# io.github.XavierFabregat/spotify-mcp (npm · @xavifabregat/spotify-mcp)

Conversational Spotify control from AI clients: play, queue, devices, playlists, and library.

- Trust score: 68/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@xavifabregat/spotify-mcp`: 68/100 (this document), [markdown](https://verifymcp.io/servers/xavierfabregat-spotify-mcp/xavifabregat-spotify-mcp.md), [page](https://verifymcp.io/servers/xavierfabregat-spotify-mcp/xavifabregat-spotify-mcp)

## Channel facts

- Registry: `npm`
- Package: `@xavifabregat/spotify-mcp`
- Version: `0.1.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (106 of 110), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 32 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 824 tokens (~74/item across 11 items; 11 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 93/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 79% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add xavierfabregat-spotify-mcp -- npx -y @xavifabregat/spotify-mcp
```

### Codex

```bash
codex mcp add xavierfabregat-spotify-mcp -- npx -y @xavifabregat/spotify-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "xavierfabregat-spotify-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@xavifabregat/spotify-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add xavierfabregat-spotify-mcp --command npx --arg -y --arg @xavifabregat/spotify-mcp
```

### Hermes

```yaml
mcp_servers:
  xavierfabregat-spotify-mcp:
    command: "npx"
    args: ["-y", "@xavifabregat/spotify-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "xavierfabregat-spotify-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@xavifabregat/spotify-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 68, −1)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-03 (score 69, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 65, +40)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 25, +5)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 20, −25)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (11)

### `authenticate` (~44 tokens)

Connect Spotify account

Connects the user's Spotify account via OAuth. Opens a browser on this machine for approval and stores tokens locally. Use when other tools report you are not authenticated, or to switch accounts.

### `play` (~146 tokens)

Play music

Plays music by free-text query (searches and starts the best match) or by Spotify URI. Handles "play some Radiohead", "play the album Kind of Blue", "play my Discover Weekly". Reports what it picked — relay that to the user so they can correct it.

Input parameters:

- `device_id` (string): Target device id (see the devices tool)
- `query` (string): What to play, e.g. "Bill Evans" or "Kind of Blue". Required unless uri is given.
- `type` (string): What the query refers to (default: track)
- `uri` (string): Spotify URI to play directly, e.g. from a previous search result

### `playback` (~87 tokens)

Control playback

Transport controls for the active playback: pause, resume, next, previous, seek (value = seconds), volume (value = 0-100), shuffle (value = on/off), repeat (value = off/context/track).

Input parameters:

- `action` (string, required)
- `value`: seek: seconds · volume: 0-100 · shuffle: on/off · repeat: off/context/track

### `now_playing` (~26 tokens)

What's playing

Current track, artist, album, progress, device, and shuffle/repeat state.

### `queue` (~65 tokens)

Playback queue

action=add queues a track by query or URI; action=list shows what's playing and up next.

Input parameters:

- `action` (string, required)
- `query` (string): Track to queue by name (action=add)
- `uri` (string): Track URI to queue (action=add)

### `devices` (~53 tokens)

Spotify devices

action=list shows available Spotify devices; action=transfer moves playback to a device by name or id.

Input parameters:

- `action` (string, required)
- `device` (string): Device name (fuzzy) or id (action=transfer)

### `search` (~104 tokens)

Search Spotify

Searches the Spotify catalog. Use when the user wants options to choose from; for a direct 'play X' request, prefer the play tool. Results include URIs usable with play, queue, playlists, and library. Max 10 results per type (API limit).

Input parameters:

- `limit` (integer): Results per type, 1-10 (default 5)
- `query` (string, required): Search text
- `types` (array): Result types to include (default: track)

### `get_playlists` (~20 tokens)

List my playlists

Lists the user's playlists with item counts and URIs.

### `get_playlist_items` (~78 tokens)

Show playlist contents

Lists the tracks in one of the user's own or collaborative playlists (Spotify no longer exposes other users' playlist contents). Accepts a playlist id, URI, or URL.

Input parameters:

- `offset` (integer): Pagination offset (default 0)
- `playlist` (string, required): Playlist id, spotify:playlist:… URI, or open.spotify.com URL

### `modify_playlist` (~125 tokens)

Create playlist / add tracks

action=create makes a new playlist (private by default); action=add_items appends track URIs to an existing playlist. Does not delete or remove anything.

Input parameters:

- `action` (string, required)
- `description` (string): New playlist description (action=create)
- `name` (string): New playlist name (action=create)
- `playlist` (string): Target playlist id/URI/URL (action=add_items)
- `public` (boolean): Make the new playlist public (default false)
- `uris` (array): Track URIs to add (action=add_items)

### `library` (~76 tokens)

Manage library

Saves, removes, or checks items in the user's Spotify library ('liked'). Works with any content URI: tracks, albums, artists (follow), shows, episodes. To save the current song, get its URI from now_playing first.

Input parameters:

- `action` (string, required)
- `uris` (array, required): Spotify URIs to act on

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/xavierfabregat-spotify-mcp/xavifabregat-spotify-mcp#diagnostics

## Score history

- 2026-08-04: 68
- 2026-08-03: 69
- 2026-08-02: 65
- 2026-08-01: 25
- 2026-07-31: 20
- 2026-07-30: 45
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/@xavifabregat/spotify-mcp
- Socket report: https://socket.dev/npm/package/@xavifabregat/spotify-mcp
- Repository: https://github.com/XavierFabregat/spotify-mcp
- Changelog RSS feed: https://verifymcp.io/servers/xavierfabregat-spotify-mcp/xavifabregat-spotify-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/xavierfabregat-spotify-mcp/xavifabregat-spotify-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/xavierfabregat-spotify-mcp/xavifabregat-spotify-mcp