# Multi-stage image build ├── pyproject.toml # Package metadata and dependencies ├── uv.lock # Locked dependency versions ├── README.md ├── docs/ │ └── docker-compose.yml # Compose services (HTTP + stdio) ├── k8s/ │ └── deployment.yaml # Kubernetes: Namespace, Secret, ConfigMap, │ # Deployment, Service, Ingress (template) └── src/ └── deconz_mcp/ ├── __init__.py ├── __main__.py # CLI entrypoint and transport wiring ├── client.py # Async deCONZ REST API HTTP client └── server.py # FastMCP server: tools, resources, prompts ``` --- ## deCONZ API overview The server covers these API categories: | Category | Endpoints | |---|---| | Config | `GET /config`, `PUT /config` (permit join) | | Lights | `GET /lights`, `GET /lights/`, `PUT /lights//state`, `DELETE /lights/` | | Groups | `GET /groups`, `POST /groups`, `PUT /groups//action`, `DELETE /groups/` | | Scenes | Full CRUD under `/groups//scenes/` incl. recall and store | | Sensors | `GET /sensors`, `PUT /sensors//config`, `DELETE /sensors/` | | Rules | Full CRUD under `/rules/` | | Schedules | Full CRUD under `/schedules/` | | Touchlink | `POST /touchlink/scan`, identify, reset | For the full API reference, see the [deCONZ REST API documentation](https://dresden-elektronik.github.io/deconz-rest-doc/). --- ## Data & Privacy > **Preliminary assessment only — not legal advice.** See full notes below. ### Personal home use When this server runs in a private household and is accessed only by the residents, processing of smart-home device data is likely covered by the **household exemption** (GDPR Recital 18). In that scenario the GDPR does not apply and no additional compliance steps are required. ### Commercial or shared deployments Deploying this server in offices, rental properties, hotels, co-working spaces, or any environment where you process data on behalf of other people **takes you outside the household exemption**. In those cases: - **Presence and motion sensor data** constitutes personal behavioral data (Art. 4(1) GDPR). Establish a documented lawful basis (Art. 6) before processing it. - Conduct a **Data Protection Impact Assessment** (Art. 35) if the deployment involves systematic monitoring of occupants on a large scale. - Provide a **privacy notice** to data subjects describing what is collected, for how long, and under what legal basis. ### Security recommendations | Risk | Recommendation | |------|----------------| | API key exposed in URL paths and server access logs | Rotate the deCONZ API key periodically; restrict access to gateway logs | | Unencrypted transport | Enable TLS for any network-facing deployment (`DECONZ_TLS=true`); use a reverse proxy with a valid certificate | | MCP endpoint publicly accessible | Always set `MCP_AUTH_TOKEN` when binding to a non-loopback address | ### What this software does NOT do - No data is sent to third parties, analytics services, or cloud providers. - No telemetry, tracking pixels, or consent libraries are present in this codebase. - All communication stays between the MCP client, this server, and the local deCONZ gateway. ### Legal notice This GDPR assessment was generated as a preliminary, exploratory evaluation. It does not constitute legal advice and does not replace a legal audit. For binding guidance, consult a qualified data protection lawyer in your jurisdiction. --- ## License Apache 2.0 — see [LICENSE](LICENSE). ## Disclaimer This software is not affiliated with or endorsed by Dresden Elektronik. Use at your own risk. It does not come with any warranty of any kind. There is no liability for the developer. This software is a personal project that I maintain in my free time. Refer to the licence for more information.7:["$","div",null,{"className":"container mx-auto flex flex-col

Mcp Server For Deconz Server

Comments

Server Config