The useful shape is the round trip: search for tracks by description, then create the playlist and add the URIs in the same turn, rather than moving between a search UI and a playlist editor. The friction to plan for is authentication — every tool including search needs the OAuth flow completed, and the token expires after an hour, so a long session will ask you to re-authenticate.
An MCP server over the official Spotify Web API for finding music and managing playlists. It uses stdio transport and works with any MCP client. Authentication is OAuth 2.0 against your own Spotify app, driven from inside the conversation.
- Search and lookup: `search_tracks` with a query, a result limit between 1 and 50, and an optional ISO country code to filter by market, and `get_track_details` for one track by ID
- Playlist creation and editing — `create_playlist` with a name, description, public flag and collaborative flag; `edit_playlist` to change any of those afterwards, requiring at least one field to actually change
- Track management: `add_to_playlist` with an array of track URIs and an optional insert position, and `remove_from_playlist` with an optional snapshot ID for version control
- Reading what you have — `list_playlists` and `get_playlist_tracks`, both with limit and offset for paging
- An authentication flow you drive through the tools themselves: `authenticate_spotify` returns the authorization URL, then takes the code back, and `get_auth_status` reports the current state
- Stated limits: access tokens expire after 1 hour and need refreshing, some tracks are unavailable in some markets, and the OAuth scope determines what operations are permitted
A Spotify Developer account and an app created in the Spotify Developer Dashboard, with `http://localhost:8888/callback` added to its redirect URIs. Two environment variables from that app, `SPOTIFY_CLIENT_ID` and `SPOTIFY_CLIENT_SECRET`, set either in the client config or system-wide. Node.js 18 or higher; clone, `npm install`, `npm run build`, then point your client at the built entry point. Everything, including search, requires completing the OAuth flow first: call the authenticate tool for the URL, approve in the browser, and pass the resulting code back. MIT licensed.
