io.github.CloudCorpRecords/musicport is an MCP server that spotify search, playback and playlists as MCP tools. Its tool list has not been published yet over stdio, requires no API key, and scores 56/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients - only the file and path differ.
{
"mcpServers": {
"musicport": {
"env": {
"SPOTIFY_ACCESS_TOKEN": "BQ..."
},
"args": [
"-y",
"@reneturcios/musicport",
"mcp"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Spotify search, playback and playlists as MCP tools.
Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.
npx -y '@reneturcios/musicport' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories - click any category to see the underlying evidence.
No known CVEs.
Checked @reneturcios/musicport against OSV.dev.
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
Sign in to write a review.
Others in entertainment
The official MCP Server for the Mux API
Give Claude the ability to watch and understand videos — Claude Code plugin with frame extraction and multimodal audio analysis
Make games with AI: one MCP server that connects your agent to Unity, Unreal and Godot editors.
MCP server for *arr media suite - Sonarr, Radarr, Lidarr, Readarr, Prowlarr
MCP Security Weekly
Get CVE alerts and security updates for io.github.CloudCorpRecords/musicport and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Spotify search, playback and playlists as MCP tools, talking to the Spotify Web API. musicport is a clean-room rebuild of the core surface of community Spotify MCP servers, under a new name: fresh code, no copied branding.
TOKEN-ENV ONLY. The hosted/community OAuth flow
(SPOTIFY_CLIENT_ID / SPOTIFY_CLIENT_SECRET + browser consent +
refresh) is NOT reproduced. Tools use SPOTIFY_ACCESS_TOKEN
directly as Authorization: Bearer.
search, get_current_user_profile, get_playback_state, play,
pause, next_track, previous_track, list_playlists,
get_playlist, create_playlist, add_tracks_to_playlist,
list_saved_tracks.
Not in this subset: OAuth authorization/refresh flow, track/album/artist detail reads beyond search, audio features/analysis, recommendations, shows/episodes/audiobooks, follow/unfollow artists and users, playlist cover images, playlist item removal/reorder depth, library albums/shows, devices listing and transfer playback, queue management, recently played, top items.
Obtain a Spotify access token through your own means and set it:
export SPOTIFY_ACCESS_TOKEN=BQ...
Optionally override the API base with SPOTIFY_API_BASE_URL
(default https://api.spotify.com/v1). Without the token, every
tool call fails with an error naming the missing variable:
SPOTIFY_ACCESS_TOKEN environment variable is required.
npx @reneturcios/musicport search '{"query":"hello"}'
npx @reneturcios/musicport mcp # stdio MCP server
Each tool name is a subcommand taking one JSON object argument.
{
"mcpServers": {
"musicport": {
"command": "npx",
"args": ["-y", "@reneturcios/musicport", "mcp"],
"env": { "SPOTIFY_ACCESS_TOKEN": "BQ..." }
}
}
}
docker run -i -e SPOTIFY_ACCESS_TOKEN ghcr.io/cloudcorprecords/musicport
npm install
npm run build
npm test
MIT