClientType "iOS+Phone"
SetClientVersion "1.2.100"
SetXMLMode "Lists"
SetHost "192.168.1.12"
setoption dummy_all_tracks=false
setoption supports_inputbox=true
BrowseInstances
GetStatus
BrowseUsers
SetActiveUser 3545576b-2170-4c31-a7eb-2dfbd10711e6 ad12cd33-6472-944a-bcf0-bdf8661f388d


//set of commands to add song to playlist
// set the music filter to the GUID of the song so browsetitles only returns that song or you will bog down with all of the songs you have
SetMusicFilter Title=1f8d6fa6-7262-b3ad-04f8-fe2818513d9d
// must call browsetitles or browseactivities will return a non functional pick list
BrowseTitles
// now browse for the possible actions you can take with that song
BrowseActivities 1f8d6fa6-7262-b3ad-04f8-fe2818513d9d // GUID of the song
// pick the action you want from the returned picklist, in this case add song to an existing playlist
AckPickItem 706c6179-0000-0000-0000-706c61796c69 // picklist GUID for add to playlist

this will finally return a functional pick list which lets you select which playlist to add the song to.