Model Context Protocol

Intelligent Loxone Control for AI

Generic Model Context Protocol server that automatically discovers your Loxone Generation 1 devices and exposes only available features to AI assistants. Supports natural language commands in German, English, or mixed languages.

πŸ’‘
🏠
πŸ”§
∞
Device Types Supported
27
MCP Tools
7
Feature Categories
100%
Configuration Coverage
--%
Test Coverage
--
Tests Passed
--
Lines Covered
--
Functions
--
Branches

Adaptive System Discovery

🌍

Multilingual Support

Natural commands in German, English, or mixed languages. "Licht an", "turn off lights", or "Rolladen OG runter" - automatically adapts to your system's available devices.

🎭

Scene Management

Intelligent capability detection automatically discovers lights, blinds, weather sensors, security devices, and more - only exposing features your system actually has.

πŸ“Š

Sensor Monitoring

Smart device discovery analyzes your Loxone structure and automatically categorizes devices by type, room, and function - no manual configuration needed.

πŸ’‘

Lighting Presets

Universal device control with intelligent action mapping - automatically handles lights, blinds, switches, sensors based on your specific configuration.

🏠

Room Intelligence

Advanced reconnection system with automatic token refresh, WebSocket monitoring, and connection health checks for reliable 24/7 operation.

πŸ”’

Local Keychain Security

Configuration-aware AI assistance - prevents attempts to control non-existent devices and provides clear guidance on what your system can actually do.

Auto-Discovery Active
Capability Detection
Configuration-Aware
27 MCP Tools Available

Deployment Options

πŸ€–

Claude Desktop Integration

Direct integration with Claude Desktop app for conversational smart home control through natural language.

🌐

HTTP Server (SSE)

Web-based API server for integration with n8n, Home Assistant, webhooks, and browser applications.

⌨️

Command Line (STDIN)

Direct command-line interface for scripting, automation, and integration with shell scripts.

🐳

Docker Deployment

Containerized deployment with Docker Compose for production environments and service integration.

1

Install Dependencies

Install uv/uvx (Python package manager), clone the repository, and sync dependencies. Requires Python 3.11+ and Git.

2

Configure Credentials

Secure setup storing credentials in your local system keychain - never in files or cloud

3

Choose Deployment

Select your preferred deployment method: Claude Desktop, HTTP Server, CLI, or Docker

Quick Installation
# 1. Install uv (Python package manager)
# macOS/Linux:
curl -LsSf https://astral.sh/uv/install.sh | sh
# Windows:
# powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

# 2. Clone and setup project
git clone https://github.com/avrabe/mcp-loxone-gen1.git
cd mcp-loxone-gen1
uv sync

# 3. Configure credentials (one-time setup)
uvx --from . loxone-mcp setup
πŸ’» Interactive Setup Demo
$ _

HTTPS Security Setup

πŸ”’

Development HTTPS

Self-Signed & mkcert: Quick setup for local development with trusted certificates. Interactive setup script guides you through certificate generation and configuration.

πŸš€

Production HTTPS

Let's Encrypt & Commercial: Production-ready deployment with automatic certificate management. Reverse proxy configurations for nginx and Traefik included.

πŸ›‘οΈ

Security Benefits

End-to-End Protection: Encrypted API key transmission, browser compatibility, timing attack prevention, and production security compliance standards.

Interactive HTTPS Setup
# Interactive setup wizard
./scripts/setup-https.sh

# Options available:
# 1. Development: Self-signed certificate
# 2. Development: mkcert (trusted by browsers)
# 3. Production: Use existing certificates  
# 4. Production: Generate CSR for CA signing
# 5. Show current configuration

# Quick self-signed setup
./scripts/generate-self-signed-cert.sh

# Start HTTPS server
export LOXONE_SSE_USE_HTTPS=true
uvx --from . loxone-mcp-sse
Production Deployment Examples
# Docker with HTTPS
docker-compose -f docker-compose.ssl.yml up

# Nginx reverse proxy with Let's Encrypt
docker-compose -f docker-compose.prod.yml up

# Environment variables for HTTPS
export LOXONE_SSE_USE_HTTPS=true
export LOXONE_SSL_CERT=certs/server.crt
export LOXONE_SSL_KEY=certs/server.key
export LOXONE_SSL_PORT=8443

