Spotify Web API MCP Configuration
The Spotify Web API MCP configuration provides a hosted JSON schema that connects AI assistants — including Claude Desktop, Cursor, Windsurf, and VS Code Copilot — to the Spotify Web API API via the Model Context Protocol. This configuration maps 10 API endpoints as callable tools, including Get Several Albums , Get Album , Get Album Tracks , and more. No authentication credentials are needed — it works out of the box. The configuration is auto-generated from the Spotify Web API OpenAPI specification (v1.0.0) and has a quality score of 34/99 (fair documentation coverage). Use the hosted URL below to auto-load this schema into any compatible MCP client.
Quick Specs Reference
Hosted Config URL
Use this hosted URL in any client that supports remote MCP schema auto-loading.
https://mcpbridge.org/config/spotify-com.jsonOne-Click Client Setup
Copy the configurations below to wire your local coding assistant directly.
Claude Desktop
claude_desktop_config.json{
"mcpServers": {
"spotify-com": {
"command": "npx",
"args": [
"-y",
"@mcp/spotify-com"
],
"env": {
"SPOTIFY_WEB_API_API_KEY": "your_spotify_web_api_api_key"
}
}
}
}Cursor & VS Code
MCP Server URL Setup{
"mcpServers": {
"spotify-com": {
"url": "https://mcpbridge.org/config/spotify-com.json"
}
}
}Raw Configuration JSON
For local command line wrappers or dynamic shell bindings.
{
"mcpServers": {
"spotify-com": {
"command": "npx",
"args": ["-y","@mcp/spotify-com"],
"env": {
"SPOTIFY_WEB_API_API_KEY": "your_spotify_web_api_api_key"
}
}
}
}Required Environment Keys
Substitute these secrets inside your configuration directory environment definitions.
SPOTIFY_WEB_API_API_KEYyour_spotify_web_api_api_key with your secret key credentialMapped Web APIs & Tools
The following routes will be exposed directly as protocol tools for the LLM.
/albumsGet Several Albums
/albums/{id}Get Album
/albums/{id}/tracksGet Album Tracks
/artistsGet Several Artists
/artists/{id}Get Artist
/artists/{id}/albumsGet Artist's Albums
/artists/{id}/related-artistsGet Artist's Related Artists
/artists/{id}/top-tracksGet Artist's Top Tracks
/audio-analysis/{id}Get Track's Audio Analysis
/audio-featuresGet Tracks' Audio Features
Similar Configurations
1Password Connect
The 1Password Connect API is a robust RESTful interface provided by 1Password, a leading enterprise password management and secrets orchestration platform. This API serves as the programmatic backbone for 1Password Connect, a self-hosted server that acts as a secure bridge between an organization's internal infrastructure and its 1Password vaults. Its core capability is to enable secure, automated access to secrets, credentials, documents, and other sensitive items stored within 1Password, without exposing master passwords or sensitive data to applications directly. Typical use cases are extensive within modern DevOps and IT environments, including dynamically injecting database credentials into cloud application deployments, rotating secrets on a scheduled basis, automatically retrieving API keys for CI/CD pipelines, and centralizing secret management for microservices architectures. By providing a self-hosted component, the API allows organizations to maintain full control over their data flow and integrate 1Password's zero-knowledge security model directly into their internal tooling and automation scripts. When exposed as tools to an AI coding assistant via the Model Context Protocol (MCP), the 1Password Connect API unlocks a paradigm of context-aware, secure automation. The value lies in transforming the AI from a passive code generator into an active, privileged operator within the developer's secure environment. Instead of the AI merely suggesting where a hardcoded secret should go, it can dynamically fetch the correct, up-to-date secret from the designated vault at runtime. This eliminates the need for developers to manually copy secrets into environment variables or configuration files, reducing human error, secret sprawl, and the risk of accidental exposure. The AI gains a secure, read-and-write (if permitted) conduit to the organization's single source of truth for credentials, enabling it to verify secret configurations, ensure compliance, and maintain security hygiene as an integral part of the development process. Practical workflows enabled by this MCP server are highly dynamic and task-oriented. A developer could instruct the AI agent with commands such as, "Query the production database vault and retrieve the current password for the 'user_auth_service' item to test my local connection," or "Update the 'Stripe_API_Key' item in the 'Payment_Gateways' vault with a newly generated key from our payment processor." The AI agent can perform routine operational tasks like, "Fetch all items from the 'SSH_Keys' vault and summarize which keys have not been used in over 90 days," thereby aiding in access reviews. For automation, the developer could prompt, "After I deploy my application to staging, use the Connect API to fetch the required secrets from the 'Staging_Secrets' vault and format them as environment variables for my Docker container," creating a seamless, secure deployment workflow. The agent can also assist in auditing by instructing, "Retrieve the activity log for the 'DevOps_Team' vault for the past week and identify any secret access anomalies." Critical security considerations are