Mcp Divoom Lan — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Divoom Lan (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
mcp-divoom-lan is an open-source MCP server for TimesFrame/AstroToo watchfaces and PIXOO64/TimeGate LAN display control. TimesFrame/AstroToo query Device/GetHardwareVersion; PIXOO64/TimeGate use discovery Hardware or explicit hardware profiles. Unknown hardware is rejected. The TimesFrame no-response fallback is retained after checking available discovery data.
PIXOO64 Hardware 90/92 uses 80/post; 96 uses 9000/divoom_api. Its 10 dedicated tools send display elements, text, RGB animations and control commands. Hardware 96 command lists execute sequentially in MCP to match the reference firmware. See the PIXOO64 guide and examples. Device firmware is unchanged.
It works together with the v2 HTML visual editor for modifying watchfaces, switching faces, adjusting brightness, and creating new local watchfaces.
TimeGate Hardware 400 uses 80/post; 402 uses 9000/divoom_api. Its 10 dedicated tools control five independent 128×128 screens and require LocalToken from device settings. Hardware 402 batches run sequentially in MCP. See the TimeGate guide for per-version field, alignment and background differences. Device firmware is unchanged.
v2 visual editor (public):
https://github.com/DivoomDevelop/divoom-watchface-visual-editor_v2https://divoomdevelop.github.io/divoom-watchface-visual-editor_v2/Your local clone path (e.g. D:\divoom-watchface-visual-editor) is machine-specific; use the v2 GitHub / GitHub Pages URLs above in docs and MCP metadata.
Divoom_Watchface_Remote_Customization_Guide_EN.md as MCP toolsHardware 510/511/512 selects TimesFrame; 530 AstroToo; 90/92/96 PIXOO64; 400/402 TimeGate. Explicit target.hardware is a caller profile override. Use pixoo64_* or timegate_* for those products; managed-watchface rules below apply to TimesFrame/AstroToo.ClockId from create and patch calls. The server injects its managed slot, reads it first, creates it when missing, and updates it when present.GetLocalClockInfo returns an empty `ItemList`: stop writes; switch to an editable watchface first.watchface_patch_local for edits. Use watchface_create_local_clock when the user asks to create a watchface or when intentionally replacing the complete managed configuration and backdrop.Discovery tool (1):
watchface_list_devices → returns selectable TimesFrame/AstroToo/PIXOO64/TimeGate targets with product-specific default portsDevice tools (15):
watchface_get_device_info → hardware identification and LAN capability reportwatchface_get_local → Device/GetLocalClockInfowatchface_patch_local → managed-slot upsert with no caller-supplied ClockId. Existing configurations use Device/PatchLocalClockInfo; a missing configuration is created when a backdrop and complete item tables are supplied.watchface_get_fonts_local → Device/GetLocalFontListwatchface_get_store_market_list → Device/GetStoreClockMarketListwatchface_set_clock_select → Channel/SetClockSelectId (TimesFrame queues a paired request inside one serialized MCP operation so a manual selection suppresses the active traditional schedule for the current period; AstroToo sends once)watchface_get_brightness → Sys/GetBrightnesswatchface_set_brightness → Channel/SetBrightnesswatchface_onoff_screen → Channel/OnOffScreen (1=on, 0=off)watchface_replace_dial_bg_file → POST /replace_clock_dial_bgwatchface_upload_file → AstroToo-only POST /upload_local_asset; returns a temporary local:// staging reference consumed by a successful create/patch. AstroToo keeps product photo/pixel POST /upload separate. TimesFrame generic /upload is blocked in local-only MCP mode.watchface_create_local_clock → managed-slot multipart upsert with no caller-supplied ClockId: /create_local_clock when missing and /patch_local_clock when already present.watchface_reset_local_then_cloud → Device/ResetLocalClockFromServerwatchface_get_screen_snapshot → Device/GetScreenSnapshot (downloads the returned AstroToo snapshot path; TimesFrame keeps its WebP fallback)watchface_raw_command → generic POST /divoom_apiOffline/model-aware authoring tools (6):
watchface_protocol_quick_reference → key protocol constraints for the modelwatchface_clock_catalog → product-specific ClockId, Chinese/English names, fonts, disp and item-id semantics; optional native configurationwatchface_disp_catalog → model-specific disp catalog and filterswatchface_font_catalog → model-specific font catalog; with a live AstroToo target it merges local availability into the AstroToo nameswatchface_template_search → curated TimesFrame or AstroToo watchface templateswatchface_layout_suggest → model-specific layout hints; AstroToo never receives TimesFrame coordinate statisticsPIXOO64 tools (10): pixoo64_get_device_info, pixoo64_send_animation, pixoo64_send_items, pixoo64_send_text, pixoo64_clear_text, pixoo64_set_brightness, pixoo64_onoff_screen, pixoo64_set_channel, pixoo64_play_gif, and pixoo64_command_list. Read divoom://pixoo64/guide and divoom://pixoo64/example. A direct LAN target can be { "host":"192.168.1.100", "model":"pixoo64", "hardware":90 }; omit port and DIVOOM_DEVICE_PORT to select the version's default.
