grade F

10 days ago

glama

pixoo-mcp-server

Enables programmatic control of Divoom Pixoo LED matrices to display layered pixel art, animations, and hardware-rendered scrolling text. Users can compose complex visual scenes, push images, and manage device settings like brightness and channels through an LLM.

→ cyanheads/pixoo-mcp-server · listed on glama

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Code appears obfuscated

1 file are unreadable to a human reviewer. Cannot audit what they do.

⚠️

Known vulnerabilities in dependencies: 5 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 4 credentials: SPEECH_STT_API_KEY, SPEECH_TTS_API_KEY, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configAWS_LAMBDA_FUNCTION_NAME

configAWS_REGION

configDEV_MCP_SCOPES

configFORCE_COLOR

configFUNCTION_TARGET

configGCP_REGION

configGIT_PARAMS

configHUSKY

configIS_SERVERLESS

configK_SERVICE

configLLM_DEFAULT_TEMPERATURE

configLOGS_DIR

configMCP_ALLOWED_ORIGINS

configMCP_HTTP_PORT— HTTP server port 3010

configMCP_LOG_LEVEL— "": "info"

configMCP_SESSION_MODE

configMCP_TRANSPORT_TYPE— "": "stdio",

configNO_COLOR

configOAUTH_PROXY_AUTHORIZATION_URL

configOAUTH_PROXY_DEFAULT_CLIENT_REDIRECT_URIS

configOAUTH_PROXY_ISSUER_URL

configOAUTH_PROXY_REVOCATION_URL

configOAUTH_PROXY_SERVICE_DOCUMENTATION_URL

configOAUTH_PROXY_TOKEN_URL

configOPENROUTER_APP_NAME

configOPENROUTER_APP_URL

configOTEL_ENABLED— Enable OpenTelemetry instrumentation false

configOTEL_EXPORTER_OTLP_TRACES_ENDPOINT

configOTEL_LOG_LEVEL

configOTEL_SERVICE_NAME

configOTEL_SERVICE_VERSION

configOTEL_TRACES_SAMPLER_ARG

configPIXOO_IP— Be sure to set to the IP address of your Pixoo device on the local network.

🔐 secretSPEECH_STT_API_KEY

configSPEECH_STT_BASE_URL

configSPEECH_STT_DEFAULT_MODEL_ID

configSPEECH_STT_ENABLED

configSPEECH_STT_PROVIDER

configSPEECH_STT_TIMEOUT

🔐 secretSPEECH_TTS_API_KEY

configSPEECH_TTS_BASE_URL

configSPEECH_TTS_DEFAULT_MODEL_ID

configSPEECH_TTS_DEFAULT_VOICE_ID

configSPEECH_TTS_ENABLED

configSPEECH_TTS_PROVIDER

configSPEECH_TTS_TIMEOUT

configSTORAGE_FILESYSTEM_PATH

configSTORAGE_PROVIDER_TYPE— Storage backend: in-memory, filesystem, supabase, cloudflare-r2, cloudflare-kv, cloudflare-d1 in-memory

🔐 secretSUPABASE_ANON_KEY

🔐 secretSUPABASE_SERVICE_ROLE_KEY

configSUPABASE_URL

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/cyanheads-pixoo-mcp-server-hv7evi)](https://m8ven.ai/mcp/cyanheads-pixoo-mcp-server-hv7evi)

commit: 88eb0eab2f9853d89e87db4a0ea3bc4bbd7d4d87

code hash: b8c4e3f986114f486482aa0d0a839e8f24b4bcd50a9acaa80686f2f730bd5a4c

verified: 4/11/2026, 2:49:00 PM

view raw JSON →