paramount when deploying this server, especially when bridging it to an AI agent. Although the API endpoint authentication may be configured as "None" (meaning the Connect server itself handles internal auth via API tokens), the MCP server layer must enforce strict, granular authentication. It is essential to use the principle of least privilege when generating API tokens; tokens should be scoped to only the specific vaults and item permissions (e.g., read-only) required for the AI's tasks. The MCP server should act as a secured gateway, requiring the AI assistant to authenticate itself before it can make any API calls, preventing unauthorized direct access. Developers must ensure all communication is over TLS, store API tokens securely outside of source code (e.g., in a secure vault), and implement detailed logging and monitoring of all API calls initiated by the AI to maintain a full audit trail. Configuration should involve explicit mapping of allowed vaults and item types to the AI tool's capabilities, creating a well-defined boundary for automated actions.
https://mcpbridge.org/config/1password-local-connect.jsonEvents API
The 1Password Events API is a specialized service provided by the password and credential management platform 1Password, designed for enterprise security teams, IT administrators, and security analysts. Its core capability is to provide a secure, queryable stream of audit events related to secret access and authentication activity within a 1Password organization or team. By aggregating data from the specified endpoints—`/api/v1/itemusages` for secret access logs and `/api/v1/signinattempts` for user authentication logs—it enables comprehensive monitoring, threat detection, and compliance reporting. Unlike a general-purpose API for managing vaults or secrets, this API is strictly read-focused, serving as the primary telemetry pipeline for security information and event management (SIEM) systems, custom alerting tools, and internal audit platforms. Typical use cases include correlating unusual secret access patterns with potential insider threats, verifying compliance with data access policies, generating audit trails for regulatory frameworks like SOC 2 or GDPR, and building real-time dashboards to visualize credential usage across an organization. Exposing this API as tools through the Model Context Protocol (MCP) for an AI coding assistant transforms it from a passive data source into an active analytical partner. The unique value lies in enabling the AI to perform contextual, natural language-driven security investigations directly within a developer's or analyst's workflow. Instead of manually writing API queries, filtering JSON responses, and piecing together timeline correlations, a user can instruct the AI to analyze the event stream for patterns. The AI can act as an expert security co-pilot, instantly querying the `/api/v1/itemusages` endpoint to identify which users accessed a specific secret, cross-referencing that with `/api/v1/signinattempts` to see if those access events align with suspicious login attempts from unfamiliar locations or devices, and then summarizing the findings. This turns raw log data into actionable intelligence without the context-switching overhead, dramatically reducing mean time to detection (MTTD) and response (MTTR) for security events. In a practical workflow, a developer or security engineer could use an MCP-enabled AI agent to perform dynamic, iterative tasks. For instance, they could instruct it with commands like, "Analyze item usage events for the 'production-api-key' secret from the past 24 hours and tell me if any access occurred outside of normal business hours," or "Compare all failed sign-in attempts for the '[email protected]' account with successful ones and highlight any discrepancies in IP addresses or user agents." More complex automations become possible, such as asking the AI to "Continuously monitor the sign-in attempts endpoint and generate a concise alert summary if you see more than five consecutive failures from a single IP range, then suggest potential containment steps." This allows the AI to handle repetitive monitoring, correlation, and initial triage tasks, freeing human experts to focus on high-level strategy and remediation. Critical to the setup and use of this MCP server are the strict security and authentication requirements. Although the API itself is listed as having "None" for authentication in the provided specification, this is a critical misnomer for a real-world implementation. In practice, accessing 1Password's event logs requires a dedicated service account with explicit, read-only permissions scoped to audit events, governed by 1Password's Connect server or a similar secure provisioning mechanism. Developers must follow the principle of least privilege, ensuring the service account token or credentials used by the MCP server can only query the event endpoints and nothing else. All configuration, especially the authentication secrets, must be managed outside of the AI's direct context, injected via secure environment variables or a dedicated secrets manager, and never hardcoded. It is also essential to configure the MCP server with strict rate limiting and to use encrypted connections (HTTPS) to prevent token interception, ensuring that this powerful analytical tool does not become a vector for credential leakage.
