Domotz

io.github.WYRE-AIPublished by GitHub account WYRE-AIv1.1.14Updated Oct 24, 2026

MCP server for Domotz network monitoring — agents, devices, alerts, and network discovery.

VerifiedSTDIODesktop onlyCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

Connects an AI assistant to Domotz network monitoring so it can inspect agents, devices, alerts, metrics, topology and power state.

What you can do
  • Manage Domotz monitoring agents
  • View and manage network alerts
  • Discover devices and check their status
  • Read network performance metrics
  • Inspect network topology and configuration
  • Manage power for managed devices
When to use it
Useful for MSPs and network administrators who already run Domotz and want an assistant to answer questions about device status, alerts and network health, or to act on alerts without switching to the Domotz portal.
Requirements
Runs locally over stdio (npm package or container image) or as an HTTP server. Needs a Domotz Public API key in DOMOTZ_API_KEY, plus DOMOTZ_API_URL or DOMOTZ_REGION for the regional endpoint. HTTP mode additionally requires CONDUIT_S2S_SECRET and, in gateway mode, an X-Domotz-API-Key header per request. Node.js for the npm route.
Before you install
The Domotz API key grants access to your monitoring environment; keep it out of configs you commit. Some domains are described as managing alerts and power, so the assistant may change state, not just read it. HTTP mode needs a real CONDUIT_S2S_SECRET; the insecure development override disables authentication and should stay loopback-only. Requests go to Domotz's regional API.

Installation

In SourceWeft

  1. Open Domotz in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Domotz MCP Server

[License] [Node.js]

A Model Context Protocol (MCP) server for Domotz network monitoring and management. Enables AI assistants to monitor network devices, view alerts, check device status, and manage network infrastructure.

This is a Model Context Protocol (MCP) server that connects Claude (or any MCP-compatible AI) to your Domotz environment.

Part of the MSP Claude Plugins ecosystem — a growing suite of AI integrations for the MSP stack. Built by MSPs, for MSPs.

Installation

bash
npm install @wyre-ai/domotz-mcp

Configuration

Copy .env.example and set the variables below.

VariableRequiredDescription
DOMOTZ_API_KEYFor stdio and AUTH_MODE=envDomotz Public API key
DOMOTZ_REGIONNoAPI region cell label (default: us-east-1)
MCP_TRANSPORTNostdio (default) or http
AUTH_MODENogateway (Docker image and Compose default) or env. Gateway mode requires X-Domotz-API-Key on each /mcp request and never falls back to DOMOTZ_API_KEY. env uses that variable only after S2S auth succeeds.
CONDUIT_S2S_SECRETYes for HTTPService-to-service secret. The HTTP server logs an error and exits non-zero when this is empty or a known placeholder (changeme, secret, your-s2s-secret, replace-with-a-real-secret, and the other values rejected in src/http.ts). Compose will not start without it. Never commit a real value. The value is never logged.
MCP_ALLOW_INSECURE_DEVNoSet to exactly 1 only for local development to start HTTP without CONDUIT_S2S_SECRET. The process logs a warning, does not enforce X-Gateway-S2S, and binds 127.0.0.1 only. A non-loopback MCP_HTTP_HOST is ignored and the override is logged. A known placeholder secret is still refused.
MCP_HTTP_HOSTNoBind address when MCP_TRANSPORT=http. Defaults to 127.0.0.1. Honored when CONDUIT_S2S_SECRET is set. The container image sets 0.0.0.0.
MCP_HTTP_PORTNoHTTP port. Defaults to 8080.

