Mcp Spotify Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Spotify Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center" style="display: flex; align-items: center; justify-content: center; gap: 10px;"> <img src="https://upload.wikimedia.org/wikipedia/commons/8/84/Spotify_icon.svg" width="35" height="35"> <h1>MCP Spotify Server</h1> </div>
A lightweight [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that enables AI assistants like Cursor & Claude to control Spotify playback, playlists and manage tokens.
The auth class (previously authTest.ts) allows manual token generation by running the command npm run auth. This process generates an accessToken and refreshToken based on the clientId and clientSecret specified in the spotify-config.json file. The tokens are updated in the configuration file after user confirmation in the browser.
The getAccessToken is a new MCP tool that enables AI clients like Claude, Cursor and VsCode to fetch Spotify tokens programmatically. It uses the clientId and clientSecret from spotify-config.json to generate an accessToken and refreshToken. After user confirm Spotify Authorizationin the browser, the user is redirected back to the AI client, and browser shows a success message via the Redirect URI http://127.0.0.1:8088, the tool updates the spotify-config.json file with the new tokens (accessToken & refreshToken).
The refreshAccessToken is a new MCP tool that enables AI clients like Claude, Cursor and VsCode to refresh the Spotify accessToken programmatically using the refreshToken. It uses the refreshToken from spotify-config.json to generate an newaccessToken without the need for user confirmation in the browser. This MCP tool simplifies token management and integrates seamlessly with MCP workflows and eliminates the need for manual intervention.
You can view 'accessToken' and check its status using ``sh spotify-check-token.sh`` in a terminal prompted in the root of the project.
query (string): The search termtype (string): Type of item to search for (track, album, artist, playlist)limit (number, optional): Maximum number of results to return (10-50)searchSpotify("bohemian rhapsody", "track", 20)getNowPlaying()limit (number, optional): Maximum number of playlists to return (default: 20)offset (number, optional): Index of the first playlist to return (default: 0)getMyPlaylists(10, 0)playlistId (string): The Spotify ID of the playlistlimit (number, optional): Maximum number of tracks to return (default: 100)offset (number, optional): Index of the first track to return (default: 0)getPlaylistTracks("37i9dQZEVXcJZyENOWUFo7")limit (number, optional): A number specifying the maximum number of tracks to return.getRecentlyPlayed({ limit: 10 })uri (string, optional): Spotify URI of the item to play (overrides type and id)type (string, optional): Type of item to play (track, album, artist, playlist)id (string, optional): Spotify ID of the item to playdeviceId (string, optional): ID of the device to play onplayMusic({ uri: "spotify:track:6rqhFgbbKwnb9MLmUQDhG6" })playMusic({ type: "track", id: "6rqhFgbbKwnb9MLmUQDhG6" })deviceId (string, optional): ID of the device to pausepausePlayback()deviceId (string, optional): ID of the deviceskipToNext()deviceId (string, optional): ID of the deviceskipToPrevious()name (string): Name for the new playlistdescription (string, optional): Description for the playlistpublic (boolean, optional): Whether the playlist should be public (default: false)createPlaylist({ name: "Workout Mix", description: "Songs to get pumped up", public: false })playlistId (string): ID of the playlisttrackUris (array): Array of track URIs or IDs to addposition (number, optional): Position to insert tracksaddTracksToPlaylist({ playlistId: "3cEYpjA9oz9GiPac4AsH4n", trackUris: ["spotify:track:4iV5W9uYEdYUVa79Axb7Rh"] })uri (string, optional): Spotify URI of the item to add to queue (overrides type and id)type (string, optional): Type of item to queue (track, album, artist, playlist)id (string, optional): Spotify ID of the item to queuedeviceId (string, optional): ID of the device to queue onaddToQueue({ uri: "spotify:track:6rqhFgbbKwnb9MLmUQDhG6" })addToQueue({ type: "track", id: "6rqhFgbbKwnb9MLmUQDhG6" })git clone https://github.com/JKGzenna/mcp-spotify-server.git
cd mcp-spotify-server
npm i
npm run buildhttp://127.0.0.1:8088/callback) & check the Web Playback SDK and Web API checkboxes.Create a `spotify-config.json` file in the project root (you must copy and modify the provided example):
# Copy the example config file with this command
cp spotify-config.example.json spotify-config.jsonThen edit the ``spotify-config.json`` file with your credentials and redirectUri:
{
"clientId": "your-spotify-clientId",
"clientSecret": "your-spotify-clientSecret",
"redirectUri": "http://127.0.0.1:8088/callback",
"accessToken": "execute_npm_run_auth_to_get_accessToken",
"refreshToken": "execute_npm_run_auth_to_get_resfreshToken"
}The Spotify API uses OAuth 2.0 for authentication, follow these steps to authenticate your application:
npm run authnpm run auth` script will open a browser and go to an Spotify authorization URL that you need to authorize in your browser manually.accessToken and refresToken`.spotify-config.json file, which will now look something like:{
"clientId": "your-spotify-clientId",
"clientSecret": "your-spotify-clientSecret",
"redirectUri": "http://127.0.0.1:8088/callback",
"accessToken": "BQCC4lx...pk2",
"refreshToken": "AQDYbe...jk"
}If detects a valid accessToken when running the ``npm run auth`` command, it will not prompt you to authenticate again, and automatically refresh the accessToken using the existing refreshToken using the ``refreshAccessToken`` tool.
npm run auth, it will automatically refresh the accessToken with the existing refreshToken using the refreshAccessToken tool, the server always will automatically refresh the accessToken when needed, using the refreshAccessToken tool, only if the refreshToken is expired, calls the getAccessToken tool for obtain a new accessToken and refreshToken`, in this case, you will need to confirm the authentication in the browser again.You can view 'accessToken' and check its status using ``sh spotify-check-token.sh`` in a terminal prompted in the root of the project.
To use your MCP server with Claude Desktop, add it to your Claude configuration:
{
"mcpServers": {
"spotify": {
"command": "node",
"args": ["~/../mcp-spotify-server/build/index.js"]
}
}
}For Cursor, go to the MCP tab in `Cursor Settings` (command + shift + J). Add a server with this command:
node path/to/mcp-spotify-server/build/index.jsTo set up your MCP correctly with Cline ensure you have the following file configuration set cline_mcp_settings.json:
{
"mcpServers": {
"spotify": {
"command": "node",
"args": ["~/../mcp-spotify-server/build/index.js"],
"autoApprove": ["getListeningHistory", "getNowPlaying"]
}
}
}You can add additional tools to the auto approval array to run the tools without intervention.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.