Spotify MCP OAuth Server

This is a fork of Stytch’s MCP Consumer TODO List example, adapted to demonstrate Spotify OAuth 2.0 integration with Model Context Protocol (MCP) using Cloudflare Workers.

Why This Fork?

The original Stytch example provided an excellent foundation for implementing OAuth discovery and Dynamic Client Registration for MCP servers. We forked this project to:

1. Leverage the OAuth Discovery Pattern: The original implementation showed how to create OAuth discovery endpoints that work with MCP Inspector
2. Replace Stytch with Spotify: Demonstrate how to integrate with a third-party OAuth provider (Spotify) that doesn’t natively support Dynamic Client Registration
3. Focus on the API Layer: While the original included a full TODO app with frontend components, this fork focuses primarily on the MCP server implementation

What’s Changed

API Layer Updates

• New Files Added:

  • api/SpotifyMCP.ts - MCP server implementation for Spotify Web API
  • api/SpotifyService.ts - Service layer for Spotify API interactions
  • api/lib/spotify-auth.ts - OAuth flow implementation for Spotify

• Modified Files:

  • api/index.ts - Updated to handle Spotify OAuth flow and MCP endpoints
  • Environment variables changed from Stytch to Spotify credentials

Key Features

This implementation provides:

• OAuth 2.0 Authorization Code Flow with PKCE support
• OAuth Discovery Endpoint at /.well-known/oauth-authorization-server
• Dynamic Client Registration for MCP Inspector compatibility
• Automatic Token Refresh when access tokens expire
• Full Spotify Web API Integration via MCP tools
• Cloudflare Durable Objects for MCP server state management

Architecture

The project uses:

• Cloudflare Workers for the backend API
• Cloudflare Durable Objects for MCP server instances
• Spotify Web API for music data and playback control
• Model Context Protocol (MCP) for AI agent integration

Important: Development Example

⚠️ This server is primarily designed for development and testing OAuth flows with MCP clients.

This implementation is optimized for:

• Testing with LibreChat - An open-source AI chat platform with MCP support
• Development with MCP Inspector - Official MCP debugging tool
• Learning how to implement OAuth discovery for MCP servers

Not Production-Ready

Before deploying to production, you should:

1. Add Authentication Validation

   • Implement proper client validation in the /register endpoint
   • Add rate limiting to prevent abuse
   • Validate redirect URIs against a whitelist

2. Enhance Security

   • Implement CSRF protection
   • Add request signing/verification
   • Use secure session management