Reported issues for ccu-mcp
Pod holds 18 of 68 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.
Back to ccu-mcp.
Most discussed
List debmatic-mcp on the low-effort MCP registries
Get the server into the discovery directories. server.json already validates against the official registry (mcp-publisher validate → ✅ valid, schema 2025-12-11), so most of these are near-zero effort.
Registries
- Glama — already listed (
glama.json, badge in README). - Official MCP registry (
registry.modelcontextprotocol.io) — highest value. Already configured: validserver.json+mcpNameinpackage.json. Publish with:mcp-publisher login github m
Read the thread · 2026-06-15 · closed · 3 comments
I-7: Verify escapeHmScript's # escape against a real CCU
Severity: Info (needs verification on real hardware) — from code review round 3 (2026-06-11)
Location: src/utils.ts:13
escapeHmScript escapes # as \#. Inside a double-quoted ReGa string literal, # is not an operator and shouldn't need escaping; if the interpreter treats \# literally (backslash retained), values containing # get corrupted on write (e.g. a sysvar value or room name containing #).
Action: test once against a real CCU (set_system_variable with a stri
Read the thread · 2026-06-11 · closed · 2 comments
wizard: e2e tests, coverage baseline, docs
e2e test/e2e/cli-init.test.ts (modeled on cli-flags.test.ts): spawn built dist with piped answers against a mock CCU, assert the written .env; doctor exits 0 on it, 1 on a broken file. Add src/cli line to .github/coverage-baseline.txt (measured honestly). README: Command-line flags section, Quick start + HTTPS pointers, Configuration-errors note. CHANGELOG under Unreleased.
Part of #195 (interactive setup wizard); see ROADMAP.md → Configuration experience.
Read the thread · 2026-08-25 · closed · 1 comment
wizard: ccu-mcp doctor
src/cli/doctor.ts: load the env file (util.parseEnv), run loadConfig() reporting its fatal errors as findings, then per profile check reachability, pinned-fingerprint match (offer interactive refresh on mismatch), login, privilege level. Check-list output, exit 1 on any failure.
Part of #195 (interactive setup wizard); see ROADMAP.md → Configuration experience.
Read the thread · 2026-08-25 · closed · 1 comment
wizard: ccu-mcp init flow + client config snippets
src/cli/init.ts: per-profile loop — name, host, probe/auto-detect port+HTTPS, show cert and offer fingerprint pin, user/password (hidden), test login, report USER vs ADMIN (with the ReGa-needs-ADMIN warning), protected/readonly flags; confirm before overwriting managed keys in an existing .env; print ready-to-paste client snippets (claude mcp add, .mcp.json, Claude Desktop).
Part of #195 (interactive setup wizard); see ROADMAP.md → Configuration experience.
Read the thread · 2026-08-25 · closed · 1 comment
wizard: .env writer with managed-keys merge
src/cli/env-writer.ts: build flat or CCU_PROFILES-style .env content, rewrite only wizard-owned keys, preserve foreign lines verbatim, write mode 0600 via tmp+rename — same pattern as the token persistence in src/auth/token.ts. Never echoes the password.
Part of #195 (interactive setup wizard); see ROADMAP.md → Configuration experience.
Read the thread · 2026-08-25 · closed · 1 comment
wizard: probe core — reachability, cert fetch, test login, privilege detection
src/cli/probe.ts, pure functions reusable later by the LLM-guided setup (#196): probeApi() classifies a JSON-RPC POST to /api/homematic.cgi (CCU found / not a CCU / TLS error / unreachable) and lets init auto-try 443+HTTPS then 80+HTTP; fetchCert() returns fingerprint256 + subject/validity via node:tls; testLogin() uses the real CcuClient/SessionManager, probes privilege via CCU.getVersion (ADMIN-only, same approach as get_system_info) and maps failures through the existing CcuError categories
Read the thread · 2026-08-25 · closed · 1 comment
wizard: CLI subcommand dispatch + prompt helpers
Dispatch init / doctor positional subcommands in the early no-env path of src/index.ts (same rule as --version, issue #112), extend USAGE. Add src/cli/prompt.ts: ask / askHidden (echo off, plain read on non-TTY) / askYesNo / askChoice on injected streams for testability. No new dependencies.
Part of #195 (interactive setup wizard); see ROADMAP.md → Configuration experience.
Read the thread · 2026-08-25 · closed · 1 comment
Most recent
Dev-VM live tests, e2e, docs
Gated integration suite against the OpenCCU QEMU dev VM (ADMIN, so run_script paths are live-testable), stdio e2e for the full setup-mode flow incl. server restart into configured mode, README/CHANGELOG/ROADMAP updates.
