AIRIOT MCP Server
MCP server for the AIRIOT IoT platform, enabling AI assistants to manage data tables, records, devices, alarms, files, and more through natural language.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
sshwsfc
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
get_tables查询AIRIOT数据表列表，支持过滤、排序和分页
get_table_by_id根据ID查询单个数据表的详细信息
create_table创建新的数据表，需要提供完整的表结构定义（schema）
update_table更新数据表信息
delete_table删除数据表
get_table_records查询数据表的记录列表，支持过滤、排序、分页和字段投影
get_record_by_id根据ID查询单个表记录的详细信息
create_record在指定表中创建新记录
update_record更新表记录数据
delete_record删除单条表记录
batch_delete_records批量删除表记录
get_table_tags查询数据表的所有属性点定义
get_record_tags查询表记录的属性点列表
get_latest_data查询设备属性点的最新数据
get_history_data查询设备属性点的历史时序数据
get_online_stats统计数据表下设备的在线状态
get_warning_rules查询报警规则列表，支持过滤、排序和分页
get_warning_rule_by_id根据ID查询单个报警规则的详细信息
create_warning_rule创建新的报警规则
update_warning_rule更新报警规则
delete_warning_rule删除报警规则
get_warnings查询报警列表，支持按级别、状态、设备、时间范围等过滤
get_warning_by_id根据ID查询单个报警的详细信息
create_warning创建新的报警记录
update_warning更新报警信息（状态、确认信息等）
delete_warning删除报警记录
batch_confirm_warnings批量确认报警
get_archived_warnings查询已归档的报警列表
restore_archived_warning恢复已归档的报警
get_archive_setting获取自动归档设置
update_archive_setting更新自动归档设置
get_warning_descriptions获取报警描述列表
archive_all_warnings一键归档所有符合条件的报警
get_warning_statistics获取报警统计信息（总数、各级别数量、各状态数量等）
get_latest_warnings获取最新的报警列表
get_warning_timeline获取报警时间线数据（指定时间段内的报警趋势）
get_warning_cleans查询报警清除规则列表
get_warning_clean_by_id根据ID查询单个清除规则的详细信息
create_warning_clean创建新的报警清除规则
update_warning_clean更新报警清除规则
delete_warning_clean删除报警清除规则
execute_warning_clean立即执行清除规则
get_alarms[已废弃] 请使用 get_warnings 替代。查询告警列表，支持按级别、状态、时间范围过滤
get_alarm_by_id[已废弃] 请使用 get_warning_by_id 替代。根据ID查询单个告警的详细信息
acknowledge_alarm[已废弃] 请使用 update_warning 替代。确认告警，将告警状态从active改为acknowledged
resolve_alarm[已废弃] 请使用 update_warning 替代。解除告警，将告警状态改为resolved
upload_file上传文件到AIRIOT平台
get_file_info获取文件信息
delete_file删除文件
send_control_command向设备发送控制命令
send_batch_control_commands批量发送控制命令
get_reports查询报表列表
get_report_by_id根据ID查询单个报表的详细信息
execute_report执行报表生成，返回报表数据
create_report创建新报表
update_report更新报表信息
delete_report删除报表
login用户登录，返回 token 和用户信息
get_current_user获取当前登录用户的信息
get_users获取用户列表
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
AIRIOT_BASE_URLexport ="https://your-airiot-server.com"AIRIOT_LOG_LEVELexport ="info"AIRIOT_PASSWORDexport ="your-password"AIRIOT_PROJECT_IDexport ="your-project-id"AIRIOT_RETRIESAIRIOT_TOKENexport ="your-api-token"AIRIOT_USERNAMEexport ="your-username"Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
120/120 tools missing one or more hints — get_tables (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_table_by_id (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_table (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +117 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.0.4 (high), axios@1.7.9 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
2 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Domain consistency
npm scope @airiot doesn't match GitHub owner sshwsfc
Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sshwsfc/mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check