# Test HTTPS endpoint with API key
curl -H "Authorization: Bearer your-api-key" \
  https://your-domain.com:8443/health

Deployment Methods

πŸ€– Claude Desktop

claude_desktop_config.json
{
  "mcpServers": {
    "loxone": {
      "command": "uvx",
      "args": ["--from", "/path/to/mcp-loxone-gen1", "loxone-mcp-server"],
      "env": {
        "LOXONE_LOG_LEVEL": "INFO"
      }
    }
  }
}

🌐 HTTPS Server (SSE)

Start Secure HTTPS Server
# Setup HTTPS certificates first
./scripts/setup-https.sh

# Start HTTPS SSE server with authentication
LOXONE_SSE_USE_HTTPS=true uvx --from . loxone-mcp-sse

# HTTP fallback for development only
uvx --from . loxone-mcp-sse

# Production HTTPS with custom API key
LOXONE_SSE_USE_HTTPS=true \
LOXONE_SSE_API_KEY=your-secure-key \
uvx --from . loxone-mcp-sse

# Use API key with HTTPS endpoints:
curl -H "Authorization: Bearer " https://localhost:8443/sse
curl -H "X-API-Key: " https://localhost:8443/health

⌨️ Command Line (STDIN)

CLI Usage
# Direct MCP protocol via STDIN
echo '{"method":"list_rooms","params":{},"id":1}' | \
  uvx --from . loxone-mcp-server

# For scripts and automation
uv run python -m loxone_mcp

# Pipe commands from files
cat commands.json | uvx --from . loxone-mcp-server

🐳 Docker Deployment

Secure Docker Compose
# HTTP deployment (development)
docker-compose -f docker-compose.sse.yml up

# HTTPS deployment (production)
./scripts/setup-https.sh  # Generate certificates
docker-compose -f docker-compose.ssl.yml up

# Environment variables for production
LOXONE_HOST=192.168.1.100
LOXONE_USER=your-username  
LOXONE_PASS=your-password
LOXONE_SSE_REQUIRE_AUTH=true
LOXONE_SSE_API_KEY=your-secure-api-key

# HTTPS configuration (optional)
LOXONE_SSE_USE_HTTPS=true
LOXONE_SSL_PORT=8443

# Test authenticated HTTPS endpoint
curl -H "Authorization: Bearer " \
  https://localhost:8443/health

Natural Language Examples

πŸ‡¬πŸ‡§ English Commands

  • "Turn on all lights in the living room"
  • "Close all blinds upstairs"
  • "Set bedroom lights to 30%"
  • "Activate night mode"
  • "Check temperature in office"

πŸ‡©πŸ‡ͺ Deutsche Befehle

  • "Licht im Wohnzimmer einschalten"
  • "Alle Rolladen im OG runter"
  • "Schlafzimmer auf 30% dimmen"
  • "Nachtmodus aktivieren"
  • "Temperatur im BΓΌro prΓΌfen"

🌍 Mixed Language

  • "Turn off Licht in KΓΌche"
  • "Rolladen in living room hoch"
  • "Dimme OG bathroom auf 20%"
  • "Morning routine starten"
  • "Check Luftfeuchtigkeit upstairs"
Capability-Aware Discovery
# Check what your system can do first
get_available_capabilities()         # Shows only your available features

# Auto-discovery finds your devices
discover_all_devices()               # Analyzes your specific setup
get_devices_by_category("Lighting")  # Only shows if you have lights

# Configuration-aware control
control_device("your_room_light", "on")    # Only works if device exists
get_weather_data()                   # Only available if weather sensors found
get_security_status()                # Only works with security devices
Dynamic Feature Detection
# Each feature automatically checks availability
if capabilities.has_weather:
    get_weather_data()                 # Only if weather stations exist
    
if capabilities.has_security:
    get_security_status()              # Only if security devices found

# Error handling with helpful guidance
> get_audio_zones()
{"error": "No audio devices available",
 "available_features": ["lighting", "blinds", "weather"]}

# Adaptive to your configuration - no hardcoded assumptions!

Security & Compatibility

πŸ”

System Keychain Security

OS-Level Encryption: All credentials stored in system keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service). Zero cloud storage - complete local privacy with OS-managed encryption.

🎫

JWT Token Authentication

Loxone Protocol: HMAC-based JWT token exchange with automatic refresh. Secure authentication flow using Gen 1 Miniserver's token API with connection health monitoring and graceful reconnection.

🌐

HTTPS & API Key Protection

Web Integration Security: SSE server with HTTPS/TLS encryption and API key authentication. Bearer token transmission over encrypted channels. Self-signed certificates for development, Let's Encrypt for production.