https://mcpbridge.org/config/1password-com-events.jsonAuthentiq API
The Authentiq API provides a robust foundation for implementing strong, passwordless authentication and identity verification systems. Developed by Authentiq, a specialist in modern digital identity solutions, this API enables the secure management of cryptographic keys and the orchestration of login and scope-based authorization flows. Its core capabilities are centered around the lifecycle management of public-private key pairs, which serve as the user's credentials. The endpoints allow for the creation of a new key pair (POST /key), retrieval of a public key by its ID (GET /key/{PK}), and associated management operations (POST, PUT, DELETE on the key resource). Beyond basic key management, the API facilitates the authentication process itself through the POST /login endpoint, which verifies a signature from the user's private key. The /scope endpoints introduce a layer of fine-grained, permission-based access control, allowing developers to define, query, and manage specific authorization scopes tied to a job or session. This makes the API ideal for enterprise applications requiring secure internal tool access, consumer-facing mobile or web apps seeking seamless login experiences without credential fatigue, and IoT ecosystems where device authentication is paramount. When exposed as tools via the Model Context Protocol (MCP) to an AI coding assistant, the Authentiq API transforms from a static set of endpoints into a dynamic, interactive capability. An AI agent, such as one running in Cursor or Cline, could be instructed to programmatically manage authentication infrastructure. For example, it could generate a new API key for a specific service (POST /key), rotate existing keys for security compliance (DELETE followed by POST for a given {PK}), or audit the status of currently active keys by retrieving their details (GET /key/{PK}). More profoundly, it could orchestrate complex authorization workflows by querying and validating user scopes (GET /scope/{job}) or dynamically creating new, time-bound authorization scopes for automated tasks (POST /scope/{job}). This integration empowers developers to delegate repetitive security and configuration tasks to the AI, accelerating setup, ensuring consistency in security policy application, and allowing for rapid prototyping of authentication systems within larger applications. In practical terms, a developer using an MCP-connected AI could issue natural language commands to perform sophisticated operational tasks. For instance, they could instruct, "Onboard a new partner service by generating a dedicated authentication key with the scope 'analytics:read' and 'logs:write'," prompting the AI to first create the key (POST /key) and then define the associated scope (POST /scope/{job}). Alternatively, a command like "Audit all active login sessions for the 'admin' scope" would have the AI agent use GET /scope/{job} to fetch and summarize the relevant records. The AI could also automate security workflows, such as "Revoke and replace the key used by the legacy reporting module" by executing a sequence of DELETE and POST operations. These dynamic interactions turn the AI into a force multiplier for DevOps and security engineering, handling routine yet critical identity management tasks with precision and speed that manual scripting cannot match. It is critical to note that while the API itself employs no built-in authentication method for its endpoints, this represents a significant security consideration, not a simplification. All interactions with the Authentiq API should occur over strictly encrypted channels (HTTPS). Developers must implement their own robust authentication and authorization layer in front of this API to control access to its powerful key and scope management functions. The principle of least privilege must be rigorously applied; any service or AI agent interacting with the API should be granted only the absolute minimum permissions necessary to perform its specific function. API keys or other secrets used to interact with Authentiq endpoints must be stored securely in environment variables or a secrets vault, never committed to source code. When configuring the MCP server, developers should ensure the AI assistant operates within a sandboxed context with tightly controlled outbound network rules, allowing it to communicate only with the designated Authentiq API endpoint.
