@novalux12/spotify-mcp

MCPattested
v3.1.0io.github.NovaLux12MITUpdated 3d agonpmGitHub

Spotify Web API MCP: playback, library, playlists, search, podcasts. Not affiliated with Spotify.

Works in
ClaudeCursorCopilotGemini

Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Attested build
A verified provenance attestation binds this artifact to the listed repository. Nobody has claimed the listing yet — this proves where the code was built, not who stands behind it.
6kDownloads/wk
1GitHub stars
3d agoLast update
Package
Authorio.github.NovaLux12
LicenseMIT
Version3.1.0
Sourcenpm+mcp-registry
Trust Status
A
85/100Trusted
✓Listed in Forge index+10/10
✓Identity verified · attested build+20/20
—Ed25519 publish signature+0/5
→ Included automatically when the publisher runs `forge publish`
—Domain verification+0/5
→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }
✓npm Trusted Publishing (Sigstore)+5/5
—npm maintainer match+0/5
→ Publisher: add the verified GitHub login to the npm package's maintainers (npm owner add <login>)
✓CVE scan · clean+30/30
✓Static analysis · clean+20/20
Paste into Claude Code, Cursor, or any AI assistant to fix all gaps
StatusIdentity verified
PublisherUnverified
SignatureUnsigned
Domain—
Provenance✓ Sigstore-verified · ec5feef
Dependencies✓ 60 resolved+ · none vulnerable
Tool surface40 tools · 1 privileged
Security scan✓ Cleanv3.1.0 · todayHow well does this scan work?
EvalsNone
IndexedAug 26, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

40 tools · 1 privileged
Statically extracted from the published packagev3.1.0 · 2h ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

list_accountsList every local account this server can act as, and which one it is acting as now.

List every local account this server can act as, and which one it is acting as now.

No input schema was published for this tool.

switch_accountChange which registered account this session acts as. Takes effect for every subsequent call

Change which registered account this session acts as. Takes effect for every subsequent call

No input schema was published for this tool.

listening_streaksCompute consecutive-day listening streaks from recently-played history (up to 150 items, or max_items if lower). Quota: GET /me/player/recently-played cursor walk, one call per 50 items.

Compute consecutive-day listening streaks from recently-played history (up to 150 items, or max_items if lower). Quota: GET /me/player/recently-played cursor walk, one call per 50 items.

No input schema was published for this tool.

top_artists_by_rangeTop artists per time window; with time_range 'all' (default) also reports short_term↔long_term rank deltas for artists present in both. Quota: up to 3× GET /me/top/artists.

Top artists per time window; with time_range 'all' (default) also reports short_term↔long_term rank deltas for artists present in both. Quota: up to 3× GET /me/top/artists.

No input schema was published for this tool.

taste_shift_reportCompare short_term vs long_term top artists+tracks: rising/falling + Jaccard similarity, null when both windows of a domain are empty (not enough data). Quota: 4× GET /me/top/*.

Compare short_term vs long_term top artists+tracks: rising/falling + Jaccard similarity, null when both windows of a domain are empty (not enough data). Quota: 4× GET /me/top/*.

No input schema was published for this tool.

listening_reportAggregate listening report: compares your top tracks between two time windows (rising / constant / fading), plus era histogram, discovery ratio, repeat overlap with recently played, and hour-of-day buckets

Aggregate listening report: compares your top tracks between two time windows (rising / constant / fading), plus era histogram, discovery ratio, repeat overlap with recently played, and hour-of-day buckets

No input schema was published for this tool.

verify_receiptNo description published

This tool published no description. Forge does not invent one.

get_artist_discographyGet filtered discography for an artist (GET /artists/{id}/albums with album-type filtering)

Get filtered discography for an artist (GET /artists/{id}/albums with album-type filtering)

No input schema was published for this tool.

resolve_artistResolve an artist name or URI to a Spotify artist ID via search

Resolve an artist name or URI to a Spotify artist ID via search

No input schema was published for this tool.

save_artist_new_releasesFind new releases for an artist and save unsaved albums to Your Library (diffs against /me/library/contains)

Find new releases for an artist and save unsaved albums to Your Library (diffs against /me/library/contains)

No input schema was published for this tool.

watch_artistsAdd artists to a watchlist sidecar for new-release polling. File ~/.spotify-mcp/artist-watchlist.json (SPOTIFY_MCP_DATA_DIR overrides); a failed write is reported, not swallowed.

