本地、无浏览器的 TP-Link VIGI NVR MCP 服务器：优先读、写门、锁定感知;管理频道并通过 RTSP 导出画面。
概览
一个MCP服务器，适用于你自己网络上的单个TP-Link VIGI NVR。它直接通信NVR的本地JSON API——没有云端，没有浏览器，也没有供应商应用——并将它作为一组安全、有类型的工具暴露给AI代理或任何MCP客户端：读取设备及其摄像头，管理频道，并通过RTSP导出录制的录像。读取是免费的;每次写入都需要两次单独的选择加入;登录系统围绕NVR的账户锁定设计，确保代理无法锁定你自己的录制。 VIGI NVR在登录失败~10次后锁定管理员账户，锁定期间你完全无法访问NVR，包括其录制。该服务器从不自动重试登录，默认情况下，登录失败后会停止所有登录，直到有人清除断路器。在指向代理之前，请用vigi-nvr-mcp --check-auth --login确认密码。参见安全模型。 其他 VIGI 型号和固件很可能也能正常工作，但——这台设备使用 MD5+RSA，而较新的固件已知采用基于 SHA-256 的方案。
概述（AI 翻译）
单个TP-Link VIGI NVR的MCP服务器 在你自己的网络上。它直接使用NVR的本地JSON API——没有云端，没有 浏览器，没有供应商应用——并以 AI 代理或任何 MCP 客户端的形式暴露它 一套安全、打字工具：读取设备及其摄像头，管理频道， 并通过RTSP导出录制素材。读取是免费的;每次写入都需要两次 分开选择加入;登录系统设计时会围绕NVR的账户锁定设计，所以 代理不能把你自己的录音锁在外面。
[!警告] 账户锁定是主要风险。 VIGI NVR会在之后锁定
admin账户 ~10次登录失败，锁定期间完全无法访问NVR，包括 它的录制。这个服务器从不自动重试登录，默认情况下会停止 在出现一次失败后，所有登录都>，直到有人清除断路器。 在指向前请先用vigi-nvr-mcp --check-auth --login确认密码 有个特工在做这件事。参见安全模型。
支持的硬件
| 测试模型VIGI NVR1016H（联合国） | |
| 测试过固件 | 1.1.3 构建260727 |
| 认证方案（本固件） | MD5 + RSA-PKCS1v15 （encrypt_type 2），退回裸MD5（encrypt_type 1） |
本页由 AI 翻译，技术细节请以原文为准。
README
以下为原文 README 节选，完整内容请查看原文。
vigi-nvr-mcp
An MCP server for a single TP-Link VIGI NVR on your own network. It speaks the NVR’s local JSON API directly — no cloud, no browser, no vendor app — and exposes it to an AI agent or any MCP client as a set of safe, typed tools: read the device and its cameras, manage channels, and export recorded footage over RTSP. Reads are free; every write needs two separate opt-ins; and login is engineered around the NVR’s account-lockout so an agent cannot lock you out of your own recordings.
[!WARNING] Account lockout is the main risk. VIGI NVRs lock the
adminaccount after ~10 failed logins, and while locked you cannot reach the NVR at all, including its recordings. This server never auto-retries a login and, by default, stops all logins after a single failure until a human clears the breaker. Confirm your password withvigi-nvr-mcp --check-auth --loginbefore pointing an agent at it. See Safety model.
Supported hardware
| Tested model | VIGI NVR1016H(UN) |
| Tested firmware | 1.1.3 Build 260727 |
| Auth scheme (this firmware) | MD5 + RSA-PKCS1v15 (encrypt_type 2), falling back to bare MD5 (encrypt_type 1) |
Other VIGI models and firmware very likely work, but the login scheme varies
by firmware — this unit uses MD5+RSA, and newer firmware is known to use
SHA-256-based schemes. The server auto-detects encrypt_type 1 vs 2, but if
your firmware uses something else, login will fail. Verify first, without
risking the lockout counter:
vigi-nvr-mcp --check-auth # fetch the challenge only: offered schemes, counters; NO login
vigi-nvr-mcp --check-auth --login # plus exactly ONE login attempt
The full wire protocol is documented in docs/protocol/vigi-nvr.md.
Features
- 45 tools over one NVR, all returning a uniform
{success, data, error}envelope with credentials redacted. - Catalog gateway —
nvr_callreaches every one of the 586 documented calls across 61 API modules through one validated, write-gated entry point, so coverage is the whole inventory rather than 586 hand-written tools. - Typed reads for the high-value calls: device/system/network info, users, storage and disks, recording status, video/image/detection config, firewall, cloud status, time.
- Channel management — list bound cameras, group duplicates by device UUID, flag stale “ghost” channels, and plan/execute cleanup (remove, move) with per-write UUID checks.
- Footage over RTSP — enable ONVIF/RTSP, build redacted stream URLs, export
replay windows to mp4 (lossless
-c copy, or re-encode to a size target), grab snapshots, build time-stamped contact sheets, sample frames, and run a full “find the footage and send it” investigation recipe. - MCP resources — the export directory is also exposed as
exports://
安装
This server does not publish a one-line install command.
Open the repository installation guide 新手？先看 mcpskill.org 教程 →配置
{
"mcpServers": {
"vigi-nvr": {
"command": "/path/to/.venv/bin/vigi-nvr-mcp",
"env": { "VIGI_NVR_HOST": "192.0.2.1", "VIGI_NVR_PASSWORD": "<password>" }
}
}
}