Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.epheterson/applemusic-mcp

PYPI · APPLEMUSIC-MCP · SCANNED SEP 20

Apple Music MCP server: playlists, library, catalog, playback and Up Next, on Mac/Windows/Linux.

Available components

+1 this week 79 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
  • 4 of 54 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency35
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • License check failed: the license (MIT License) isn't a recognized OSI-approved license. See how to fix → Fail
  • Actively maintained (last published 22 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability69
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 2283 tokens (~285/item across 8 items; 7 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage71
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 0% of tool parameters carry a description.Fail
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Install

How do I install the io.github.epheterson/applemusic-mcp server?

io.github.epheterson/applemusic-mcp runs locally as a PyPI package, launched with uvx applemusic-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · applemusic-mcp

# add to Claude Code
claude mcp add epheterson-applemusic-mcp -- uvx applemusic-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "epheterson-applemusic-mcp": {
      "command": "uvx",
      "args": [
        "applemusic-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "epheterson-applemusic-mcp": {
      "command": "uvx",
      "args": [
        "applemusic-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add epheterson-applemusic-mcp -- uvx applemusic-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "epheterson-applemusic-mcp": {
      "type": "local",
      "command": [
        "uvx",
        "applemusic-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add epheterson-applemusic-mcp --command uvx --arg applemusic-mcp
# ~/.hermes/config.yaml
mcp_servers:
  epheterson-applemusic-mcp:
    command: "uvx"
    args: ["applemusic-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "epheterson-applemusic-mcp": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "applemusic-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add epheterson-applemusic-mcp -t stdio -c uvx -a applemusic-mcp
// mcp.json
{
  "mcpServers": {
    "epheterson-applemusic-mcp": {
      "command": "uvx",
      "args": [
        "applemusic-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 19 Sept 26 0
    • Stability: 0.97 → pass security
  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 −1
    • Stability: pass → 0.93 functional
  • 16 Sept 26 0
    • Stability: 0.97 → pass security
  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 9 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed pypi/applemusic-mcp@0.20.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem pypi

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 54 packages
Packages resolved 54
Stale 3
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 7 exposed · ~2,269 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
catalog ~367

Apple Music catalog. Actions: search, resolve, album_tracks, album_details, song_details, artist_details, genres, suggestions. `search` is discovery: one query in, a ranked list out, for browsing. `resolve` is identification: N identifiers in, N verdicts out, writing nothing — use it (never repeated `search`) to turn a track list into catalog IDs. It routes on which identifier you have: - `resolve(isrcs=...)` — exact, 25 per request. ISRCs come with Spotify/Rekordbox/ Plex exports; this is what keeps a large import under Apple's rate limit. - `resolve(tracks=...)` — titles/artists, fuzzy, reporting how confident each match is so a wrong edition gets caught before it's written. One request per track, so it's capped at 25 (raise with `max_tracks`, not `limit`). Either way the IDs come back ready for `playlist(action="add", track=...)` — or use `playlist(action="add", dry_run=True)` to preview against a specific playlist, which also reports what's already in it.

NameTypeReqDescription
actionstring
albumstring
artiststring
chart_typestring
clean_only
exportstring
formatstring
fullboolean
isrcsstring
limitinteger
max_tracksinteger
offsetinteger
querystring
song_idstring
termstring
tracksstring
typesstring
NameTypeReqDescription
resultstringyes

No examples provided.

config ~199

Config, cache, and authentication. Settings/cache actions: info, set-pref, list-storefronts, audit-log, clear-tracks, clear-exports, clear-audit-log. Auth actions (no terminal needed — just ask): - auth-status (or status): which tokens are active, expiry/auto-renew, what works, next step - signin: open a browser to sign in (any OS) and capture your session - logout: sign out — clears your user token + browser session so you can switch accounts (needs confirm=True) - reset: wipe ALL credentials for a clean slate or to drop a dev token for the web path; keeps your .p8 (needs confirm=True)

NameTypeReqDescription
actionstring
confirmboolean
days_oldinteger
limitinteger
preferencestring
string_valuestring
value
NameTypeReqDescription
resultstringyes

No examples provided.

discover ~98

Personalized discovery. Actions: recommendations, heavy_rotation, personal_station, charts, top_songs, similar_artists, song_station.

NameTypeReqDescription
actionstring
artiststring
chart_typestring
exportstring
formatstring
fullboolean
limitinteger
song_idstring
storefrontstring
NameTypeReqDescription
resultstringyes

No examples provided.

library ~366

Your library. Actions: search, add, recently_played, recently_added, browse, favorites (macOS), rate, remove, snapshot (macOS). action='search' searches the user's local library only — for catalog (Apple Music's full library) use catalog(action='search'). For search, types can be 'songs' (default), 'artists', 'albums', 'all', or 'genre' — types='genre' lists the user's own tracks whose genre matches query (e.g. query='Rock'); genre filtering is macOS-only (local Music app). Search returns one page: limit (default 25) caps results and offset pages through larger result sets — the text header shows 'start-end of total' so you know when more remain. action='favorites' lists songs marked Favorite (loved) in Music.app. action='add' adds catalog tracks/albums to your library over the API (developer token — generated or harvested — plus a media-user-token from `signin`); there is no UI-automation fallback. In api mode, search/browse read via the API and love/dislike rate via the API; star ratings (rate get/set) need native mode (local Music.app).