Add artists to a watchlist sidecar for new-release polling. File ~/.spotify-mcp/artist-watchlist.json (SPOTIFY_MCP_DATA_DIR overrides); a failed write is reported, not swallowed.

No input schema was published for this tool.

check_artist_releasesCheck watched artists for new releases since last check (or within lookback_days).

Check watched artists for new releases since last check (or within lookback_days).

No input schema was published for this tool.

artist_release_digestShow a digest of new releases since the last check for a watchlist.

Show a digest of new releases since the last check for a watchlist.

No input schema was published for this tool.

list_all_chaptersList every chapter of an audiobook in one table (index, name, duration, resume point). Walks all pages of the chapters endpoint, unlike the ~18-chapter app limit, but stops at the fetch-all cap: a capped result is a PREFIX of the book, flagged truncated_by_cap=true.

List every chapter of an audiobook in one table (index, name, duration, resume point). Walks all pages of the chapters endpoint, unlike the ~18-chapter app limit, but stops at the fetch-all cap: a capped result is a PREFIX of the book, flagged truncated_by_cap=true.

No input schema was published for this tool.

jump_to_chapterStart playing a specific audiobook chapter (1-based number) by resuming the audiobook context at that chapter. Use dry_run to preview without touching playback.

Start playing a specific audiobook chapter (1-based number) by resuming the audiobook context at that chapter. Use dry_run to preview without touching playback.

No input schema was published for this tool.

where_was_iOrient yourself in an audiobook: matches current playback against the fetched chapter list (fetch-all cap may bound it) and reports which chapter you are on, how far into it, and how much listening time is left in that fetched prefix.

Orient yourself in an audiobook: matches current playback against the fetched chapter list (fetch-all cap may bound it) and reports which chapter you are on, how far into it, and how much listening time is left in that fetched prefix.

No input schema was published for this tool.

get_audiobookNo description published

This tool published no description. Forge does not invent one.

get_audiobook_chaptersNo description published

This tool published no description. Forge does not invent one.

get_chapterNo description published

This tool published no description. Forge does not invent one.

get_saved_audiobooksList the audiobooks saved in the current user's Spotify library. Requires the user-library-read scope.

List the audiobooks saved in the current user's Spotify library. Requires the user-library-read scope.

No input schema was published for this tool.

clean_backup_artifactsDelete the NON-library files sharing SPOTIFY_MCP_BACKUP_DIR with your library backups: closed listening sessions

Delete the NON-library files sharing SPOTIFY_MCP_BACKUP_DIR with your library backups: closed listening sessions

No input schema was published for this tool.

delete_backupprivilegedDelete one library backup file (and its metadata sidecar) from SPOTIFY_MCP_BACKUP_DIR. Irreversible — the library rows in the file cannot be recovered from anywhere else. Destructive and confirmation-gated: dry_run defaults to true, and executing is refused when the client cannot prompt (SPOTIFY_MC…

Delete one library backup file (and its metadata sidecar) from SPOTIFY_MCP_BACKUP_DIR. Irreversible — the library rows in the file cannot be recovered from anywhere else. Destructive and confirmation-gated: dry_run defaults to true, and executing is refused when the client cannot prompt (SPOTIFY_MC…

No input schema was published for this tool.

backup_librarySnapshot your ENTIRE library to a local JSON file (read-only against Spotify): liked tracks, saved albums/shows/episodes/audiobooks, followed artists, and every playlist with its items. Walks capped at SPOTIFY_MCP_FETCH_ALL_CAP (500/category) and each playlist at SPOTIFY_MCP_PLAYLIST_ITEMS_CAP (500…

Snapshot your ENTIRE library to a local JSON file (read-only against Spotify): liked tracks, saved albums/shows/episodes/audiobooks, followed artists, and every playlist with its items. Walks capped at SPOTIFY_MCP_FETCH_ALL_CAP (500/category) and each playlist at SPOTIFY_MCP_PLAYLIST_ITEMS_CAP (500…

No input schema was published for this tool.

