Spotify Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Spotify Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that provides tools for interacting with the Spotify Web API.
npm installhttp://127.0.0.1:8888/callback to the Redirect URIs (or http://localhost:8888/callback) cp .env.example .envEdit .env and add your Spotify credentials:
SPOTIFY_CLIENT_ID=your_client_id_here
SPOTIFY_CLIENT_SECRET=your_client_secret_here
SPOTIFY_REDIRECT_URI=http://127.0.0.1:8888/callback
SPOTIFY_PERSIST_TOKENS=false npm run buildnpm startFor development with auto-reload:
npm run dev#### Authentication Tools
spotify_auth_url: Generate OAuth authorization URLspotify_exchange_code: Exchange authorization code for tokensspotify_set_tokens: Manually set access tokensspotify_refresh_token: Refresh the access token#### Search Tools
spotify_search: Search for content on Spotify#### Content Tools
spotify_get_track: Get track detailsspotify_get_artist: Get artist detailsspotify_get_album: Get album detailsspotify_get_playlist: Get playlist details#### Playback Control Tools
spotify_play: Start or resume playbackspotify_pause: Pause playbackspotify_next: Skip to next trackspotify_previous: Skip to previous trackspotify_seek: Seek to position in trackspotify_set_volume: Set playback volumespotify_get_playback_state: Get current playback statespotify_get_devices: Get available devicesspotify_transfer_playback: Transfer playback to another devicespotify_toggle_shuffle: Toggle shuffle modespotify_set_repeat: Set repeat mode (track/context/off)spotify_auth_url to generate an authorization URL with desired scopesspotify_exchange_code with the code and state from the callbackImportant for WSL Users: The callback URL (http://127.0.0.1:8888/callback) won't automatically open in WSL. After authorizing in your browser, you'll be redirected to a URL that may not load. Copy the entire URL from your browser's address bar and paste it back to the LLM to complete the authentication process.
By default, authentication tokens are stored only in memory and will be lost when the server restarts. To enable persistent token storage:
SPOTIFY_PERSIST_TOKENS=true~/.spotify-mcp-tokens.json)Security Note: Tokens are stored in plaintext in your home directory. Only enable persistence if you trust the security of your system.
Add the server to your Claude Desktop configuration:
{
"mcpServers": {
"spotify": {
"command": "node",
"args": ["/path/to/spotify-mcp/dist/index.js"],
"env": {
"SPOTIFY_CLIENT_ID": "your_client_id",
"SPOTIFY_CLIENT_SECRET": "your_client_secret",
"SPOTIFY_REDIRECT_URI": "http://127.0.0.1:8888/callback",
"SPOTIFY_PERSIST_TOKENS": "false"
}
}
}
}When using Claude CLI, configure the MCP server with the built JavaScript file:
claude mcp add spotify node /path/to/spotify-mcp/dist/index.jsImportant: Make sure to use the compiled JavaScript file from the dist/ directory, not the TypeScript source. The server requires Node.js to run and will automatically load environment variables from the .env file in the project root.
Different features require different OAuth scopes:
user-modify-playback-state, user-read-playback-stateuser-read-private, user-read-emailuser-library-read, user-library-modifyplaylist-read-private, playlist-modify-public, playlist-modify-privatespotify-mcp/
├── src/
│ ├── index.ts # Main server implementation
│ ├── auth.ts # OAuth authentication logic
│ └── playback-tools.ts # Playback control tools
├── dist/ # Compiled JavaScript
├── package.json
├── tsconfig.json
└── README.mdnpm run buildThe server uses stdio transport for communication with MCP clients. You can test it using any MCP-compatible client.
ISC
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.