Fibaro MCP (ikari-software/fibaro-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 94 tools. No publisher has claimed this listing.
Enables control of Fibaro Home Center devices, scenes, variables, and system administration through natural language.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
ikari-software
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
first_runSetup helper. Use this when configuration is missing. Returns step-by-step instructions plus config templates for common MCP clients.
fibaro_deviceDevice management: list/get/control devices. IMPORTANT: Avoid 'op=list' without filters - it returns 1MB+ of data. Instead: use 'op=get' with 'name' parameter for specific devices, or filter with room_id/type/interface. Supports: turn_on, turn_off, set_brightness, set_color, set_temperature, action,…
fibaro_sceneScene management: list/get/run/stop scenes and Lua code. IMPORTANT: Avoid 'op=list' without filters - use 'op=get' with 'name' or 'id' for specific scenes, or filter by room_id. Supports: run, stop, create, update_lua, get_lua, delete.
fibaro_variableVariable intent tool: list/get/set/create/delete global variables.
fibaro_quick_appQuick App intent tool: list/create/update code/update variables/get lua/delete.
fibaro_homeHome/system management: rooms, sections, users, weather, energy_graph, energy_panel, system_info. For quick stats use 'op=device_stats'. For current power consumption use 'op=energy_panel'. For historical energy/power data use 'op=energy_graph'. Supports: rooms, sections, users, profiles, notificati…
find_by_nameFind devices, rooms, or scenes by name (case-insensitive, ignores diacritics). Returns ranked candidates.
resolve_by_nameResolve a single device by name (or multiple devices if the query is plural). Errors on ambiguity for singular queries.
list_devicesList all devices in the Fibaro system
get_deviceGet detailed information about a specific device
control_deviceControl a device by calling an action
turn_onTurn on a device (light, switch, etc.)
turn_offTurn off a device (light, switch, etc.)
set_brightnessSet brightness level for a dimmable light
set_colorSet RGB color for a color-capable light
set_temperatureSet the target temperature for a thermostat
list_roomsList all rooms in the Fibaro system
list_sectionsList all sections in the Fibaro system
list_scenesList all scenes in the Fibaro system
get_sceneGet detailed information about a specific scene
run_sceneExecute a scene
stop_sceneStop a running scene
list_global_variablesList all global variables
get_global_variableGet the value of a specific global variable
set_global_variableSet the value of a global variable
get_system_infoGet system information about the Fibaro Home Center
get_weatherGet current weather information
get_energy_panelGet energy consumption data from the energy panel
get_scene_luaGet the Lua script code from a scene
list_quick_appsList all Quick Apps (Lua-based applications)
get_device_luaGet Lua code and variables from a device (Quick App)
create_sceneCreate a new Lua scene
update_scene_luaUpdate the Lua code of an existing scene
delete_sceneDelete a scene
create_quick_appCreate a new Quick App (Lua application)
update_quick_app_codeUpdate the Lua code of a Quick App
update_quick_app_variablesUpdate Quick App variables
delete_deviceDelete a device (including Quick Apps)
create_roomCreate a new room
update_roomUpdate room properties
delete_roomDelete a room
create_sectionCreate a new section
update_sectionUpdate section properties
delete_sectionDelete a section
list_usersList all users
create_userCreate a new user
update_userUpdate user properties
delete_userDelete a user
list_profilesList all home profiles/modes
get_active_profileGet the currently active profile
set_active_profileSet the active profile/mode
list_notificationsList all notifications
send_notificationSend a notification to users
list_alarmsList all alarm partitions
arm_alarmArm an alarm partition
disarm_alarmDisarm an alarm partition
get_zwave_networkGet Z-Wave network status and nodes
start_zwave_inclusionStart Z-Wave inclusion mode
stop_zwave_inclusionStop Z-Wave inclusion mode
start_zwave_exclusionStart Z-Wave exclusion mode
stop_zwave_exclusionStop Z-Wave exclusion mode
remove_failed_zwave_nodeRemove a failed Z-Wave node
heal_zwave_networkHeal the Z-Wave network
create_backupCreate a system backup
list_backupsList available system backups
restore_backupRestore a system backup by ID
get_settingsGet system settings
update_settingsUpdate system settings
restart_systemRestart the Fibaro Home Center
get_event_logGet event logs
list_geofencesList all geofences
create_geofenceCreate a new geofence
update_geofenceUpdate an existing geofence
delete_geofenceDelete a geofence
list_pluginsList installed plugins
install_pluginInstall a plugin from URL
uninstall_pluginUninstall a plugin by ID
restart_pluginRestart a plugin by ID
trigger_custom_eventTrigger a custom event
list_climate_zonesList climate zones
set_climate_modeSet climate mode for a zone
get_device_statsGet device energy/power statistics with intelligent aggregation. Automatically handles large datasets by aggregating data based on time span. Returns aggregated metrics (power, energy, voltage, current) with min/max/avg values per time bucket.
fibaro_energy_graphGet historical energy/power data from Fibaro HC2 summary-graph API. Works for both devices and rooms. Returns time-series data aggregated by the HC2.
create_global_variableCreate a global variable
delete_global_variableDelete a global variable
fibaro_templateScene template management: list available templates, get template details, instantiate templates with parameters, add custom templates, or delete templates
fibaro_historyDevice state history: query historical device states, calculate statistics, aggregate data by time intervals, and export history
fibaro_scene_historyScene execution history: track scene runs, analyze performance, calculate success rates and execution durations
fibaro_backupComprehensive backup and restore: export Fibaro system configuration to JSON/YAML, validate imports, restore configurations
fibaro_bulkBulk operations: execute batch actions on multiple devices matching query criteria (room, type, interface, name pattern, properties)
fibaro_replInteractive Lua REPL: execute Lua code in sandboxed temporary scenes, manage REPL sessions, get execution output
fibaro_analyticsAnalytics and insights - USE THIS FOR OVERVIEWS instead of listing all devices/scenes. Operations: dashboard (comprehensive overview), system_health (quick health check), device_usage, energy_trends, scene_frequency, hourly_distribution, room_activity.
fibaro_integrationExternal integrations: webhook server (HTTP endpoints) and MQTT bridge (pub/sub). Requires optional dependencies (express, mqtt).
fibaro_automationAdvanced automation builder: create complex multi-step automations with conditions and actions, generate Fibaro Lua scenes
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
FIBARO_CACHE_TTL_MSFIBARO_CONFIG2. =/absolute/path/to/fibaro.json (single config file)FIBARO_HOST1. /FIBARO_USERNAME/FIBARO_PASSWORD env vars (explicit)FIBARO_HTTPSWhether to use HTTPS (optional, defaults to true)FIBARO_LOG_LEVELFIBARO_PASSWORD1. FIBARO_HOST/FIBARO_USERNAME/ env vars (explicit)FIBARO_PORTThe port number (optional, defaults to 443 for HTTPS, 80 for HTTP)FIBARO_TEMPLATES_PATHFIBARO_TOOLSETintent (default), legacy, or bothFIBARO_USERNAME1. FIBARO_HOST//FIBARO_PASSWORD env vars (explicit)Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
94/94 tools missing one or more hints — first_run (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); fibaro_device (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); fibaro_scene (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +91 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
57/94 tools referenced in tests (61%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.0.4 (high), axios@1.7.9 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/ikari-software/fibaro-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check