Spotify Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Spotify Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Control Spotify playback through Claude using the Model Context Protocol (MCP).
Uses PKCE authentication - just install and authorize your Spotify account.
Note: The bundled client ID works for playback control and reading data. For write operations (adding to playlists, saving to library), you'll need to set up your own Spotify app.
git clone https://github.com/panuhen/spotify-mcp.git ~/spotify-mcp
cd ~/spotify-mcp
python -m venv .venv
.venv/bin/pip install -e .Run once to authorize with your Spotify account:
~/spotify-mcp/.venv/bin/spotify-mcpThis opens your browser for Spotify login. After authorizing, the token is cached at ~/.spotify-mcp-token.
Add to ~/.mcp.json:
{
"mcpServers": {
"spotify": {
"command": "/home/YOUR_USER/spotify-mcp/.venv/bin/spotify-mcp"
}
}
}Then enable in ~/.claude/settings.local.json:
{
"enabledMcpjsonServers": ["spotify"]
}Restart Claude Code and you're ready!
play - Resume or play specific track/album/playlistpause - Pause playbacknext - Skip to next trackprevious - Go to previous trackseek - Seek to position in trackset_volume - Set volume (0-100)shuffle - Toggle shuffle moderepeat - Set repeat mode (off/track/context)get_current_track - Get currently playing track infoget_playback_state - Get full playback stateget_queue - Get upcoming tracksget_devices - List available devicessearch - Search for tracks, albums, artists, playlistsadd_to_queue - Add track to queueget_playlists - List your playlistsget_playlist_tracks - Get tracks from a playlistadd_to_playlist - Add tracks to a playlist (requires own app)save_tracks - Save tracks to your library (requires own app)remove_saved_tracks - Remove tracks from library (requires own app)get_saved_tracks - Get your liked tracksNo Spotify API permissions needed - stored locally in ~/.spotify-mcp-favorites.json:
favorite_current - Add currently playing track to favoritesget_favorites - List all favorited tracksremove_favorite - Remove a track from favoritesplay_favorites - Play random favorite or queue all favoritesclear_favorites - Clear all favoritesOnce configured, you can ask Claude:
Required for: add_to_playlist, save_tracks, remove_saved_tracks
The bundled client ID is in Spotify's Development Mode, which restricts write operations. To use all features:
http://127.0.0.1:8888/callback~/spotify-mcp/.env: SPOTIPY_CLIENT_ID=your_client_id_here rm ~/.spotify-mcp-tokenMake sure Spotify is open on at least one device (phone, desktop app, web player).
Delete ~/.spotify-mcp-token and run spotify-mcp again to re-authenticate.
The token auto-refreshes, but if issues persist, delete ~/.spotify-mcp-token and re-auth.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.