The project states that plainly and it is the single thing that trips people up: the first call validates credentials, runs OAuth if needed, and returns your profile. After that the playlist tools are the strong part — position-aware inserts, range reorders, and snapshot ids so two edits do not silently clobber each other. Playback is Premium-only, so on a free account those four tools are not available to you.
A Node server over the Spotify Web API. It runs the OAuth flow itself, so you supply a client ID and secret rather than hunting for an access token. One tool has to be called before any other work happens.
- The connection established and your profile read, which must happen first — `get_initial_context`
- Playlists listed, created, retitled, and made public, private or collaborative — `get_user_playlists`, `create_playlist`, `update_playlist_details`
- Tracks added at a chosen position, removed, and reordered by range, with a snapshot id for concurrency safety — `add_tracks_to_playlist`, `remove_tracks_from_playlist`, `reorder_playlist_tracks`
- The catalogue searched across tracks, albums, artists, playlists, shows and episodes — `search`
- New releases and Spotify's featured playlists, by country — `get_new_releases`, `get_featured_playlists`
- Your top artists or tracks over roughly 4 weeks, 6 months or a year — `get_user_top_items`
- Audio features per track — danceability, energy, speechiness, acousticness, instrumentalness, liveness, valence and tempo — `get_audio_features`
- Playback, queue and device control, which require Spotify Premium — `get_current_playback`, `playback_control`, `queue_management`, `device_management`
A Spotify account — Premium for playback control — and an app in the Spotify Developer Dashboard. `SPOTIFY_CLIENT_ID`, `SPOTIFY_CLIENT_SECRET` and `SPOTIFY_REDIRECT_URI` are required, and the redirect URI must be `http://127.0.0.1:8000/callback` or another localhost address for the automatic token exchange to work. Node.js 18 or newer; the client launches `npx` with `-y` and `@tdp2003/spotify-mcp@latest`. `SPOTIFY_API_TOKEN` and `SPOTIFY_REFRESH_TOKEN` are produced by the OAuth flow rather than set by hand. `MAX_TOOL_TOKEN_OUTPUT` caps tool response size and defaults to 50000.