spotify-mcp

mcp-name: io.github.jamiew/spotify-mcp

A local Python MCP server for searching Spotify, controlling playback, and managing playlists and Liked Songs from your MCP client. Runs over stdio with your Spotify account. This is a supported fork of varunneal/spotify-mcp.

The TypeScript edition supports local and hosted use, with a different MCP surface.

Setup

Requires Python 3.12+, uv, and Spotify Premium for playback.

1. Create an app in the Spotify developer dashboard.
2. Register http://127.0.0.1:8888 as its redirect URI, exactly as written.
3. Copy the app's Client ID and Client Secret into your MCP client's configuration:

{
  "mcpServers": {
    "spotify": {
      "command": "uvx",
      "args": ["spotify-mcp-jamiew"],
      "env": {
        "SPOTIFY_CLIENT_ID": "your_client_id",
        "SPOTIFY_CLIENT_SECRET": "your_client_secret",
        "SPOTIFY_REDIRECT_URI": "http://127.0.0.1:8888"
      }
    }
  }
}

Restart the client. On first use, a browser opens for Spotify authorization; the token is cached locally. Keep the client secret and token cache private. Playback needs an available Spotify Connect device, so open Spotify on the device you want to control.

Client-specific setup: Claude Desktop, Claude Code, and Codex. Use the same command and environment variables in each client's format.

Run from source

The package command above uses the published package, which may lag this README's source changes. To run the current checkout:

git clone https://github.com/jamiew/spotify-mcp.git
cd spotify-mcp
uv sync

In the config above, change command to uv and args to ["--directory", "/absolute/path/to/spotify-mcp", "run", "spotify-mcp"]. Keep the same environment variables. Without cloning, use uvx --from git+https://github.com/jamiew/spotify-mcp.git spotify-mcp.

Reauthorization: artist-follow checks need user-follow-read. Existing grants do not receive new scopes automatically. Restart and complete Spotify authorization when prompted; if access is still denied, review the app's grant in your Spotify account and reauthorize. Do not automatically delete the auth cache.

Features

28 tools, six resources (user, playback, track, playlist, artist, album), and five prompts. Tools provide typed outputs and behavior annotations; large playlist reads report progress. Playlist removal asks for confirmation where supported, reordering uses snapshot guards, and playback control attempts best-effort read-after-write confirmation, not guaranteed success.

Tools

Behavior to know

• New playlists default to private. Existing playlists are unchanged. Spotify can report unexpected visibility, so confirm sensitive playlists in the Spotify app.
• Track saves/removals and track/artist membership checks accept 50 items, sent upstream in batches of 40. Album checks accept 20. Membership results preserve input alignment; incomplete chunks fail. Writes are not atomic across chunks: earlier changes may remain after an error. Check membership before retrying.
• Restricted apps cap search pages at 10. Advance by the returned offset + limit, not the requested size. Individual-track fallback can make up to 50 Spotify requests.
• Playlist pagination counts positions, including unresolved rows and local files with id: null. Local files also set is_local; positions remain valid for reordering.

Spotify access and policy

• Permissions and app access mode determine available endpoints and playlist access. A 403 may mean missing permission, not a retired endpoint. Existing integrations' February restrictions were postponed; restricted apps use the February 2026 API routes.
• Development Mode normally allows five allowlisted users and requires a Premium app owner; older larger allowlists may be grandfathered. Extended access is not routine hobby-project approval: criteria include an organization, a legal entity, a launched service, and 250,000 monthly active users. A public URL does not remove these limits.
• All Development Mode apps on a developer account share one quota, even with the 25 permitted Client IDs. This server surfaces 429 errors without retries, including QUOTA_EXCEEDED and ordinary rate limits with Retry-After when provided. No guaranteed quota reset time is specified.
• This server uses one local identity. Do not share its token cache or expose it as an unauthenticated public service. Other users should self-host and authorize their own accounts.
• AI policy is a separate constraint. Spotify Developer Policy III.14 restricts training or otherwise ingesting Spotify Content into AI/ML models; "no training" or "metadata only" is not automatic clearance. III.13 restricts analysis and derived metrics; III.3 restricts voice-control assistants. Seek Spotify clarification or approval before public AI access. This is a risk notice, not legal advice or permission.

Moving between implementations

Shared versions and tool names do not imply drop-in compatibility with other implementations. Check arguments, limits, and result shapes before switching. Preserve any workflow that relies on this server's resources, five prompts, snapshot guards, removal confirmation, or playback confirmation; those behaviors are not universal.

Credits

MIT license, copyright 2025 Varun Neal Srivastava. Thanks to @varunneal for the original project, @jamiew, @jonico, @tedeuxx, and @karimStekelenburg.

Banner made with Glif.