
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
@reneturcios/musicport
Advanced tools
Use Spotify from an MCP client: search tracks, albums and artists, control playback, and create and manage playlists through the Spotify Web API. One bin serves a small CLI and a stdio MCP server.
Spotify search, playback and playlists as MCP tools, talking to the Spotify Web API. musicport is a clean-room rebuild of the core surface of community Spotify MCP servers, under a new name: fresh code, no copied branding.
TOKEN-ENV ONLY. The hosted/community OAuth flow
(SPOTIFY_CLIENT_ID / SPOTIFY_CLIENT_SECRET + browser consent +
refresh) is NOT reproduced. Tools use SPOTIFY_ACCESS_TOKEN
directly as Authorization: Bearer.
search, get_current_user_profile, get_playback_state, play,
pause, next_track, previous_track, list_playlists,
get_playlist, create_playlist, add_tracks_to_playlist,
list_saved_tracks.
Not in this subset: OAuth authorization/refresh flow, track/album/artist detail reads beyond search, audio features/analysis, recommendations, shows/episodes/audiobooks, follow/unfollow artists and users, playlist cover images, playlist item removal/reorder depth, library albums/shows, devices listing and transfer playback, queue management, recently played, top items.
Obtain a Spotify access token through your own means and set it:
export SPOTIFY_ACCESS_TOKEN=BQ...
Optionally override the API base with SPOTIFY_API_BASE_URL
(default https://api.spotify.com/v1). Without the token, every
tool call fails with an error naming the missing variable:
SPOTIFY_ACCESS_TOKEN environment variable is required.
npx @reneturcios/musicport search '{"query":"hello"}'
npx @reneturcios/musicport mcp # stdio MCP server
Each tool name is a subcommand taking one JSON object argument.
{
"mcpServers": {
"musicport": {
"command": "npx",
"args": ["-y", "@reneturcios/musicport", "mcp"],
"env": { "SPOTIFY_ACCESS_TOKEN": "BQ..." }
}
}
}
docker run -i -e SPOTIFY_ACCESS_TOKEN ghcr.io/cloudcorprecords/musicport
npm install
npm run build
npm test
MIT
FAQs
Use Spotify from an MCP client: search tracks, albums and artists, control playback, and create and manage playlists through the Spotify Web API. One bin serves a small CLI and a stdio MCP server.
We found that @reneturcios/musicport demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.