Fibaro MCP (ikari-software/fibaro-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 94 tools. No publisher has claimed this listing.

D
Caution
54/100

Fibaro MCP

Enables control of Fibaro Home Center devices, scenes, variables, and system administration through natural language.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

ikari-software

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 14 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 1 credential: FIBARO_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes94 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

first_run

Setup helper. Use this when configuration is missing. Returns step-by-step instructions plus config templates for common MCP clients.

fibaro_device

Device management: list/get/control devices. IMPORTANT: Avoid 'op=list' without filters - it returns 1MB+ of data. Instead: use 'op=get' with 'name' parameter for specific devices, or filter with room_id/type/interface. Supports: turn_on, turn_off, set_brightness, set_color, set_temperature, action,

fibaro_scene

Scene management: list/get/run/stop scenes and Lua code. IMPORTANT: Avoid 'op=list' without filters - use 'op=get' with 'name' or 'id' for specific scenes, or filter by room_id. Supports: run, stop, create, update_lua, get_lua, delete.

fibaro_variable

Variable intent tool: list/get/set/create/delete global variables.

fibaro_quick_app

Quick App intent tool: list/create/update code/update variables/get lua/delete.

fibaro_home

Home/system management: rooms, sections, users, weather, energy_graph, energy_panel, system_info. For quick stats use 'op=device_stats'. For current power consumption use 'op=energy_panel'. For historical energy/power data use 'op=energy_graph'. Supports: rooms, sections, users, profiles, notificati

find_by_name

Find devices, rooms, or scenes by name (case-insensitive, ignores diacritics). Returns ranked candidates.

resolve_by_name

Resolve a single device by name (or multiple devices if the query is plural). Errors on ambiguity for singular queries.

list_devices

List all devices in the Fibaro system

get_device

Get detailed information about a specific device

control_device

Control a device by calling an action

turn_on

Turn on a device (light, switch, etc.)

turn_off

Turn off a device (light, switch, etc.)

set_brightness

Set brightness level for a dimmable light

set_color

Set RGB color for a color-capable light

set_temperature

Set the target temperature for a thermostat

list_rooms

List all rooms in the Fibaro system

list_sections

List all sections in the Fibaro system

list_scenes

List all scenes in the Fibaro system

get_scene

Get detailed information about a specific scene

run_scene

Execute a scene

stop_scene

Stop a running scene

list_global_variables

List all global variables

get_global_variable

Get the value of a specific global variable

set_global_variable

Set the value of a global variable

get_system_info

Get system information about the Fibaro Home Center

get_weather

Get current weather information

get_energy_panel

Get energy consumption data from the energy panel

get_scene_lua

Get the Lua script code from a scene

list_quick_apps

List all Quick Apps (Lua-based applications)

get_device_lua

Get Lua code and variables from a device (Quick App)

create_scene

Create a new Lua scene

update_scene_lua

Update the Lua code of an existing scene

delete_scene

Delete a scene

create_quick_app

Create a new Quick App (Lua application)

update_quick_app_code

Update the Lua code of a Quick App

update_quick_app_variables

Update Quick App variables

delete_device

Delete a device (including Quick Apps)

