M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
S

Spotify Streamable MCP Server

Community
MCP server for Spotify—search music, control playback, manage playlists and saved tracks.
How to install ↓ Compare GitHub source repository ↗
Category
Other #64 of 230
Stars
★ 80 Popular
Transport
Streamable HTTP
Runtime
Bun · Node.js
Credentials
API key / credential required
License
MIT
Last commit
Tools
5
61FMRS · C

This server provides a practical MCP integration for Spotify with batch operations and clear feedback. However, note that it targets a candidate MCP version and requires careful handling of OAuth and security configuration.

Strongest · Documentation 17/20 Weakest · Reliability 8/20

Reliability
8/20
Security and permissions
14/20
Maintenance
9/20
Documentation
17/20
Setup experience
13/20
Why each score
Reliability 8/20
Only the README and repository metadata were supplied; no source tree, CI workflows, test files, or runtime logs were available for verification. The README describes six tools and startup commands, and honestly warns that the project targets the 2026-07-28 candidate protocol with pinned beta packages, so it cannot be treated as conforming to the final release. The happy path is plausible but unverified; per static calibration, reliability cannot exceed 12, so 8 is awarded.
Security and permissions 14/20
The README describes a strong security posture: Host/Origin validation, strict CORS, bounded request bodies, opaque Resource Server token mapping, tools that never use the inbound bearer or receive the Spotify refresh token, AES-256-GCM encrypted storage, and OAuth redirect allowlists. No red-line issues such as malware or credential theft are evident. However, the implementation cannot be verified without source; MCP_REQUIRED_SCOPES is empty by default, and tokens are stored in plaintext when no encryption key is configured. These deductions yield 14.
Maintenance 9/20
Metadata shows 80 stars, zero open issues, and not archived, while the README claims an MIT license but the metadata lists license as unknown. No commit history, releases, dependency-update evidence, security-response channel, or changelog was supplied, and the project pins beta packages. Stars were treated only as a discovery signal, not as evidence. Because governance and versioning cannot be confirmed, the score is 9.
Documentation 17/20
The README is comprehensive and layered: features, quick start, .env example, Spotify Dashboard setup, full input/output schemas for all six tools, a complete example session, HTTP and credential boundaries, Claude Desktop configuration, Cloudflare Workers deployment, development commands, architecture, and troubleshooting. It also discloses candidate-protocol status and remaining credential-only validation gaps. Deductions are made for the lack of separate docs and verifiable CI evidence, plus production details left to operators, giving 17.
Setup experience 13/20
The README gives clear end-to-end steps: bun install, .env configuration, Spotify redirect URIs, bun dev, and a Claude Desktop client config example; Cloudflare Workers deployment is also described step by step. However, the path requires Bun, a Spotify developer account, OAuth callback setup, optional encryption keys, and Worker configuration, making it multi-step and dependent on external services. With no verifiable execution evidence, static calibration caps this at 15; 13 is awarded.

Static review · not runListed 2026-08-07

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkChanges third-party account data

Best for

  • Developers who want to integrate Spotify playback control into AI assistants or workflows
  • Scenarios requiring voice control of music
  • Agents that need batch processing of music searches and playlist operations

Not for

  • Scenarios that require a stable, final MCP protocol version (currently targets candidate)
  • Users who do not want to configure OAuth and Spotify API credentials
  • Developers needing fine-grained access to the full raw Spotify API

Required permissions

  • Read playback state, modify playback control (play, pause, skip, volume, etc.)
  • Read and modify playlists (private, collaborative, public)
  • Read and modify saved tracks in the user library
  • Access current track and device information

Risks and side effects

  • OAuth tokens stored in file or KV; security risk if not encrypted
  • Requires correct device ID; playback control may fail if wrong
  • Playback behavior depends on Spotify account type (free may be limited) and Premium service
  • Since targeting MCP candidate version, protocol compatibility may change over time