list_backupsList complete and partial library backups (newest first) using bounded metadata sidecar reads, with a bounded prefix fallback for legacy snapshots. Expires snapshots past SPOTIFY_MCP_BACKUP_RETENTION_DAYS (default 30, 0 disables) and reports what it removed, plus the store envelope (dir_bytes, olde…

List complete and partial library backups (newest first) using bounded metadata sidecar reads, with a bounded prefix fallback for legacy snapshots. Expires snapshots past SPOTIFY_MCP_BACKUP_RETENTION_DAYS (default 30, 0 disables) and reports what it removed, plus the store envelope (dir_bytes, olde…

No input schema was published for this tool.

backup_firstCreate a pre-flight library snapshot before a destructive operation. Returns snapshot file path and counts for later restore. Read-only against Spotify.

Create a pre-flight library snapshot before a destructive operation. Returns snapshot file path and counts for later restore. Read-only against Spotify.

No input schema was published for this tool.

get_artist_genresGet genres for an artist (focused view of GET /artists/{id})

Get genres for an artist (focused view of GET /artists/{id})

No input schema was published for this tool.

get_trackGet full details for a track by ID

Get full details for a track by ID

No input schema was published for this tool.

get_artistGet artist info by ID

Get artist info by ID

No input schema was published for this tool.

get_artist_albumsList an artist's albums and singles

List an artist's albums and singles

No input schema was published for this tool.

get_albumGet album details and track list by ID

Get album details and track list by ID

No input schema was published for this tool.

get_album_tracksList the tracks of an album with pagination

List the tracks of an album with pagination

No input schema was published for this tool.

get_showGet full details for a podcast show

Get full details for a podcast show

No input schema was published for this tool.

get_episodeGet full details for a podcast episode

Get full details for a podcast episode

No input schema was published for this tool.

get_meGet the current user's Spotify profile: display name, user ID, and URI. Spotify removed `email`, `country`, `product`, `followers` and `explicit_content` from `GET /me` in February 2026, so on a current registration none of them is returned and this tool omits them rather than reporting a placehold…

Get the current user's Spotify profile: display name, user ID, and URI. Spotify removed `email`, `country`, `product`, `followers` and `explicit_content` from `GET /me` in February 2026, so on a current registration none of them is returned and this tool omits them rather than reporting a placehold…

No input schema was published for this tool.

get_artist_top_tracksGet an artist's ten most-played tracks for a market. Removed by Spotify's February 2026 Web API changes — unavailable for newer app registrations

Get an artist's ten most-played tracks for a market. Removed by Spotify's February 2026 Web API changes — unavailable for newer app registrations

No input schema was published for this tool.

get_available_marketsList the country codes of every market where Spotify is available. Removed by Spotify’s February 2026 Web API changes — unavailable for newer app registrations

List the country codes of every market where Spotify is available. Removed by Spotify’s February 2026 Web API changes — unavailable for newer app registrations

No input schema was published for this tool.

get_several_tracksGet full details for several tracks by ID in a single call (up to 50 per request)

Get full details for several tracks by ID in a single call (up to 50 per request)

No input schema was published for this tool.

get_several_albumsGet full details for several albums by ID in a single call (up to 20 per request)

Get full details for several albums by ID in a single call (up to 20 per request)

No input schema was published for this tool.

get_several_artistsGet full details for several artists by ID in a single call (up to 50 per request)

Get full details for several artists by ID in a single call (up to 50 per request)

No input schema was published for this tool.

get_several_episodesGet full details for several podcast episodes by ID in a single call (up to 50 per request)

Get full details for several podcast episodes by ID in a single call (up to 50 per request)

No input schema was published for this tool.

36 of 40 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

Spotify Web API MCP: playback, library, playlists, search, podcasts. Not affiliated with Spotify.

Keywords
mcp
Alternatives
Comparing tool surfaces…

Dependency tree

What one Forge scan resolved from npm metadata on 2026-10-12 — observed resolution, not a publisher declaration.

60 packages resolved · 3 direct · none carrying advisories Resolution stops at depth 4 and 60 packages.

The crawl stopped at the 60-package limit. The rest of the tree was never resolved.

36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)

Declared but not resolved

68 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.

+56 more not listed. The counts by reason above cover all of them.

Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.

Topics

Related in music