pod
Other formats agents might prefer:
markdownjsonllms.txt

Agent? You probably want markdown or json, or Pod over MCP.

Reported issues for debmatic-mcp

Pod holds 19 of 71 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to debmatic-mcp.

Most discussed

List debmatic-mcp on the low-effort MCP registries

Get the server into the discovery directories. server.json already validates against the official registry (mcp-publisher validate → ✅ valid, schema 2025-12-11), so most of these are near-zero effort.

Registries

  • Glama — already listed (glama.json, badge in README).
  • Official MCP registry (registry.modelcontextprotocol.io) — highest value. Already configured: valid server.json + mcpName in package.json. Publish with:
    mcp-publisher login github
m

Read the thread · 2026-06-15 · closed · 3 comments

I-7: Verify escapeHmScript's # escape against a real CCU

Severity: Info (needs verification on real hardware) — from code review round 3 (2026-06-11)

Location: src/utils.ts:13

escapeHmScript escapes # as \#. Inside a double-quoted ReGa string literal, # is not an operator and shouldn't need escaping; if the interpreter treats \# literally (backslash retained), values containing # get corrupted on write (e.g. a sysvar value or room name containing #).

Action: test once against a real CCU (set_system_variable with a stri

Read the thread · 2026-06-11 · closed · 2 comments

wizard: ccu-mcp doctor

src/cli/doctor.ts: load the env file (util.parseEnv), run loadConfig() reporting its fatal errors as findings, then per profile check reachability, pinned-fingerprint match (offer interactive refresh on mismatch), login, privilege level. Check-list output, exit 1 on any failure.

Part of #195 (interactive setup wizard); see ROADMAP.md → Configuration experience.

Read the thread · 2026-08-25 · closed · 1 comment

wizard: ccu-mcp init flow + client config snippets

src/cli/init.ts: per-profile loop — name, host, probe/auto-detect port+HTTPS, show cert and offer fingerprint pin, user/password (hidden), test login, report USER vs ADMIN (with the ReGa-needs-ADMIN warning), protected/readonly flags; confirm before overwriting managed keys in an existing .env; print ready-to-paste client snippets (claude mcp add, .mcp.json, Claude Desktop).

Part of #195 (interactive setup wizard); see ROADMAP.md → Configuration experience.

Read the thread · 2026-08-25 · closed · 1 comment

wizard: .env writer with managed-keys merge

src/cli/env-writer.ts: build flat or CCU_PROFILES-style .env content, rewrite only wizard-owned keys, preserve foreign lines verbatim, write mode 0600 via tmp+rename — same pattern as the token persistence in src/auth/token.ts. Never echoes the password.

Part of #195 (interactive setup wizard); see ROADMAP.md → Configuration experience.

Read the thread · 2026-08-25 · closed · 1 comment

wizard: probe core — reachability, cert fetch, test login, privilege detection

src/cli/probe.ts, pure functions reusable later by the LLM-guided setup (#196): probeApi() classifies a JSON-RPC POST to /api/homematic.cgi (CCU found / not a CCU / TLS error / unreachable) and lets init auto-try 443+HTTPS then 80+HTTP; fetchCert() returns fingerprint256 + subject/validity via node:tls; testLogin() uses the real CcuClient/SessionManager, probes privilege via CCU.getVersion (ADMIN-only, same approach as get_system_info) and maps failures through the existing CcuError categories

Read the thread · 2026-08-25 · closed · 1 comment

wizard: CLI subcommand dispatch + prompt helpers

Dispatch init / doctor positional subcommands in the early no-env path of src/index.ts (same rule as --version, issue #112), extend USAGE. Add src/cli/prompt.ts: ask / askHidden (echo off, plain read on non-TTY) / askYesNo / askChoice on injected streams for testability. No new dependencies.

Part of #195 (interactive setup wizard); see ROADMAP.md → Configuration experience.

Read the thread · 2026-08-25 · closed · 1 comment

put_paramset stringifies values while set_value sends them raw — needs live verification

Observation

Two write tools feed the same CCU XML-RPC layer with the same type field but different wire shapes for the value.

set_value, src/tools/control.ts:77-83 — value passed through untouched:

session.call("Interface.setValue", {
  interface: iface, address: args.address, valueKey: args.valueKey,
  type: valueType,
  value: args.value,            // JS boolean / number / string as-is
});

put_paramset, src/tools/control.ts:138-142 — every value stringified:


[Read the thread](https://github.com/claymore666/ccu-mcp/issues/125) · 2026-07-29 · closed · 1 comment

## Most recent

### Dev-VM live tests, e2e, docs

Gated integration suite against the OpenCCU QEMU dev VM (ADMIN, so run_script paths are live-testable), stdio e2e for the full setup-mode flow incl. server restart into configured mode, README/CHANGELOG/ROADMAP updates.

[Read the thread](https://github.com/claymore666/ccu-mcp/issues/207) · 2026-08-25 · closed · 0 comments

### ccu-mcp secret <profile> subcommand

Hidden local prompt (echo off) that writes only CCU_PASSWORD / CCU_<P>_PASSWORD into the env file (0600, tmp+rename). Flat form takes no profile name; CCU_PROFILES form requires one. Also the documented password-rotation path.

