Last.fm MCP

Last.fm MCP Server

A Model Context Protocol (MCP) server for Last.fm. Gives AI assistants access to your listening history, music discovery, and detailed track/artist/album information.

Runs on Cloudflare Workers. Your MCP client signs you in with OAuth the first time it connects, and after that every tool is available, from track and artist lookups to your own listening history.

Quick start

lastfm-mcp.com has setup steps for each app, including ChatGPT, Codex, Cursor, Devin Desktop (formerly Windsurf) and OpenCode. If an AI agent is setting it up for you, point it at lastfm-mcp.com/llms.txt.

Claude.ai / Claude Desktop

1. Go to Customize -> Connectors
2. Click Add, then Add custom connector. Name it Last.fm, enter https://lastfm-mcp.com/mcp and click Continue
3. Leave the sign-in settings as they are, click Add, then Connect, and sign in to Last.fm

Claude Code

claude mcp add --scope user --transport http lastfm "https://lastfm-mcp.com/mcp"

Then start Claude Code, run /mcp, choose lastfm, then Authenticate, and sign in to Last.fm in your browser.

Other MCP clients

For clients that don't support remote servers directly (Continue.dev, Zed, etc.), use mcp-remote:

{	"mcpServers": {		"lastfm": {			"command": "npx",			"args": ["-y", "mcp-remote", "https://lastfm-mcp.com/mcp"]		}	}}

MCP Inspector

npx @modelcontextprotocol/inspector https://lastfm-mcp.com/mcp

Authentication

The server uses OAuth 2.0. The first time your client connects, your browser opens a short page on lastfm-mcp.com that names the app asking for access and the address that access will go to. Approve it, then sign in to Last.fm. That browser remembers the approval for a year, so reconnecting the same app skips the page.

Access is read-only: the server can read your listening history and profile, but it can't scrobble or change anything. Sign-ins expire after 30 days, and your client then asks you to sign in again.

Available tools

Lookups and diagnostics

Your listening data

Your listening history over time

Good for questions like "when did I start listening to Led Zeppelin?" or "what was I into last March?"

Resources

The server exposes MCP resource URIs:

lastfm://user/{username}/recent          # Recent trackslastfm://user/{username}/top-artists     # Top artistslastfm://user/{username}/top-albums      # Top albumslastfm://user/{username}/loved           # Loved trackslastfm://user/{username}/profile         # User profilelastfm://track/{artist}/{track}          # Track infolastfm://artist/{artist}                 # Artist infolastfm://album/{artist}/{album}          # Album infolastfm://artist/{artist}/similar         # Similar artistslastfm://track/{artist}/{track}/similar  # Similar tracks

Prompts

Development

Prerequisites

• Node.js 22 (see .nvmrc; CI runs 22)
• Cloudflare Workers account
• Last.fm API key (create one here)

Local setup

git clone https://github.com/rianvdm/lastfm-mcp.gitcd lastfm-mcpnpm install

Create .dev.vars (or copy .dev.vars.example):

LASTFM_API_KEY=your_api_keyLASTFM_SHARED_SECRET=your_shared_secretCONSENT_SECRET=any_random_string_of_32_or_more_characters

npm run dev

Test with the inspector:

npx @modelcontextprotocol/inspector http://localhost:8787/mcp

Deployment

Set production secrets (or run npm run setup:prod, which creates the KV namespaces, prompts for the two Last.fm values and generates CONSENT_SECRET):

echo "your_api_key" | wrangler secret put LASTFM_API_KEY --env productionecho "your_shared_secret" | wrangler secret put LASTFM_SHARED_SECRET --env productionopenssl rand -base64 32 | wrangler secret put CONSENT_SECRET --env production

CONSENT_SECRET signs the cookie that remembers which apps a browser approved. Rotating it shows the consent page again to everyone; if it's missing or shorter than 32 characters, approvals aren't remembered, but sign-ins still work.

Upgrading a deployment from v2.6.0 or earlier: v2.7.0 added the consent page and the CONSENT_SECRET secret. Set it with the openssl line above before you deploy, or right after. Until it's set, the consent page shows on every sign-in.

Deploy:

npm run deploy:prod

Testing

npm test          # vitest, in workerd via @cloudflare/vitest-pool-workersnpm run lintnpm run build     # wrangler deploy --dry-run: catches type and binding errors

Architecture

• Runtime: Cloudflare Workers
• Protocol: MCP (streamable HTTP)
• Auth: OAuth 2.0 (RFC 9728) via @cloudflare/workers-oauth-provider; the provider owns sessions and tokens
• Storage: Cloudflare KV for OAuth state, sessions, caching, and rate-limit counters
• Rate limiting: per-IP on /mcp, so one client can't exhaust the shared Last.fm API key's budget
• API: Last.fm Web API v2.0

Endpoints

Contributing

1. Fork the repo
2. Create a feature branch
3. Commit your changes
4. Open a pull request

License

MIT