Model Context Protocol moderate risk

Vms

MCP server integrates with VMS systems to retrieve video streams, control PTZ cameras, and manage video playback, offering both live and recorded video access.

Connections & Capabilities

Connects To

GitHub

Capabilities

readwriteexec

Quickstart

Config

{
  "mcpServers": {
	"vms": {
	  "command": "uv",
	  "args": [
		"--directory",
		"X:\\path\\to\\mcp-vms",
		"run",
		"mcp_vms.py"
	  ]
	}
  }
}

Exposed MCP Tools (6)

safe

get_channel_info

Retrieves information about a specific video channel, including connection and recording status.

Read-only operation; retrieves existing information.

safe

get_recording_dates

Fetches the dates and times when recordings are available for a given channel.

Read-only operation; retrieves existing information.

safe

get_image

Retrieves a live or recorded image from a specified video channel.

Read-only operation; retrieves existing information.

moderate

show_live_stream

Displays a live video stream for a specified channel.

Displays video, potentially revealing sensitive information.

moderate

show_playback_dialog

Opens a playback dialog for a specific channel and timestamp.

Allows viewing of recorded video, potentially revealing sensitive information.

moderate

ptz_move_to_preset

Moves a PTZ camera to a predefined preset position.

Controls camera movement, potentially affecting surveillance coverage.

Safety Assessment

This server is relatively safe in controlled environments where VMS access is already restricted. However, the storage of credentials in the configuration file and lack of sandboxing pose risks if the server is exposed or the configuration is compromised. Exercise caution when granting access to this server.

Limited internet exposure as it's designed for local VMS integration.
Configuration file allows some control over VMS connection parameters.
Error handling and logging mechanisms are implemented.
PTZ control is limited to preset positions, reducing potential for misuse.

Direct access to VMS credentials (access_id, access_pw) in configuration.
No explicit sandboxing is mentioned, potentially allowing broader system access.
VMS control capabilities (PTZ, playback) introduce potential for unauthorized manipulation.
Dependency on external libraries (vmspy) introduces supply chain risks.
Lack of RBAC (Role-Based Access Control) means all users have same permissions.