Spaces:
Running
Running
Commit History
-
Treat non-JSON success bodies as no content (#8) Running
Unverified signatureSpotify documents the player write endpoints as 204 No Content, but PUT /me/player/shuffle and PUT /me/player/repeat answer 200 with a short non-JSON body. The client only guarded 204-or-empty, so response.json() raised JSONDecodeError on those two actions. That exception escaped player_control's `except SpotifyAPIError` and _dispatch's `except AuthenticationError`, surfacing to MCP clients as a raw "Expecting value: line 1 column 1 (char 0)" tool error. The write itself had already succeeded, so the error was doubly misleading: shuffle and repeat did take effect, and any batch containing them aborted and discarded its remaining actions. Verified live against the Spotify Web API: 204 responses (transfer, play, volume) succeeded while the two 200 responses failed, with the server log confirming the status split. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>0645c76 -
Throttle JWKS refreshes during MCP token verification (#7)
Unverified signatureScalekit token verification resolved signing keys with PyJWKClient.get_signing_key_from_jwt, which bypasses the JWK set cache and refetches whenever a token's key id misses. That path runs before any signature is checked, so an unauthenticated caller sending tokens with arbitrary key ids turned each inbound request into an outbound fetch to Scalekit, every one of them holding an asyncio worker thread for the duration of a blocking network call. Resolve keys through a throttled client instead: reject any algorithm outside the pinned RS256 list and any token without a key id before touching the JWK set, and allow at most one cache-bypassing refresh per 30 seconds. A genuine key rotation is still picked up on the next request. Fifty forged key ids now cause two outbound fetches rather than fifty, and legitimate verification is unchanged. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>f48d12a -
Harden hosted token verification dependencies (#6)
Unverified signatureCo-authored-by: Leo Walker <29339724+leoalord@users.noreply.github.com>7537286
-
Add authenticated hosted deployment (#5)
Unverified signatureeffc0fc
-
Add curated Spotify prompts and profile resource (#4)
Unverified signature* feat: add curated Spotify prompts and profile resource * fix: validate Spotify prompt and resource contracts203ee4f -
Implement nine-tool Spotify MCP v2 suite (#3)
Unverified signature* feat: implement Spotify MCP tool suite * fix: address Spotify tool review findings93a887a
-
Initial Spotify MCP server scaffold
52c1e0f