
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
@xavifabregat/spotify-mcp
Advanced tools
MCP server to control Spotify conversationally from Claude, Cursor, and other AI clients
Control Spotify by talking to your AI. An MCP server for Claude Desktop, Claude Code, Cursor, and any other MCP client.
You: play something like early Bill Evans AI: ▶ Now playing: "Peace Piece" — Bill Evans · Everybody Digs Bill Evans
You: perfect, queue the whole album and save this one AI: ➕ Queued Everybody Digs Bill Evans · ❤️ Saved "Peace Piece" to your library
Built against the current (post-February-2026) Spotify Web API — many older Spotify MCP servers predate those changes and are partially broken.
npx -y @xavifabregat/spotify-mcp init
The wizard walks you through creating your own (free) Spotify developer app, asks for its Client ID, and opens a browser to connect your account — about 2 minutes total.
Why your own app? Spotify caps third-party apps at a handful of users, so every user
brings their own; the wizard makes that painless. No client secret is involved (PKCE).
Tokens stay in ~/.spotify-mcp/ on your machine and refresh silently.
The one detail that must be exact — your app's Redirect URI:
http://127.0.0.1:8888/callback
Claude Code
claude mcp add -s user spotify -- npx -y @xavifabregat/spotify-mcp
Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json)
or Cursor (~/.cursor/mcp.json):
{
"mcpServers": {
"spotify": {
"command": "npx",
"args": ["-y", "@xavifabregat/spotify-mcp"]
}
}
}
Restart the client and start talking.
| Tool | What it does |
|---|---|
play | Play by free-text query (search → best match → play) or Spotify URI |
playback | pause / resume / next / previous / seek / volume / shuffle / repeat |
now_playing | Current track, progress, device, mode |
queue | Add a track to the queue; show up next |
devices | List devices; transfer playback |
search | Browse tracks/albums/artists/playlists (max 10 per type — API cap) |
get_playlists | List your playlists |
get_playlist_items | Show a playlist's tracks (own/collaborative only — API restriction) |
modify_playlist | Create a playlist; add tracks |
library | Save / remove / check items in your library |
authenticate | Run the Spotify login from inside a conversation |
authenticate tool. The
model relays the fix instead of a stack trace.INVALID_CLIENT: Invalid redirect URI during login — the Redirect URI in your
app settings isn't exactly http://127.0.0.1:8888/callback (localhost is
rejected by Spotify).SPOTIFY_REDIRECT_PORT to a free port and
register the matching redirect URI.npx -y @xavifabregat/spotify-mcp auth to log in
again (e.g. after changing the Client ID).SPOTIFY_CLIENT_ID env var overrides
~/.spotify-mcp/config.json (written by init).git clone https://github.com/XavierFabregat/spotify-mcp.git
cd spotify-mcp
npm install
npm run build
npm run inspect # MCP Inspector against the local build
Layout: src/auth.ts (OAuth PKCE + token store) · src/spotify.ts (typed API
client) · src/tools/ (tool implementations) · src/format.ts (compact output).
MIT © Xavi Fabregat
FAQs
MCP server to control Spotify conversationally from Claude, Cursor, and other AI clients
We found that @xavifabregat/spotify-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.