https://mcpbridge.org/config/6-dot-authentiqio-appspot-com.jsonIP geolocation API
The IP Geolocation API, developed by AbstractAPI, is a robust and scalable RESTful service designed to provide developers with precise geographic, network, and contextual data associated with any given IPv4 or IPv6 address. Its core capability lies in translating a digital identifier—a public IP address—into a rich dataset that includes region, country, city, latitude, longitude, timezone, and ISP details. Beyond this fundamental geolocation, the API extends its value by offering supplementary metadata such as the local currency code, national flag, primary language, and security flags indicating whether an IP is from a corporate network or associated with a known threat actor. Typical enterprise use cases span from real-time user authentication and fraud prevention, where a login attempt from an unexpected location can trigger a security alert, to localized content delivery, ensuring users see region-appropriate pricing, language, and offers. For consumers and developers, it powers features like website analytics dashboards, personalized news feeds, and dynamic form auto-population. When integrated as a toolset via the Model Context Protocol (MCP) for an AI coding assistant, this API transitions from a static data source to a dynamic, interactive capability. The AI agent gains the ability to resolve geographic context on-demand, transforming it from a passive code generator into an active systems integrator. This means the assistant can, within a development session, dynamically fetch and incorporate real-world geographic data into its reasoning. For instance, when a developer is building a feature that requires regional logic, the AI can proactively query the API to validate assumptions about IP-to-region mappings, test localization logic with real country/city pairs, or even mock up API responses with accurate geopolitical data for unit tests. This direct, tool-based access significantly reduces context switching and manual lookup, accelerating the development of location-aware applications and allowing the AI to serve as a knowledgeable partner in implementing complex geospatial logic. Practical workflows enabled by this MCP integration are numerous and directly enhance productivity. A developer could instruct the AI agent with a command like, “Help me write a function to determine if a user is from the EU for GDPR compliance checks. Use the IP geolocation API to test it with these sample IPs: 8.8.8.8, 2001:4860:4860::8888, and 192.168.1.1.” The AI would then leverage the MCP tool to query the AbstractAPI endpoint for each IP, analyze the response to identify European country codes, and generate or refactor the compliance function accordingly. Another dynamic task could be, “Update our user onboarding script to automatically detect a user’s country from their IP and populate the ‘currency’ field in our database.” Here, the AI agent would use the API to understand the schema and data availability, then write or modify the integration code that calls the geolocation endpoint and maps the `currency` field to the database model. It can also perform diagnostic tasks like, “Analyze these 50 IP addresses from our access logs and categorize them by country to identify our top user markets,” using the API to process and aggregate the data. While the API currently operates without authentication, which simplifies initial integration for development and testing, developers must exercise critical caution in production deployments. The lack of API keys or OAuth tokens means there is no built-in mechanism for request throttling, usage tracking, or abuse prevention at the client level. Best practice dictates implementing strict access controls within your own application architecture, ensuring the API endpoint is never exposed directly to the public internet from a client-side application. Instead, it should be called exclusively from a secure backend server. This server-side implementation should act as a controlled gateway, enforcing rate limiting, logging requests, and ideally caching responses to minimize redundant calls and mitigate latency. Developers should also rigorously validate and sanitize all IP addresses received from untrusted sources before passing them to the API to prevent injection attacks. Following the principle of least privilege, the network firewall or rules for the calling server should be configured to only allow outbound traffic to the specific AbstractAPI endpoint, minimizing the potential attack surface.
https://mcpbridge.org/config/abstractapi-com-geolocation.json