Tv One Mcp Anthropic Nodcr — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Tv One Mcp Anthropic Nodcr (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that exposes the TeamViewer Web API as tools for AI assistants — specifically for MCP clients that don't support Dynamic Client Registration (RFC 7591), such as Microsoft Copilot Studio / Power Platform custom connectors.
The server is an OAuth 2.0 authorization server + resource server that brokers access to TeamViewer. It never hands MCP clients a real TeamViewer token: it issues its own opaque, audience-bound tokens, holds TeamViewer credentials encrypted server-side, and resolves a live TeamViewer token internally on every tool call.
MCP client (Copilot Studio)
↕ OAuth via /authorize, /token (this server)
MCP server (this repo)
↕ OAuth via account.teamviewer.com + webapi.teamviewer.com
TeamViewerThis project ships as two parallel repos, because the target MCP clients speak OAuth client registration differently:
| Variant | Repo | Use for |
|---|---|---|
| DCR | NilsTv8/TV_ONE_MCP_Anthropic | Clients that support Dynamic Client Registration (e.g. Claude.ai connectors) |
| No-DCR (this repo) | NilsTv8/TV_ONE_MCP_Anthropic_noDCR | Clients that don't (e.g. Microsoft Copilot Studio / Power Platform) |
This repo accepts any client_id (no registration step), but still strictly validates redirect_uri — either an exact match against MCP_ALLOWED_REDIRECT_URIS, or a trusted domain (and its subdomains) via MCP_ALLOWED_REDIRECT_HOSTS. At least one of the two must be set, or every /authorize request is rejected (fail closed).
{TEAMVIEWER_MCP_URL}/callback (the public URL this server will run at, plus /callback — see Step 3).git clone https://github.com/NilsTv8/TV_ONE_MCP_Anthropic_noDCR.git
cd TV_ONE_MCP_Anthropic_noDCR
npm install
npm run build| Variable | Required | Description |
|---|---|---|
TEAMVIEWER_CLIENT_ID | Yes | TV OAuth app client ID (from Step 1) |
TEAMVIEWER_CLIENT_SECRET | Yes | TV OAuth app client secret |
MCP_ALLOWED_REDIRECT_URIS | No\* | Comma-separated list of exact, trusted MCP-client callback URLs |
MCP_ALLOWED_REDIRECT_HOSTS | No\* | Comma-separated list of trusted domains — matches that host exactly or any subdomain of it (e.g. consent.azure-apim.net covers Copilot Studio's global.consent.azure-apim.net, unitedstates.consent.azure-apim.net, etc.) |
TEAMVIEWER_MCP_URL | Yes | Public base URL of this server (no trailing slash) |
TEAMVIEWER_CALLBACK_URL | No | OAuth callback URL — defaults to {TEAMVIEWER_MCP_URL}/callback |
PORT | No | HTTP port (default 3000) |
\* At least one of MCP_ALLOWED_REDIRECT_URIS / MCP_ALLOWED_REDIRECT_HOSTS must be set.
No encryption-key variable is needed — TeamViewer tokens are encrypted server-side with a key generated fresh in memory on every boot (see Security design below).
TEAMVIEWER_CLIENT_ID=<id> \
TEAMVIEWER_CLIENT_SECRET=<secret> \
MCP_ALLOWED_REDIRECT_HOSTS=consent.azure-apim.net \
TEAMVIEWER_MCP_URL=https://<your-public-domain> \
PORT=3000 node dist/index.jsCreate a custom connector with OAuth 2.0 "Generic" authentication:
| Field | Value |
|---|---|
| Authorization URL | https://<your-public-domain>/authorize |
| Token URL | https://<your-public-domain>/token |
| Refresh URL | same as Token URL |
| Client ID / secret | from Step 1 |
| Scope | see Available scopes below |
Power Platform generates its own redirect URL per connector after you save it (https://<region>.consent.azure-apim.net/redirect/<connector-id>) — that's exactly what MCP_ALLOWED_REDIRECT_HOSTS=consent.azure-apim.net is for; you don't need to copy the generated URL anywhere.
| Endpoint | Purpose |
|---|---|
GET /.well-known/oauth-protected-resource (and /mcp suffix) | RFC 9728 protected resource metadata |
GET /.well-known/oauth-authorization-server | RFC 8414 authorization server metadata |
GET /authorize | Starts the OAuth flow → redirects to TeamViewer |
POST /token | Exchanges an authorization code or refresh token |
POST /revoke | Revokes a token |
GET /callback | TeamViewer redirects here after the user logs in |
(POST /register / Dynamic Client Registration is intentionally not offered in this variant — see the DCR repo instead.)
27 action-based tools (each multi-action tool takes a single action parameter plus action-specific fields):
| Group | Tools |
|---|---|
| Account & Company | tv_account, tv_company |
| Users & Access Management | tv_users, tv_deactivate_user_tfa, tv_get_user_effective_permissions, tv_get_user_roles, tv_respond_to_join_company_request, tv_user_roles, tv_user_role_assignments, tv_user_groups, tv_user_group_members |
| Contacts | tv_contacts |
| Devices & Device Groups | tv_device_groups, tv_managed_devices, tv_managed_device_managers, tv_managed_groups, tv_managed_group_managers |
| Policies | tv_teamviewer_policies, tv_monitoring_policies, tv_patch_policies |
| Monitoring | tv_monitoring |
| Sessions & Remote Control | tv_sessions, tv_connect_device |
| Reports & Event Logs | tv_connection_reports, tv_list_device_reports, tv_get_event_logs |
| Tokens | tv_tokens (permanent, non-expiring TeamViewer API tokens — separate from this server's own OAuth tokens) |
Each tool's description (visible via tools/list) documents its exact action values and parameters.
Requested during the OAuth flow; map to TeamViewer's own API permission scopes:
UserInfo.View · Computers.View · Computers.Edit · Computers.Delete · Groups.View · Groups.Create · Groups.Edit · Groups.Delete · Contacts.View · Contacts.Create · Contacts.Edit · Contacts.Delete · Partners.View · Sessions.ManualCreation
docker build -t teamviewer-mcp-nodcr .
docker run -p 3000:3000 \
-e TEAMVIEWER_CLIENT_ID=<id> \
-e TEAMVIEWER_CLIENT_SECRET=<secret> \
-e MCP_ALLOWED_REDIRECT_HOSTS=consent.azure-apim.net \
-e TEAMVIEWER_MCP_URL=https://<your-public-domain> \
teamviewer-mcp-nodcrThe image is a pinned, multi-stage, non-root build (compiles with dev dependencies in a build stage, ships only dist/ and production dependencies in the runtime stage) with a container HEALTHCHECK against /.well-known/oauth-authorization-server.
Hosted on Azure App Service with this Docker image. Azure terminates TLS; the server always runs plain HTTP internally. Deploys automatically on every push to master.
client_id is accepted, the allow-list (MCP_ALLOWED_REDIRECT_URIS / MCP_ALLOWED_REDIRECT_HOSTS) is the only check on where an authorization code can be sent; it's enforced so a mismatch gets a direct (non-redirecting) rejection, never a redirect to an unvalidated target.See CLAUDE.md in this repo for full architectural detail, local dev setup, and environment specifics.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.