NameTypeReqDescription
actionstring
albumstring
artiststring
clean_only
exportstring
fetch_explicit
formatstring
fullboolean
item_typestring
limitinteger
offsetinteger
querystring
rate_actionstring
starsinteger
trackstring
typesstring
NameTypeReqDescription
resultstringyes

No examples provided.

playback ~320

Playback transport. play/control/now_playing/settings run on the engine the `mode` preference resolves to — native Music.app (macOS), the Safari web player (macOS), or the Chrome web player (any OS). Override it for ONE call with `engine=`: 'native', 'safari', 'chrome', 'web' (the web engine — Safari on macOS, Chrome off-mac), or 'auto'. control/now_playing follow whichever engine is actively playing (so after a Safari queue, pause/next reach Safari). Safari needs a signed-in Safari + "Allow JavaScript from Apple Events"; Chrome needs a signed-in Chrome (`applemusic-mcp login`) + a desktop session. reveal and airplay are macOS-only. For the Up Next queue, use the separate `queue` tool. Actions: play, control, now_playing, settings, reveal, airplay.

NameTypeReqDescription
actionstring
add_to_libraryboolean
albumstring
artiststring
controlstring
device_namestring
enginestring
playliststring
repeatstring
reveal
secondsnumber
shuffleboolean
shuffle_modestring
trackstring
track_namestring
urlstring
volumeinteger
NameTypeReqDescription
resultstringyes

No examples provided.

playlist ~557

Playlist and folder operations. Actions: list, folders (macOS — show the folder tree; folders are NOT in `list`), tracks, search, create, add, copy, move, path (macOS), remove, delete, rename. (move/remove/delete/rename work on every OS — via Music.app on macOS, via the web API on Windows/Linux. Only folders/path are macOS-only.) To find a playlist by name, use action='list' with filter='jack' (loose name match) rather than action='search', which searches the TRACKS inside a given playlist and needs a playlist param. Folders support slash-separated paths (e.g. 'Summer/Chill/Deep'). For action='add', `track` accepts a song NAME, a catalog song id (a numeric id like '1440857781' — pins the EXACT edition, avoiding name/album version mismatches), or a library id; set auto_add=True to find tracks not already in the user's library — this is required to add catalog songs the user doesn't own. Note: adding a not-yet-owned catalog track to a Music.app-made playlist is two-step — it's added to the library over the API, then attached locally once iCloud syncs it down (usually seconds). If the sync is slow it may return "added to your library — re-run to attach"; just re-run the same add. Rarely, if the sync stalls past ~20s, Music.app briefly flashes to the foreground as a last-resort sync nudge — expected, not a glitch. To SWAP one track for another, use action='add' with `replace`=<the old track to remove>: it adds the new track, confirms it actually persisted, and only THEN removes the old one — so if the add silently reverts (a Music.app bug), the old track is kept rather than lost.

NameTypeReqDescription
actionstring
albumstring
allow_duplicatesboolean
artiststring
auto_add
descriptionstring
dry_runboolean
exportstring
fetch_explicit
filterstring
folderstring
formatstring
fullboolean
limitinteger
namestring
new_namestring
offsetinteger
playliststring
querystring
replacestring
sourcestring
trackstring
verifyboolean
NameTypeReqDescription
resultstringyes

No examples provided.

queue ~362

The Up Next play queue — the web player's own MusicKit state (the same Up Next you see in the player). It runs on a web engine: Safari on macOS (no Chrome needed) or Chrome elsewhere, picked by your `mode` (auto/safari/chrome) or a per-call `engine=` ('safari' | 'chrome'). Using the queue makes it the active playback engine, so transport controls reach it. Native (Music.app) mode has no Up Next — set mode to safari/chrome or pass engine='safari'. Actions: - `list` — show Up Next (▶ marks the current item; indices are 0-based) - `set` — replace the whole queue in order, one call (`track`=comma/newline-separated ids or names) - `play_next` — insert a track right after the current one (`track`=name or catalog id, optional `artist`) - `play_last` — append a track to the end of Up Next - `remove` — remove the item at `index` (can't remove the currently-playing item — jump away first) - `clear` — empty the queue - `jump` — jump playback to a track: by `track` (name or catalog id — drift-proof, preferred since Up Next auto-advances) or by `index` - `autoplay` — set Autoplay (∞: keep playing similar music when the queue ends); pass `enabled=true` or `enabled=false` (required)

NameTypeReqDescription
actionstring
artiststring
enabled
enginestring
indexinteger
trackstring
NameTypeReqDescription
resultstringyes

No examples provided.

Common questions

What is the io.github.epheterson/applemusic-mcp server?

io.github.epheterson/applemusic-mcp is listed in the public MCP registry as io.github.epheterson/applemusic-mcp. Apple Music MCP server: playlists, library, catalog, playback and Up Next, on Mac/Windows/Linux. This page covers its PyPI package (applemusic-mcp).

Is the io.github.epheterson/applemusic-mcp server safe to use?

io.github.epheterson/applemusic-mcp scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.epheterson/applemusic-mcp server expose?

io.github.epheterson/applemusic-mcp exposes 7 tools: playlist, library, discover, catalog, config, and 2 more. Their descriptions and schemas cost roughly 2,269 tokens of context every time the server is loaded.

Is the io.github.epheterson/applemusic-mcp server still maintained?

io.github.epheterson/applemusic-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.