TimeGate tools (10): timegate_get_device_info, timegate_send_items, timegate_send_text, timegate_clear_text, timegate_set_brightness, timegate_get_brightness, timegate_onoff_screen, timegate_select_clock, timegate_play_gif, and timegate_command_list. Read divoom://timegate/guide and divoom://timegate/example; authenticated calls supply localToken from the actual device settings.
Product data is stored by directory: resources/timesframe, resources/astrotoo, resources/pixoo64, resources/timegate, and resources/common. resources/products.json records Hardware mappings, per-screen canvas sizes, directories and routes. Runtime loaders never fall back to another product's data.
The original resource URIs retain TimesFrame semantics. AstroToo has separate 480×480 resources:
divoom://products/catalogdivoom://guide/quick-referencedivoom://skill/watchface-customizationdivoom://font/catalogdivoom://font/guidedivoom://disp/catalogdivoom://watchface/schemadivoom://watchface/example-minimaldivoom://guide/ai-watchfacedivoom://templates/curateddivoom://astrotoo/guidedivoom://astrotoo/disp/summarydivoom://astrotoo/disp/catalogdivoom://astrotoo/disp/guide/endivoom://astrotoo/disp/guide/zh-cndivoom://astrotoo/font/catalogdivoom://astrotoo/clocks/catalogdivoom://astrotoo/clocks/configsdivoom://astrotoo/templates/curateddivoom://astrotoo/watchface/example-minimaldivoom://astrotoo/watchface/schemaFor MCPB-compatible hosts (e.g. Claude desktop connectors, Smithery stdio releases), build a local bundle:
npm install -g @anthropic-ai/mcpbnpm run mcpb:packmcp-divoom-lan.mcpb (gitignored). The staging directory mcpb/staging/ is also gitignored.The bundle includes dist/, resources/, production node_modules, and a manifest.json with user fields for device IP, port, product detection, and timeout.
Published npm package:
{
"mcpServers": {
"divoom-lan": {
"command": "npx",
"args": ["-y", "mcp-divoom-lan@latest"],
"env": {
"DIVOOM_DEVICE_HOST": "192.168.1.120",
"DIVOOM_DEVICE_PORT": "9000",
"DIVOOM_DEVICE_MODEL": "auto",
"DIVOOM_TIMEOUT_MS": "45000"
}
}
}
}DIVOOM_DEVICE_HOST is optional. Leave it unset and include target.host in each tool call when one MCP server controls multiple devices.
Build from source:
cd tools/mcp-divoom-lan # or your clone root for this package
npm install
npm run build
npm startDevelopment (watch rebuild):
npm run devRegenerate AstroToo resources from the simulator and Divoom command server:
$env:DIVOOM_ASTROTOO_SIMULATOR_ROOT='D:\work\divoom_product\timebox\trunck\device\tool_src\lv_sim_visual_studio\LvglAstroTooSimulator'
$env:DIVOOM_ASTROTOO_DEVICE_ID='300400436'
npm run build:astrotooThe generator calls https://appchina.divoom-gz.com/ + command string with a JSON body. It obtains default IDs from Device/GetClockDefaultList (IsDefault=1), font names from Device/GetFontForAI, and missing configurations from Device/GetClockInfoV3.
