Spotify MCP Ops-Ready (Azure Container Apps + Terraform)

FastMCP-based server that exposes Spotify + Last.fm tools over MCP, deployed to Azure Container Apps with Terraform.

• private container registry (ACR)
• managed identity (no registry passwords)
• Key Vault secrets + RBAC (no API keys in code)
• Log Analytics workspace + Container Apps Environment

Repository layout

client/   # Python MCP client (talks to the deployed MCP server)
server/   # FastMCP server + Dockerfile (port 8080)
infra/    # Terraform: Azure Container Apps, ACR, Key Vault, RBAC, etc.
docs/     # Runbooks / structure notes (see docs/app-structure.md and docs/terraform-files.md)

MCP tools exposed

• search_spotify
• artist_top_tracks
• current_user_profile
• current_user_top_tracks
• get_current_user_playlists
• get_playlist_items
• create_playlist
• add_to_playlist
• get_similar_tracks (Last.fm)
• get_similar_artists (Last.fm)
• start_playback
• pause_playback

Required Spotify OAuth scopes (refresh token)

• User Profile & Top Tracks: user-read-private, user-read-email, user-top-read
• Playlists (Read): playlist-read-private, playlist-read-collaborative
• Playlists (Write): playlist-modify-public, playlist-modify-private
• Playback Control: user-modify-playback-state, user-read-playback-state, user-read-currently-playing

Prerequisites

• Azure CLI (az) + logged in (az login)
• Terraform
• A Docker daemon to build/push images
• Spotify + Last.fm API credentials

Deploy (Azure)

1) Create Azure resources (Terraform)

From infra/, it’s easiest to create the registry first, push the image, then deploy the Container App:

terraform init
terraform apply -target=azurerm_container_registry.main

Note: infra/terraform.tfvars is gitignored. Put your sensitive values there (or use TF_VAR_... env vars).

2) Build + push container image to ACR

ACR_SERVER="$(terraform -chdir=infra output -raw acr_login_server)"
IMAGE="$ACR_SERVER/spotify-mcp:1"

docker buildx build --platform linux/amd64 -t "$IMAGE" -f server/Dockerfile server --push

3) Deploy the full stack (Key Vault secrets + Container App)

terraform -chdir=infra apply

4) Confirm the endpoint

URL="$(terraform -chdir=infra output -raw container_app_url)"
echo "$URL"

Run the client against your deployed server

export MCP_URL="$(terraform -chdir=infra output -raw container_app_url)"
export GOOGLE_API_KEY="..."

cd client
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python client.py