Read the thread · 2026-08-25 · closed · 0 comments
ccu-mcp secret subcommand
Hidden local prompt (echo off) that writes only CCU_PASSWORD / CCU_
_PASSWORD into the env file (0600, tmp+rename). Flat form takes no profile name; CCU_PROFILES form requires one. Also the documented password-rotation path.
Read the thread · 2026-08-25 · closed · 0 comments
setup_* tools: status, probe, write_profile, test
Four tools registered only on the setup server, reusing src/cli/probe.ts and src/cli/env-writer.ts. setup_write_profile has no password parameter by design; setup_status reports password presence as a boolean only; setup_test is the doctor-style verification with role detection.
Read the thread · 2026-08-25 · closed · 0 comments
Setup mode startup: --env + invalid config starts a minimal setup server (stdio only)
Wrap loadConfig() in a try/catch in src/index.ts: with --stdio and --env
Read the thread · 2026-08-25 · closed · 0 comments
LLM-guided setup: MCP setup tool + ccu-mcp secret
Second phase of the configuration-experience plan (ROADMAP.md, #194), building on the wizard core from #195 (src/cli/probe.ts, src/cli/env-writer.ts).
Setup mode. Today the server refuses to start without a valid config (loadConfig() throws, and e2e asserts the loud failure — the earlier "it already starts with an empty config" claim was wrong). New rule: started with --stdio --env <path> and a missing/invalid config, the server comes up in setup mode — a minimal MCP server expo
Read the thread · 2026-08-25 · closed · 0 comments
Interactive setup wizard: ccu-mcp init / ccu-mcp doctor
First phase of the configuration-experience plan (ROADMAP.md, #194).
Configuring profiles today means hand-writing CCU_PROD_TLS_FINGERPRINT-style variables and finding out at runtime whether the credentials work or the user has enough privileges.
ccu-mcp init — interactive wizard that:
- prompts per profile (host, port, HTTPS, user; password read with echo off)
- probes the CCU and auto-detects HTTPS/port where possible
- fetches the TLS certificate and offers to pin its fingerprint
Read the thread · 2026-08-25 · closed · 0 comments
Spec-alignment and documentation sweep before v1.10.0
A review of the documentation, the MCP-standards alignment and the release state turned up the items below. Conformance was probed against the built server with a real SDK client (negotiation, capabilities, tool metadata, error shapes), and the docs were diffed mechanically against the code (env vars, tool names, resource URIs, prompt names — those three are in sync).
Baseline that is already correct and needs no work: protocol negotiation
(2025-11-25, downgrading to 2024-11-05 for olde
Read the thread · 2026-08-19 · closed · 0 comments
npm provenance: sign releases for OpenSSF silver
signed_releases (level 1, MUST) is the one real blocker for the OpenSSF Best Practices silver tier. Currently unmet — no provenance is configured.
Git tags are already signed (git tag -s), covering version_tags_signed (level 1, SUGGESTED), but that signs the tag, not the published artifact.
What it needs
npm publish --provenance, which requires publishing from a GitHub Actions workflow withid-token: writeso npm can verify the OIDC claim. Provenance cannot be generat
Read the thread · 2026-08-01 · closed · 0 comments
OpenSSF Scorecard: add workflow once SCORECARD_TOKEN exists
Blocked on a fine-grained read-only PAT as repo secret SCORECARD_TOKEN — without it the Branch-Protection check scores -1. Then: scheduled workflow, non-hermetic, never a required check, SHA-pinned ossf/scorecard-action. Separate from the Best Practices badge (already passing).
Read the thread · 2026-08-01 · closed · 0 comments
put_paramset accepts an empty set object and reports success
Split out of #125, which was closed as not-a-bug after live verification of the XML-RPC encoder. This part is unrelated to encoding and still stands.
src/tools/control.ts:138 builds the parameter array with no emptiness check:
const paramArray = Object.entries(args.set).map(([name, value]) => { ... });
put_paramset({address, paramsetKey: "VALUES", set: {}}) therefore sends an empty struct to Interface.putParamset and answers:
{ "address": "...", "paramsetKey": "VALU
[Read the thread](https://github.com/claymore666/ccu-mcp/issues/131) · 2026-07-29 · closed · 0 comments
The remaining reports are on [the project's issue tracker](https://github.com/claymore666/ccu-mcp/issues).