[Read the thread](https://github.com/claymore666/ccu-mcp/issues/206) · 2026-08-25 · closed · 0 comments

### setup_* tools: status, probe, write_profile, test

Four tools registered only on the setup server, reusing src/cli/probe.ts and src/cli/env-writer.ts. setup_write_profile has no password parameter by design; setup_status reports password presence as a boolean only; setup_test is the doctor-style verification with role detection.

[Read the thread](https://github.com/claymore666/ccu-mcp/issues/205) · 2026-08-25 · closed · 0 comments

### Setup mode startup: --env + invalid config starts a minimal setup server (stdio only)

Wrap loadConfig() in a try/catch in src/index.ts: with --stdio and --env <path> and a config error, start createSetupServer(envPath, configError) instead of dying. Extract the shared server identity const from src/server.ts. Bare start keeps failing loudly; HTTP never enters setup mode.

[Read the thread](https://github.com/claymore666/ccu-mcp/issues/204) · 2026-08-25 · closed · 0 comments

### LLM-guided setup: MCP setup tool + ccu-mcp secret <profile>

Second phase of the configuration-experience plan (ROADMAP.md, #194), building on the wizard core from #195 (`src/cli/probe.ts`, `src/cli/env-writer.ts`).

**Setup mode.** Today the server refuses to start without a valid config (`loadConfig()` throws, and e2e asserts the loud failure — the earlier "it already starts with an empty config" claim was wrong). New rule: started with `--stdio --env <path>` and a missing/invalid config, the server comes up in **setup mode** — a minimal MCP server expo

[Read the thread](https://github.com/claymore666/ccu-mcp/issues/196) · 2026-08-25 · closed · 0 comments

### Spec-alignment and documentation sweep before v1.10.0

A review of the documentation, the MCP-standards alignment and the release state
turned up the items below. Conformance was probed against the built server with
a real SDK client (negotiation, capabilities, tool metadata, error shapes), and
the docs were diffed mechanically against the code (env vars, tool names,
resource URIs, prompt names — those three are in sync).

**Baseline that is already correct** and needs no work: protocol negotiation
(`2025-11-25`, downgrading to `2024-11-05` for olde

[Read the thread](https://github.com/claymore666/ccu-mcp/issues/178) · 2026-08-19 · closed · 0 comments

### CodeQL: move from default setup to advanced setup

CodeQL runs via GitHub's **default setup** (`state: configured`, default suite, over `javascript-typescript`, `typescript`, `javascript`, `actions`). It works — it caught the `js/polynomial-redos` in `extractBearerToken`.

Advanced setup would put the config in version control with everything else:

- Reviewable in a PR rather than only in repo settings
- `github/codeql-action` SHA-pinned like every other action, bumped by Dependabot
- Query suite selectable (e.g. `security-extended`)
- Explicit

[Read the thread](https://github.com/claymore666/ccu-mcp/issues/156) · 2026-08-01 · closed · 0 comments

### Fuzzing: persist the corpus between nightly runs

`.github/workflows/fuzz.yml` runs from the committed seed corpus only and keeps nothing between runs. Deliberate trade, documented in the workflow header: the targets are small pure functions, so a grown corpus buys little, while a cache is one more moving part that fails silently.

Revisit if the fuzz surface grows beyond `src/utils.ts`.

## Options

- `actions/cache` keyed per target (evictable, no write permission)
- Commit the corpus back to `dev` (needs `contents: write`, noisy)

## Do not 

[Read the thread](https://github.com/claymore666/ccu-mcp/issues/155) · 2026-08-01 · closed · 0 comments

### npm provenance: sign releases for OpenSSF silver

`signed_releases` (level 1, MUST) is the one real blocker for the OpenSSF Best Practices **silver** tier. Currently unmet — no provenance is configured.

Git tags are already signed (`git tag -s`), covering `version_tags_signed` (level 1, SUGGESTED), but that signs the *tag*, not the published artifact.

## What it needs

- `npm publish --provenance`, which requires publishing from a **GitHub Actions** workflow with `id-token: write` so npm can verify the OIDC claim. Provenance cannot be generat

[Read the thread](https://github.com/claymore666/ccu-mcp/issues/154) · 2026-08-01 · closed · 0 comments

### put_paramset accepts an empty set object and reports success

Split out of #125, which was closed as not-a-bug after live verification of the XML-RPC encoder. This part is unrelated to encoding and still stands.

`src/tools/control.ts:138` builds the parameter array with no emptiness check:

```ts
const paramArray = Object.entries(args.set).map(([name, value]) => { ... });

put_paramset({address, paramsetKey: "VALUES", set: {}}) therefore sends an empty struct to Interface.putParamset and answers:

{ "address": "...", "paramsetKey": "VALU

[Read the thread](https://github.com/claymore666/ccu-mcp/issues/131) · 2026-07-29 · closed · 0 comments

### fail2ban filter test asserts against a hand-mirrored log line, not the one src/index.ts actually emits

## What

`test/unit/fail2ban-filter.test.ts` is a well-built guard — it reconstructs the auth-failure line through the real `Logger`, parses the committed `failregex` out of `fail2ban/filter.d/ccu-mcp.conf`, and checks both the active and the commented-out strict variant. Its stated contract (`:7-10`):

> Locks the contract between the auth-failure log line the server emits and the committed fail2ban filter. **If either the log shape (src/index.ts) or the filter regex (fail2ban/filter.d/ccu-mcp.

[Read the thread](https://github.com/claymore666/ccu-mcp/issues/129) · 2026-07-29 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/claymore666/debmatic-mcp/issues).