Setup

Before you start

Runtime：Bun · Node.js

SPOTIFY_CLIENT_ID required Spotify app client ID from developer.spotify.com/dashboard.
SPOTIFY_CLIENT_SECRET requiredsecret Spotify app client secret from the Spotify Developer Dashboard; secret.
TOKENS_ENC_KEY optionalsecret AES-256-GCM key (32-byte base64url) used by Workers to encrypt tokens; secret. Without it tokens are stored in plaintext.
RS_TOKENS_ENC_KEY optionalsecret Token encryption key used by Bun and the newer Worker binding, equivalent to TOKENS_ENC_KEY; secret.
Other optional settings (12)
PORT optional Port the Bun server listens on, e.g. 3000.
AUTH_ENABLED optional Whether the MCP auth boundary is enabled.
MCP_PUBLIC_URL optional Publicly exposed MCP endpoint, e.g. http://localhost:3000/mcp.
MCP_ALLOWED_HOSTS optional Comma-separated list of allowed Host values.
MCP_ALLOWED_ORIGIN_HOSTNAMES optional Comma-separated list of allowed Origin hostnames.
MCP_LEGACY_MODE optional Legacy protocol mode, e.g. stateless.
MCP_MAX_REQUEST_BYTES optional Maximum request body size, e.g. 1048576.
OAUTH_SCOPES optional OAuth scopes requested from Spotify (playback, playlists, library, etc.).
OAUTH_REDIRECT_URI optional OAuth callback URI that must be registered in the Spotify Dashboard.
OAUTH_REDIRECT_ALLOWLIST optional Allowlist of permitted OAuth redirect URIs.
MCP_REQUIRED_SCOPES optional Optional; required client-record scopes when configured, empty by default.
AUTH_DISCOVERY_URL optional Optional authorization discovery URL for production deployments.
  1. Clone the repository and navigate to the directory.
  2. Run bun install to install dependencies.
  3. Copy .env.example to .env and fill in Spotify client ID/secret, OAuth redirect URIs, etc.
  4. Register redirect URIs in the Spotify Developer Dashboard.
  5. Run bun dev to start the server.
  6. For Claude Desktop, use the provided configuration example.
claude_desktop_config.json 
{
  "mcpServers": {
    "spotify": {
      "command": "bunx",
      "args": [
        "mcp-remote",
        "http://127.0.0.1:3000/mcp",
        "--transport",
        "http-only"
      ],
      "env": {
        "NO_PROXY": "127.0.0.1,localhost"
      }
    }
  }
}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "spotify": {
      "command": "bunx",
      "args": [
        "mcp-remote",
        "http://127.0.0.1:3000/mcp",
        "--transport",
        "http-only"
      ],
      "env": {
        "NO_PROXY": "127.0.0.1,localhost"
      }
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add spotify -e NO_PROXY=127.0.0.1,localhost -- bunx mcp-remote http://127.0.0.1:3000/mcp --transport http-only

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

After running bun dev, the client tool list should show search_catalog, player_status, spotify_control, spotify_playlist, and spotify_library. You can check http://127.0.0.1:3000/health for runtime health, or call player_status in the client to confirm the player and device listing.

Troubleshooting

  1. If "Device not found", check if using device ID instead of name
  2. If "No active device", ensure Spotify is open on a device
  3. If "Unauthorized", redo OAuth flow or check if token expired
  4. If "Rate limited", wait and retry

Things to try

Once connected, you can ask your AI assistant things like:

  • What's playing right now, and which devices are available?
  • Search for the track Come with Me and play it on my MacBook Pro
  • Add the currently playing song to my saved tracks
  • Turn the volume up to 100% and skip to the next song

Tools 5

search_catalog read-only
Search tracks, artists, albums, or playlists.
player_status read-only
Get current player state, devices, queue, and current track.
spotify_control writes
Batch control playback (play, pause, next, previous, seek, volume, shuffle, repeat, transfer, queue).
spotify_playlist writes
Manage playlists (list, get, items, create, update, add/remove items, reorder).
spotify_library writes
Manage saved tracks (get, add, remove, contains).

Use cases

Find music via natural language, e.g., "play the soundtrack from [movie]" or "create a playlist that matches my mood"
Voice control of playback, e.g., "pause" or "next"
Batch manage playlists, such as adding or removing multiple tracks
Check current playback status and device information

Supported clients

Claude Desktop

Listed from the project's documentation, not tested by this site.

Overview

This server provides access to the Spotify API via MCP. It allows AI assistants to search for music, control playback (play, pause, skip, volume, etc.), transfer devices, manage playlists, and save/unsave tracks. It uses OAuth 2.1 proxy for authentication and supports both Bun and Cloudflare Workers runtimes. Note: the repository targets the candidate MCP protocol (2026-07-28) and SDK 2.0.0-beta.5; it is not yet conformant to a final dated release.

Similar servers

BioMCP 75 · B

One binary. One grammar. Evidence from the biomedical sources you already trust.

★ 659 · Tools 11 Compare with this →
Compare with other MCP servers

Source revision d39ada3924db Data synced 2026-10-19 Read the FMRS scoring method