Q Sys Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Q Sys Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Let an AI agent inspect and control a Q-SYS audio/video system over QSC's published QRC protocol — against a real Core or Q-SYS Designer's built-in emulator.
q-sys-mcp is an MCP server. It speaks QSC's QRC external-control protocol (JSON-RPC 2.0 over TCP) — the same interface third-party control systems like Crestron and AMX use — and exposes it to an LLM agent as a set of tools. Point it at a physical Q-SYS Core or at Q-SYS Designer running in Emulate mode and the agent can read meters, flip mutes, ramp gains, and watch controls for changes.
It's a pure wire-protocol client: zero QSC code, no SDK, no hardware required for development. That makes it a clean, sanctioned layer QSC ships on no platform — AI-native control — and it runs anywhere Node does.
localhost.node:net only; CI proves it on Linux, macOS, and Windows × Node 18 & 20.filter / names_only / type so large designs don't flood the agent's context.NoOp keepalive holds the socket open through QRC's 60 s idle close.Run it straight from npm (no install):
npx -y q-sys-mcp # MCP server on stdioOr from source:
git clone https://github.com/reowens/q-sys-mcp.git
cd q-sys-mcp
npm install # builds dist/ via the prepare hook
node dist/index.jsAdd it to your MCP client config (Claude Desktop, etc.):
{
"mcpServers": {
"q-sys": {
"command": "npx",
"args": ["-y", "q-sys-mcp"]
}
}
}From a local checkout instead, use "command": "node" with "args": ["/absolute/path/to/q-sys-mcp/dist/index.js"].
Always call qsys_connect first (host 127.0.0.1, port 1710 for a local emulator) before any other tool.
Once connected, just ask in natural language — the agent picks the tools.
You: "Connect to my Q-SYS emulator and bring the main gain down to −20 dB over 2 seconds."
The agent runs:
qsys_connect → { host: "127.0.0.1", port: 1710 }qsys_list_components → { type: "gain" } — finds the Levels gain blockqsys_set_component → { name: "Levels", controls: [{ name: "gain", value: -20, ramp: 2 }] }Or, if you've exposed that fader as a Named Control in Designer:
qsys_set_control → { name: "MainGain", value: -20, ramp: 2 }To watch a control live (meters, button states), create a change group and poll it:
qsys_create_change_group → { id: "meters", controls: ["MainGain"] }
qsys_poll_change_group → { id: "meters" } // returns only what changed since the last poll| Tool | QRC method | Purpose |
|---|---|---|
qsys_connect | (socket) + Logon/StatusGet | Connect to a Core/emulator |
qsys_status | StatusGet | Engine status (platform, design, run state) |
qsys_list_components | Component.GetComponents | List named components |
qsys_get_component_controls | Component.GetControls | A component's controls + values |
qsys_get_control | Control.Get | Get Named Control values |
qsys_get_component | Component.Get | Get specific component control values |
qsys_set_control | Control.Set | Set a Named Control (with optional ramp) |
qsys_set_component | Component.Set | Set component controls (with optional ramps) |
qsys_create_change_group | ChangeGroup.AddControl | Watch Named Controls for changes |
qsys_change_group_add_component | ChangeGroup.AddComponentControl | Watch a component's controls |
qsys_poll_change_group | ChangeGroup.Poll | Get changes since last poll |
qsys_destroy_change_group | ChangeGroup.Destroy | Free a change group's server-side state |
qsys_disconnect | (socket) | Close the connection |
qsys_list_components and qsys_get_component_controls accept optional filter (case-insensitive name substring), names_only, and — for components — type, to trim large designs before they reach the agent's context.
Q-SYS exposes controls two ways, and the tools mirror that split:
qsys_get_control / qsys_set_control) reach a control only if it's been explicitly exposed — dragged into the Named Controls pane in Designer with a unique name. Flat namespace, addressed by that one name.qsys_get_component_controls / qsys_get_component / qsys_set_component) reach any control on a component whose parent has a Code Name with Script Access enabled — no per-control naming needed.If qsys_get_control can't find a name, it almost always means the control hasn't been added to the Named Controls pane.
127.0.0.1:1710.QRC is fully functional in Emulate mode, so you can build and test without any hardware.
Writes mutate the running/emulated system. On an emulator, nothing persists unless you save the design in Designer.
npm test # offline: QRC integration + MCP-over-mock (no hardware)
npm run smoke -- 127.0.0.1 1710 # read-only smoke against a live emulator/Core
npm run smoke:mcp -- 127.0.0.1 1710 # full MCP-over-stdio smoke against a live target
npm run smoke:write -- 127.0.0.1 1710 # live WRITE round-trip: set a gain, verify, restore
npm run smoke:named -- MainGain # live Named-Control read/set + change-group poll
npm run smoke:keepalive # idle >60s, prove the socket survives QRC's idle closenpm test needs no hardware; every smoke:* script needs a live target (a real Core, or Designer in Emulate mode, on port 1710).
CI runs npm ci && npm run build && npm run typecheck && npm test on Linux, macOS, and Windows × Node 18 & 20 (.github/workflows/ci.yml). The whole suite is hardware-free — a mock QRC server plus an in-memory MCP transport — so the full matrix runs without a Core.
@q-sys/qrwc — a convenience adapter for real Cores. Raw QRC is the primary transport today; the lib is still beta.qsys_connect..qsys files) — out of scope: .qsys is a compressed .NET BinaryFormatter graph type-coupled to QSC's assemblies.See CHANGELOG.md for release notes, or the GitHub releases page.
MIT — see LICENSE. Q-SYS and QRC are trademarks/protocols of QSC, LLC; this project is an independent client and is not affiliated with or endorsed by QSC.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.