# lineupify-mcp Spotify playlists from a festival lineup, a genre, a song, a playlist or a blend. Own client ID. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.6.0 - **Author:** io.github.SHREESHMAN - **License:** MIT - **npm:** lineupify-mcp - **Source:** https://github.com/SHREESHMAN/lineupify - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 31 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-05T12:53:04.227Z - **Version scanned:** 0.4.1 - **CVEs:** none found by OSV at scan time **Findings** - injection-shaped content (note) in the `setup` tool: Links to undeclared domain: 127.0.0.1 - injection-shaped content (note) in the `disconnect` tool: Links to undeclared domain: spotify.com ## Tools 21 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `status` — Call this first. Shows whether Spotify is connected (and as whom), whether setup is needed and the exact steps, default options, drafts in progress, and cache s - `setup` — Save the Spotify client ID (32 hex chars from the app page at developer.spotify.com/dashboard; redirect URI must be http://127.0.0.1:8765/callback) so it is not - `connect` — Start the Spotify login. Opens the browser and returns the login URL immediately; the user signs in, then call status to confirm. Pass clientId to save the Spot - `disconnect` — Forget the saved Spotify login (deletes tokens.json). With purge: true also deletes everything Lineupify keeps on disk: config, caches, drafts and exports. Spot - `parse_lineup` — Turn raw poster text (as read from an image or pasted) into a clean artist list with tiers, days and stages, dropping dates, stage names and "tickets" lines. Op - `create_draft` - `read_playlist` — Read any playlist into a structured list: a Spotify or Deezer link, a playlist name from the user's own library, a draft id, or "library" (liked songs). Views: - `analyze_playlist` — Numbers about a playlist (or "library" / a draft): length, artist concentration, decade spread, explicit share, coarse genres (Deezer) and Last.fm tags when a k - `compare_playlists` — Compare 2-4 sides — playlists (links or names), drafts, "library", or "me" (the user's top and followed artists): artists and identical tracks shared by all, pa - `merge_playlists` — Combine 1-6 Spotify playlists (links or names), drafts or "library" into one ready draft, keeping the actual tracks and removing duplicates (same URI, ISRC or t - `expand_playlist` — Build a draft of more songs by the artists of an existing playlist (default 2 per artist, the 30 most frequent artists), excluding tracks the playlist already h - `refresh_taste` — Build a draft from the user's own top and followed artists (default 2 songs each, 30 artists), skipping everything already in their liked songs. Shortcut for cr - `get_draft` — Show a draft: summary (default), tracks (paged, with stable ids for editing), artists (status per artist), or unresolved (artists that could not be found or mat - `edit_draft` — Apply one or more edits atomically: remove_tracks (by id from get_draft view=tracks), add_track (URI, URL or "Artist - Title"), exclude_artist, set_artist_track - `search_tracks` — Search Spotify (or Deezer, for a Deezer draft or when Spotify is not connected) for a track to add manually. Supports filters like "track:Marea artist:Fred agai - `create_playlist` — Publish a ready draft as a new playlist in the connected Spotify account and return its URL. Requires that the draft was shown to the user (get_draft) or confir - `update_playlist` — Replace the tracks and details of the playlist this draft was published to, so edits made with edit_draft reach Spotify. If the playlist was changed inside Spot - `compare_taste` — Mark each artist in a draft as known (in the user's top artists over the last 4 weeks / 6 months / all time, or followed) or new to them. Optional reorderKnownF - `export_draft` — Return the draft as markdown, CSV, M3U, links (one track URL per line) or text ("Artist - Title" per line). links and text are what playlist transfer tools (Tun - `list_drafts` — List saved drafts, newest first, with status and whether they were published. - `delete_draft` — Delete a draft from disk. The Spotify playlist, if published, is not touched. ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"lineupify\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"lineupify-mcp\"\n ],\n \"env\": {\n \"LASTFM_API_KEY\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `LASTFM_API_KEY` — Lastfm API Key (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 1 credential (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — deletes data; holds an api key. - Floor 52, ceiling 52 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/lineupify-mcp - Install plan: https://forgeregistry.com/api/v1/packages/lineupify-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/lineupify-mcp - HTML page: https://forgeregistry.com/registry/lineupify-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.