πŸ›‘οΈ

Multi-Layer Security Model

Defense in Depth: Environment variable override, constant-time comparisons, request logging, health check endpoints. Production-ready with Docker support and systematic credential management.

🏠

Local Network Architecture

Zero External Dependencies: All communication stays within your home network. No cloud services, no external APIs. VPN recommended for remote access. Complete network isolation design.

βš™οΈ

Configuration-Aware Security

Adaptive Authentication: Setup wizard detects your environment and configures appropriate security. Skip SSE if unneeded, auto-generate keys, environment overrides for CI/CD workflows.

Comprehensive Security Architecture
πŸ” System Keychain Security Layer macOS Keychain Windows Credential Manager Linux Secret Service OS-Level Encryption β€’ Zero Cloud Storage β€’ Environment Override 🎫 JWT Token Authentication β€’ HMAC-SHA256 token exchange β€’ Automatic refresh before expiry β€’ Connection health monitoring β€’ Loxone Gen1 API compatibility β€’ Graceful reconnection handling 🌐 API Key Protection β€’ 32-byte cryptographically secure β€’ Bearer token OR X-API-Key header β€’ Constant-time comparison β€’ Request logging & IP tracking β€’ Auto-generation & keychain storage For AI Assistants Claude Desktop β€’ MCP Protocol For Web Integrations n8n β€’ Home Assistant β€’ Webhooks πŸ›‘οΈ Production Security Features Health Checks Docker Support Setup Wizard CI/CD Override Local Network Only
Dual Authentication Flows
Complete Authentication Architecture 🎫 MCP Mode: JWT Token Authentication MCP Server Keychain Loxone Gen1 Claude AI 1. Store Loxone creds 2. "Turn on lights" 3. Get creds 4. JWT token exchange 5. Device control 6. "Lights turned on" 🌐 SSE Mode: API Key Authentication SSE Server Keychain Loxone Gen1 n8n/HA 1. Store API key 2. Bearer token request 3. Verify key 4. JWT + Device control 5. JSON response πŸ” One-Time Setup Wizard $ uvx --from . loxone-mcp setup 1. Network Discovery β€’ Auto-discover Miniservers on network β€’ Test connection before storing 2. Loxone Credentials β€’ Store in OS keychain (encrypted) β€’ Environment override available 3. SSE API Key β€’ Generate secure 32-byte token β€’ Custom key or skip options β€’ Store alongside Loxone creds 4. Security Validation β€’ Test both MCP and SSE auth β€’ Display integration examples β€’ Ready for production use βœ… Complete Security Setup πŸ” All credentials in OS keychain 🎫 JWT authentication ready 🌐 API key protection enabled πŸ›‘οΈ Production deployment ready 🏠 Local network security model βš™οΈ CI/CD environment overrides πŸ” OS Keychain Encryption 🎫 HMAC-SHA256 JWT πŸ”’ HTTPS/TLS Encryption πŸ›‘οΈ Constant-Time Comparison 🏠 Local Network Security βš™οΈ Production Ready
Complete Security Architecture Deployment
πŸ—οΈ Security Architecture Deployment πŸ’» Developer Machine πŸ” OS Keychain Encrypted Storage πŸ€– MCP Server JWT Authentication πŸ”’ HTTPS SSE Server TLS + API Key Auth 🧠 Claude Desktop Local MCP Client πŸ–₯️ Production Server βš™οΈ Environment Variable Override πŸ”’ Docker HTTPS Port 8443 (TLS) ❀️ Health Check /health endpoint πŸ“Š Monitoring Request Logging πŸ”Œ Integrations πŸ€– n8n Workflow Bearer Token 🏠 Home Assistant X-API-Key Header πŸ“± Custom Apps RESTful API 🌐 Web Dashboard Browser Auth 🏠 Loxone Generation 1 Infrastructure 🧠 Miniserver Basic HTTP Auth 192.168.x.x πŸ”Œ Extensions Dimmer/Relay Tree/Bus πŸ’‘ Devices Lights/Blinds Sensors πŸ›‘οΈ Development Zone β€’ Local keychain security β€’ Direct MCP connection πŸš€ Production Zone β€’ Environment variables β€’ Docker containerization 🌐 Integration Zone β€’ HTTPS + API key auth β€’ Encrypted endpoints JWT API Key HTTP Auth πŸ—οΈ Deployment Architecture: πŸ’» Development: Local HTTPS with self-signed certificates and keychain encryption πŸ–₯️ Production: Docker HTTPS with Let's Encrypt certificates and environment security πŸ”Œ Integrations: Web services use encrypted API key authentication over TLS