Pre-release check (typecheck, build, pack dry-run):
npm run release:checkdocs/README.md — documentation indexdocs/quick-start.md — minimal setupdocs/mcp-tools.md — complete 42-tool API catalog and model-specific file policydocs/astrotoo-and-multiple-devices.md — hardware detection, multiple targets, and AstroToo local storagedocs/astrotoo-watchface-workflow.md — release-ready AstroToo create, update, switch, and screenshot workflowdocs/adding-products.md — product registry, isolated resource directories, and onboarding checksdocs/tool-examples.md — tool usage examples (includes §5b analog pointer layout)docs/disp-usage.md — choosing disp ids (pointer layout 131/132/233; net-gallery uniqueness 13/125–130/173–175)docs/html-visual-editor.md — using the visual editor with MCPdocs/safety-and-troubleshooting.md — safety and FAQsdocs/reference/ — condensed protocol rules (EN/ZH)docs/examples/ — sample requests/responses and catalogDIVOOM_DEVICE_HOST — device LAN IP (e.g. 192.168.1.120)DIVOOM_DEVICE_PORT — optional override; omit for PIXOO64 90/92 or TimeGate 400 port 80, otherwise 9000DIVOOM_DEVICE_MODEL — auto (default), timesframe, astrotoo, pixoo64, or timegateDIVOOM_DEVICE_HARDWARE — optional default-device profile: PIXOO64 90/92/96 or TimeGate 400/402; omit to use discoveryDIVOOM_TIMEGATE_LOCAL_TOKEN — optional LocalToken from the default TimeGate settings; matched by host, otherwise supply localToken per callDIVOOM_TIMEOUT_MS — request timeout ms, default 45000If DIVOOM_DEVICE_HOST is unset, each tool call must pass target.host. To control several devices, pass a different target on each call. The server serializes a complete operation per host while allowing independent devices to run concurrently.
{
"mcpServers": {
"divoom-lan": {
"command": "node",
"args": [
"/ABSOLUTE/PATH/to/tools/mcp-divoom-lan/dist/index.js"
],
"env": {
"DIVOOM_DEVICE_HOST": "192.168.1.120",
"DIVOOM_DEVICE_PORT": "9000",
"DIVOOM_DEVICE_MODEL": "auto",
"DIVOOM_TIMEOUT_MS": "45000"
}
}
}
}You can also copy client-config.example.json in this directory as a starting point.
mcp-divoom-lan) with this package at the repo root.LICENSE, SECURITY.md, CONTRIBUTING.md, CHANGELOG.md, RELEASE.md as applicable.npm run release:check.v0.3.0) with screenshots and sample requests if helpful.GLAMA_SUBMISSION_READY.md (including Dockerfile and glama.json). For MCP.so, follow MCP_SO_SUBMISSION_READY.md. For the Volcengine MCP catalog, see VOLCENGINE_SUBMISSION_READY.md (PR: https://github.com/volcengine/mcp-server/pull/398). For an Alibaba Cloud Bailian custom MCP deployed with npx, see BAILIAN_MCP_SUBMISSION_READY.md. For publishing a Coze HTTP plugin, see COZE_SUBMISSION_READY.md.watchface_get_local → watchface_patch_local (font size/color) → watchface_replace_dial_bg_file (background).Included in this repo (when present): LICENSE, CHANGELOG.md, CONTRIBUTING.md, SECURITY.md, RELEASE.md, optional checklist and directory templates, and .github/workflows/ci.yml.
Recommendation: no for the core MCP package — keep MCP lean. Offer the editor as a separate optional project.
https://github.com/DivoomDevelop/mcp-divoom-lanhttps://github.com/DivoomDevelop/divoom-watchface-visual-editor_v2https://divoomdevelop.github.io/divoom-watchface-visual-editor_v2/Benefits:
ItemList, then let the AI apply patchesThis repo ships standalone docs under docs/, docs/reference/, and docs/examples/. If you maintain full guides elsewhere, keep this tree synced or treat it as the distribution subset.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.