create_room

Create a new room

update_room

Update room properties

delete_room

Delete a room

create_section

Create a new section

update_section

Update section properties

delete_section

Delete a section

list_users

List all users

create_user

Create a new user

update_user

Update user properties

delete_user

Delete a user

list_profiles

List all home profiles/modes

get_active_profile

Get the currently active profile

set_active_profile

Set the active profile/mode

list_notifications

List all notifications

send_notification

Send a notification to users

list_alarms

List all alarm partitions

arm_alarm

Arm an alarm partition

disarm_alarm

Disarm an alarm partition

get_zwave_network

Get Z-Wave network status and nodes

start_zwave_inclusion

Start Z-Wave inclusion mode

stop_zwave_inclusion

Stop Z-Wave inclusion mode

start_zwave_exclusion

Start Z-Wave exclusion mode

stop_zwave_exclusion

Stop Z-Wave exclusion mode

remove_failed_zwave_node

Remove a failed Z-Wave node

heal_zwave_network

Heal the Z-Wave network

create_backup

Create a system backup

list_backups

List available system backups

restore_backup

Restore a system backup by ID

get_settings

Get system settings

update_settings

Update system settings

restart_system

Restart the Fibaro Home Center

get_event_log

Get event logs

list_geofences

List all geofences

create_geofence

Create a new geofence

update_geofence

Update an existing geofence

delete_geofence

Delete a geofence

list_plugins

List installed plugins

install_plugin

Install a plugin from URL

uninstall_plugin

Uninstall a plugin by ID

restart_plugin

Restart a plugin by ID

trigger_custom_event

Trigger a custom event

list_climate_zones

List climate zones

set_climate_mode

Set climate mode for a zone

get_device_stats

Get device energy/power statistics with intelligent aggregation. Automatically handles large datasets by aggregating data based on time span. Returns aggregated metrics (power, energy, voltage, current) with min/max/avg values per time bucket.

fibaro_energy_graph

Get historical energy/power data from Fibaro HC2 summary-graph API. Works for both devices and rooms. Returns time-series data aggregated by the HC2.

create_global_variable

Create a global variable

delete_global_variable

Delete a global variable

fibaro_template

Scene template management: list available templates, get template details, instantiate templates with parameters, add custom templates, or delete templates

fibaro_history

Device state history: query historical device states, calculate statistics, aggregate data by time intervals, and export history

fibaro_scene_history

Scene execution history: track scene runs, analyze performance, calculate success rates and execution durations

fibaro_backup

Comprehensive backup and restore: export Fibaro system configuration to JSON/YAML, validate imports, restore configurations

fibaro_bulk

Bulk operations: execute batch actions on multiple devices matching query criteria (room, type, interface, name pattern, properties)

fibaro_repl

Interactive Lua REPL: execute Lua code in sandboxed temporary scenes, manage REPL sessions, get execution output

fibaro_analytics

Analytics and insights - USE THIS FOR OVERVIEWS instead of listing all devices/scenes. Operations: dashboard (comprehensive overview), system_health (quick health check), device_usage, energy_trends, scene_frequency, hourly_distribution, room_activity.

fibaro_integration

External integrations: webhook server (HTTP endpoints) and MQTT bridge (pub/sub). Requires optional dependencies (express, mqtt).

fibaro_automation

Advanced automation builder: create complex multi-step automations with conditions and actions, generate Fibaro Lua scenes

// known CVEs in dependencies1 critical14 high5 medium11 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@4.0.16GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.0.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.7.9GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.7.9GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.7.9GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configFIBARO_CACHE_TTL_MS
configFIBARO_CONFIG2. =/absolute/path/to/fibaro.json (single config file)
configFIBARO_HOST1. /FIBARO_USERNAME/FIBARO_PASSWORD env vars (explicit)
configFIBARO_HTTPSWhether to use HTTPS (optional, defaults to true)
configFIBARO_LOG_LEVEL
🔐 secretFIBARO_PASSWORD1. FIBARO_HOST/FIBARO_USERNAME/ env vars (explicit)
configFIBARO_PORTThe port number (optional, defaults to 443 for HTTPS, 80 for HTTP)
configFIBARO_TEMPLATES_PATH
configFIBARO_TOOLSETintent (default), legacy, or both
configFIBARO_USERNAME1. FIBARO_HOST//FIBARO_PASSWORD env vars (explicit)
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

94/94 tools missing one or more hints — first_run (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); fibaro_device (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); fibaro_scene (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +91 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

57/94 tools referenced in tests (61%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.0.4 (high), axios@1.7.9 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/ikari-software/fibaro-mcp?variant=verified)](https://m8ven.ai/mcp/ikari-software/fibaro-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: feaba90376b76cc359c27117952033e4d448c8fe
code hash: 7f8093dac1409b2e58e619a52bcf06f0877b1fcdd35080c88b7a50ce5439f818
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client