spotify-mcp-server

The server implements robust error handling and token management, prioritizing token integrity. It never invalidates tokens on transient network failures (e.g., 5xx, 429 rate limit, network errors) and explicitly only invalidates tokens upon an 'invalid_grant' error during refresh, indicating a truly revoked refresh token. Credentials are saved using atomic writes to prevent corruption and secured with 0o600 file permissions. OAuth flow includes CSRF protection via state. Logs are correctly directed to stderr to avoid interfering with MCP stdout. No direct 'eval' or malicious patterns are observed. Sensitive credentials (client secret, tokens) are handled with care, either prompted, loaded from secured files, or read from environment variables without being logged in clear text at normal log levels.