Nr Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Nr Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.Texan-NXTassist/nr-mcp -->
A Model Context Protocol (MCP) server that lets AI assistants interact with Node-RED — read flows, search nodes, edit function code, deploy changes safely, and manage modules.
Built to solve real problems: the existing Node-RED MCP implementations use PUT /flow/:id which reorders your tabs. nr-mcp uses the correct GET → POST /flows pattern with optimistic locking, so your tab order is always preserved.
13 tools for complete Node-RED flow management:
| Tool | Description |
|---|---|
nr_get_flow_summary | Overview of all tabs with node counts and groups |
nr_get_flow | Get a single tab with all nodes — by name or ID |
nr_search_nodes | Search nodes by name, type, or JavaScript code content |
nr_get_function_code | Extract full JS code from function nodes (incl. init/finalize) |
nr_get_node_config | Full config with computed upstream/downstream connections |
nr_get_flow_context | Read flow-level context variables |
nr_safe_deploy | Deploy changes with optimistic locking — never reorders tabs |
nr_create_nodes | Batch-create nodes/groups in a single deploy |
nr_delete_nodes | Batch-delete with automatic wire and group cleanup |
nr_inject | Trigger inject nodes remotely to test flows |
nr_get_installed_modules | List installed modules and available node types |
nr_install_module | Install npm packages from the Node-RED registry |
nr_get_debug_output | Read debug/error data from flow context |
PUT /flow/:id which silently reorders your tabs in Node-RED. nr-mcp uses the correct GET → POST /flows full-deploy pattern.rev field. If someone else deployed between your read and write, you get a clear conflict error instead of silent data loss.pip install nr-mcpuv tool install nr-mcpOr from source:
git clone https://github.com/Texan-NXTassist/nr-mcp.git
cd nr-mcp
uv tool install .This creates the nr-mcp command in ~/.local/bin/.
| Variable | Required | Description |
|---|---|---|
NR_URL | No | Node-RED URL (default: http://localhost:1880) |
NR_TOKEN | No* | Bearer token for token-based auth |
NR_USER | No* | Username for Basic Auth |
NR_PASS | No* | Password for Basic Auth |
\* At least one auth method is recommended. Auth is checked in order: token → basic auth → no auth.
Add to your claude_desktop_config.json:
{
"mcpServers": {
"nr-mcp": {
"command": "nr-mcp",
"env": {
"NR_URL": "http://localhost:1880",
"NR_USER": "admin",
"NR_PASS": "your-password"
}
}
}
}Tip: If you get a "working directory" error, create a wrapper script: ``bash #!/bin/bash cd /tmp exec nr-mcp "$@"`Then pointcommand` to the wrapper path.
Add to your MCP settings (.cursor/mcp.json or VS Code equivalent):
{
"mcpServers": {
"nr-mcp": {
"command": "nr-mcp",
"env": {
"NR_URL": "http://localhost:1880",
"NR_TOKEN": "your-access-token"
}
}
}
}Once connected, you can ask your AI assistant things like:
nr-mcp is a Python MCP server that communicates with Node-RED via its Admin API. It uses stdio transport (standard for MCP) and makes HTTP calls to your Node-RED instance.
AI Assistant ↔ MCP (stdio) ↔ nr-mcp ↔ HTTP ↔ Node-RED Admin APIPUT /flow/:id which reorders tabs.rev field to detect concurrent modifications.For more details, see docs/ARCHITECTURE.md.
The Admin API must be enabled (it is by default). If you've restricted it, ensure these endpoints are accessible:
GET /flows and POST /flows — flow read/writeGET /context/flow/:id — flow contextPOST /inject/:id — inject triggerGET /nodes and POST /nodes — module managementSee Node-RED Admin API docs for auth configuration.
Contributions welcome! Please open an issue first to discuss what you'd like to change.
git clone https://github.com/Texan-NXTassist/nr-mcp.git
cd nr-mcp
uv venv && source .venv/bin/activate
uv pip install -e .MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.