Spotify Streamable MCP Server
Spotify music search, playback control, and playlist management for LLMs.
Data last scanned today · Reviewed today
Overview
This server acts as a bridge between LLMs and the Spotify API, enabling voice-based interaction or complex automated workflows for music control. It simplifies direct API interaction by providing an LLM-friendly interface that handles fuzzy search queries and manages playlists through batches to optimize tool usage. Built for modern environments using Bun and Cloudflare Workers, the tool includes support for OAuth 2.1 using PKCE. It provides comprehensive controls, including device switching, track seeking, and library management, while returning specific status messages to confirm actions performed by the AI.
Our verdict
This server carries a high risk level with a security score of 32/100. It is a community-maintained project rather than an official Spotify release, lacks an explicit software license to clarify legal usage, and does not implement a read-only mode, meaning it grants full write access upon installation. It is recommended only for users comfortable managing their own environment security and those aware of the experimental nature of the beta MCP protocol versions utilized.
- Supports OAuth 2.1 with PKCE S256 for authentication.
- Uses a minimal architecture with only four direct dependencies.
- Provides human-readable feedback messages for every tool action.
- Features batch-oriented interfaces to reduce total tool call count.
- High-risk security profile with no official vendor maintenance.
- No detected license leaves legal usage terms undefined.
- Operates on a beta version of the MCP specification.
- Single-contributor project increases the bus-factor risk.
Setup
{
"mcpServers": {
"spotify-streamable-mcp-server": {
"args": [
"-y",
"mcp-spotify"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
Tools
| Tool | Description | Risk |
|---|---|---|
| search_catalog | Search songs, artists, albums, and playlists. | low |
| player_status | Read current player state, devices, queue, and current track. | low |
| spotify_control | Control playback with batch operations. | medium |
| spotify_playlist | Manage playlists. | medium |
| spotify_library | Manage saved tracks. | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›Which runtime environments are supported by this server?
This MCP server is designed for dual runtime support, specifically compatible with both Bun and Cloudflare Workers.
›What is the critical requirement for controlling playback devices?
You must use the exact alphanumeric device_id string provided by the player_status tool; human-readable device names will cause control operations to fail.
›Is this server compatible with the final MCP specification?
No, this repository targets the candidate 2026-07-28 protocol and uses specific beta SDK versions; it should not be described as conforming to the final specification until it is officially published.
›What configuration is required for security and deployment?
Production operators must manually configure settings including public URLs, allowlists, TLS-facing deployment, encrypted storage, rate limits, and Spotify credential management.
›How does the server handle multiple search or control requests?
The server uses a batch-first approach where tools accept arrays for queries and operations to minimize the number of tool calls required.
Badge
Maintain this server? Add the live badge to your README.