/health stays unauthenticated and does not read credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

HTTP authentication

With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S. The check is verifyS2sHeader in src/s2s-verify.ts: the header value is t=<unix seconds>,v1=<hex>, where the hex is HMAC-SHA256 of the literal string t=<unix seconds> keyed with CONDUIT_S2S_SECRET (64 lowercase hex characters). The timestamp must be within 300 seconds of the server clock. A missing or invalid header returns 401 before vendor credentials are read.

bash
TS=$(date +%s)SIG=$(printf 't=%s' "$TS" | openssl dgst -sha256 -hmac "$CONDUIT_S2S_SECRET" -hex | awk '{print $NF}')curl -sS http://127.0.0.1:8080/mcp \  -H 'Content-Type: application/json' \  -H 'Accept: application/json, text/event-stream' \  -H "X-Gateway-S2S: t=${TS},v1=${SIG}" \  -H "X-Domotz-API-Key: $DOMOTZ_API_KEY" \  -H 'X-Domotz-Region: us-east-1' \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

In AUTH_MODE=gateway, /mcp also requires X-Domotz-API-Key (X-Domotz-Region is optional and defaults to us-east-1). That header is the only credential source for the request. In AUTH_MODE=env, a valid X-Gateway-S2S header is still required and vendor credentials come from DOMOTZ_API_KEY.

Usage

Running with Claude Desktop

Add to your Claude Desktop claude_desktop_config.json:

json
{  "mcpServers": {    "domotz-mcp": {      "command": "npx",      "args": ["@wyre-ai/domotz-mcp"],      "env": {        "DOMOTZ_API_KEY": "your-domotz-api-key"      }    }  }}

Running with Claude Code (CLI)

bash
claude mcp add domotz-mcp \  -e DOMOTZ_API_KEY=your-value \  -- npx -y @wyre-ai/domotz-mcp

Docker

The image listens on 0.0.0.0 inside the container (MCP_HTTP_HOST) and defaults to AUTH_MODE=gateway. Publish the port on loopback and pass the S2S secret. In gateway mode, the Domotz API key arrives on each request as X-Domotz-API-Key; it is not read from the environment. Compose does not set DOMOTZ_API_KEY.

bash
docker build -t domotz-mcp .docker run \  -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \  -p 127.0.0.1:8080:8080 \  domotz-mcp

Compose refuses to start when CONDUIT_S2S_SECRET is unset, sets AUTH_MODE=gateway, and publishes 127.0.0.1:8080:8080. Generate the secret with openssl rand -hex 32; do not use a placeholder such as your-s2s-secret.

bash
CONDUIT_S2S_SECRET="$(openssl rand -hex 32)" docker compose up

Single-tenant HTTP (AUTH_MODE=env) still requires the S2S secret, then uses DOMOTZ_API_KEY:

bash
docker run \  -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \  -e AUTH_MODE=env \  -e DOMOTZ_API_KEY=your-value \  -e DOMOTZ_REGION=us-east-1 \  -p 127.0.0.1:8080:8080 \  domotz-mcp

Local HTTP without a secret is development-only. It binds 127.0.0.1 only and logs a warning. A non-loopback MCP_HTTP_HOST, including 0.0.0.0, is ignored:

bash
MCP_TRANSPORT=http MCP_ALLOW_INSECURE_DEV=1 npm run start:http

Available Domains

Agents

Manage Domotz monitoring agents

Alerts

View and manage network alerts

Devices

Device discovery and status monitoring

Metrics

Network performance metrics

Network

Network topology and configuration

Power

Power management for managed devices

Development

bash
# Clone the repositorygit clone https://github.com/WYRE-AI/domotz-mcp.gitcd domotz-mcp
# Install dependenciesnpm install
# Buildnpm run build
# Run testsnpm test
# HTTP transport refuses to start until CONDUIT_S2S_SECRET is a real secretCONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" npm run start:http
# Local HTTP only, without a service-to-service secret (always binds 127.0.0.1)MCP_ALLOW_INSECURE_DEV=1 npm run start:http

Contributing

Contributions are welcome! Please see CONTRIBUTING.md if present, or open an issue to discuss changes.

License

Licensed under the Apache License, Version 2.0. See LICENSE for details.

Source: README.md at commit 7472640

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v1.1.14LatestOct 14, 2026
  2. v1.1.13Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts