devices-mcp (sandraschi/devices-mcp) is an MCP server listed on the M8ven Trust Index. It scores 36 out of 100, grade F. It declares 175 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
F
Warning
36/100

devices-mcp

MCP server + web dashboard + Windows Tauri app for home LAN devices (Tapo, Hue, Ring, Nest, Shelly).

→ sandraschi/devices-mcp· listed on github_repo_search

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

sandraschi

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Hardcoded credentials detected
1 live-looking API key in source: 1 Google API key
// tools this server exposes160 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_devices

Get a comprehensive list of all Ring devices with real-time status.

get_device_details

Get detailed information about a specific device

get_device_events

Retrieve recent activity events and motion history for a Ring device.

get_live_stream_url

Generate a temporary live stream URL for Ring camera viewing.

set_arm_status

Arm or disarm Ring security systems and alarm devices (CRITICAL SECURITY OPERATION).

trigger_chime

Manually trigger doorbell chime for testing and signaling purposes.

health_check

Perform comprehensive health check of Ring MCP service and Ring connectivity.

base
agentic_security_workflow

Execute agentic security workflows using FastMCP 3.1+ sampling with tools.

listcameras
getcamerainfo
connectcamera
disconnectcamera
getcamerastatus
setactivecamera
query_logs

Query the in-memory message/log store. Filters by source, level, or keyword.

moveptz
saveptzpreset
recallptzpreset
getptzpresets
gotohomeptz
stopptz
getptzposition
assess_home_safety

🧠 **AI-Powered Home Safety Assessment with Sampling Intelligence**

coordinate_emergency_response

🚨 **AI Emergency Response Coordination with Sampling**

create_security_automation

Create custom security automation rule with triggers and responses

trigger_emergency_protocol

Activate emergency security protocol with full system response

schedule_security_modes

Configure time-based security mode scheduling for automated protection

get_camera_status

Get comprehensive status of all Ring security cameras

stream_all_cameras

Start live streams from all available Ring cameras

get_doorbell_status

Get comprehensive status of all Ring doorbells in the system

get_doorbell_live_stream

Get live video stream from Ring doorbell

answer_doorbell_call

Answer an active doorbell call with two-way audio communication

get_visitor_history

Get comprehensive visitor history with snapshots and event details

configure_motion_detection

Configure motion detection settings for Ring doorbell with advanced options

get_fire_alarm_status

Get comprehensive status of all Ring fire alarms and smoke detectors

test_fire_safety_system

Perform comprehensive test of fire safety system

list_available_tools

List all available Ring MCP tools with categories and descriptions

get_tool_help

Get detailed help and usage information for a specific tool

search_tools

Search for tools by name, description, or functionality

monitor_system_health

Perform comprehensive health check of entire Ring security system

get_real_time_activity

Get real-time activity feed from all Ring devices

get_security_system_status

Get comprehensive status of the entire Ring security system

arm_security_system

Arm the Ring security system with specified mode and options

disarm_security_system

Disarm the Ring security system safely with authentication

get_security_history

Get comprehensive security system history and event timeline

get_system_status

Get comprehensive system status including authentication and device connectivity

check_authentication_status

Check Ring API authentication status and token validity

check_device_connectivity

Test connectivity and status of all Ring devices

get_service_health

Get detailed service health and performance metrics

sceneanalyzer
nestprotect
getnestprotectstatus
getnestprotectalerts
testnestprotectdevice
getnestprotectbatterystatus
correlatenestcameraevents
securityanalysis
performanceanalyzer
smartautomation
cameraconnection
camerainfo
cameramanagement
addcamera
removecamera
managecameragroups
capturesnapshot
getstreamurl
usbcameramanagement
devicesettings
privacysettings
energymanagement
smartmeterstatus
smartmeterconsumption
smartmetercost
getsmartplugstatus
controlsmartplug
getenergyconsumption
getenergycostanalysis
setenergyautomation
gettapop115detailedstats
settapop115energysavingmode
gettapop115powerschedule
gettapop115datastorageinfo
viennadashboard
grafanametrics
grafanasnapshots
gethuelights
controlhuelight
gethuegroups
controlhuegroup
gethomeawarestatus
monitorhomeawaremotion
tapolighting
listtapolights
controltapolight
gettapolightstatus
imagecapture
captureimage
findsimilarimages

60 further tools are not listed here. The complete surface is in the source.

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configCONTAINER
configTAPO_MCP_LAZY_INIT
configMCP_BRIDGE_URLS
configTAPO_MCP_SKIP_HARDWARE_INIT
configDEVICES_MCP_AUTO_DISCOVER_USB
configTAPO_MCP_TOOL_MODE
configMETRICS_PORT
configOPENCV_LOG_LEVEL
configENABLE_MOCK_ENERGY
configPYTHONWARNINGS
configLOG_LEVEL
configHOST
configMCP_CENTRAL_DOCS
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

175/175 tools missing one or more hints — get_devices (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_device_details (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_device_events (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +172 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

No hardcoded API keys

1 live-looking API key in source: 1 Google API key

Move secrets to environment variables (process.env.X) or your secret manager.

Tool test coverage

Only 35/175 tools referenced in tests (20%)

Write tests that reference each tool by name so every tool has at least one test.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/sandraschi/devices-mcp?variant=verified)](https://m8ven.ai/mcp/sandraschi/devices-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 7bacfc9f6c8cbd4c59030183b09288d74cc1e66d
code hash: 4cc506e78f33e5ddc36ecae97d84c0208fbedd7a5c51fcda75418a606a78eb54
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client