← Back to search

Shelly Smart Home

Buggy1111 Scanned 6d ago

Local-first MCP server for Shelly smart-home devices (Gen1-Gen4): control, energy, automation.

C
63.6 / 100

Versions

0.1.1latest
first seen Jun 30, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 47

shelly_rpc
annotations: none low

Call any **read-only** RPC method (``*.Get*``/``*.List*``/``*.Check*``) on a device. Mutating methods are refused here — use ``shelly_rpc_write``. The method name is classified server-side; unknown methods are treated as writes and rejected.

device str method str params string
shelly_rpc_write
annotations: none low

Call any **mutating** RPC method. Requires ``confirm:true``; audit-logged. Read methods are rejected (use ``shelly_rpc``). Destructive methods (factory reset, wipe-all, reset-wifi) need a second gate: ``params.i_understand_data_loss = true``.

device str method str params string confirm bool
shelly_list_methods
annotations: none low

List the RPC methods a device supports (Gen2+ ``Shelly.ListMethods``). Returns an actionable error on Gen1/cloud where the device can't enumerate methods.

device str
shelly_energy_live
annotations: none low

Live power/energy per channel: power_w, voltage, current, pf, freq, totals. ``None`` where a device can't report it (e.g. Gen1 plugs have no voltage/current). Pass ``channel`` to narrow to one. Safe, read-only.

device str channel string
shelly_energy_history
annotations: none low

Best-effort energy history: lifetime totals plus any per-minute series the device exposes in its status; notes when richer history needs a local connection. Detailed historical queries (Pro 3EM ``EMData``/CSV, Gen1 ``em_data.csv``) land with the local backends (M2) — over cloud only totals + recent by-minute are available.

device str channel string
shelly_system_reboot
annotations: none low

Reboot a device. Requires ``confirm:true``. Audit-logged.

device str confirm bool delay_ms string
shelly_system_update
annotations: none low

Trigger a firmware update (``channel`` = stable|beta). Requires ``confirm:true``.

device str channel str confirm bool
shelly_system_set_auth
annotations: none low

Enable/rotate the device login password (≥12 chars). Requires ``confirm:true``. The password is write-only — never returned, and redacted in the audit log.

device str confirm bool password str
shelly_virtual_list
annotations: none low

List the device's virtual (dynamic) components via ``Shelly.GetComponents``.

device str
shelly_virtual_add
annotations: none low

Add a virtual component of ``type`` (boolean/number/text/enum/button/group). Optional ``config`` and ``id`` (200-299). Returns the new component id. Audit-logged.

id string type str config string device str
shelly_virtual_delete
annotations: none low

Delete a virtual component by ``key`` (``<type>:<cid>``). Requires ``confirm:true``.

key str device str confirm bool
shelly_webhook_list
annotations: none low

List webhooks configured on a device. Local-only.

device str
shelly_webhook_create
annotations: none low

Create a webhook: ``event`` (e.g. 'switch.on'), ``cid`` component id, ``urls`` 1-5. Optional ``condition`` (JS expression) and ``repeat_period`` (seconds; 0=always, negative=once). Audit-logged.

cid int name string urls string event str device str enable bool condition string repeat_period string
shelly_webhook_update
annotations: none low

Update fields of an existing webhook by ``id``. Audit-logged.

id int name string urls string device str enable string condition string repeat_period string
shelly_webhook_delete
annotations: none low

Delete a webhook by ``id``. Requires ``confirm:true``. Audit-logged.

id int device str confirm bool
shelly_version
annotations: none low

Return the shelly-mcp server version (health check).

shelly_discover
annotations: none low

Discover Shelly devices on the LAN via mDNS, merged with the cloud account list. ``timeout_s`` is the mDNS browse window. Set ``use_cloud=false`` to skip the cloud list (LAN-only). Safe, read-only; returns lightweight identities (probe for detail).

timeout_s float use_cloud bool
shelly_list_devices
annotations: none low

List every Shelly device known to this server (configured + cloud account). Safe, read-only. Returns each device's canonical identity (id, name, generation, model, online state) — the starting point before any status or control call.

shelly_get_info
annotations: none low

Identify one device (generation, model, firmware, online state, capabilities). ``device`` is a device id or a configured name. Safe, read-only.

device str
shelly_get_status
annotations: none low

Get a device's **normalized** live status (Gen1/Gen2/Cloud folded into one shape). Returns canonical channels/lights/covers plus the raw per-generation payload. Pass ``component`` (e.g. ``"switch:0"``) to narrow to a single component. Safe, read-only.

device str component string
shelly_list_components
annotations: none low

List the component keys present on a device (e.g. ['switch:0', 'input:0']). Safe, read-only. Use this to discover what a specific device exposes before reading status or controlling it.

device str
shelly_get_config
annotations: none low

Get a device's configuration, with credential fields masked as ``***`` (Gen1 ``/settings`` returns Wi-Fi/MQTT secrets in the clear — they must not reach the model). Local-first — the Shelly Cloud API can't expose config, so this returns an actionable error for cloud-only devices.

device str component string
shelly_schedule_list
annotations: none low

List the schedules configured on a device. Local-only (cloud can't manage schedules).

device str
shelly_schedule_create
annotations: none low

Create a schedule: ``timespec`` + ``calls`` (1-5 × {method, params}). ``timespec``: cron ``"sec min hour day month dow"`` (e.g. ``"0 0 22 * * MON-THU"``; 5 or 7 fields also accepted), a shorthand (``@daily``), or sun-relative ``"@sunset"``, ``"@sunset+30m"``, ``"@sunrise-1h * * MON-FRI"`` (offset max ±12 h; the device needs its location set). Validates the timespec, ≤5 calls, the ≤20-per-device limit, and each call's method. Audit-logged.

calls string device str enable bool timespec str
shelly_schedule_update
annotations: none low

Update fields of an existing schedule by ``id``. Audit-logged.

id int calls string device str enable string timespec string
shelly_schedule_delete
annotations: none low

Delete a schedule by ``id``. Requires ``confirm:true``. Audit-logged.

id int device str confirm bool
shelly_script_list
annotations: none low

List scripts on a device (id, name, enable, running). Local-only.

device str
shelly_script_get_code
annotations: none low

Get a script's full source, reassembling the device's paginated ``GetCode``.

id int device str
shelly_script_create
annotations: none low

Create an empty script (optionally named). Returns its ``id``. Audit-logged. Use ``shelly_script_put_code`` to give it code (that step is confirm-gated).

name string device str
shelly_script_put_code
annotations: none low

Upload code into a script (chunked). **Arbitrary code on the device** → ``confirm:true``. ``append=false`` replaces the script body; ``true`` appends. Large code is split into ≤1 KB chunks automatically. Audit-logged.

id int code str append bool device str confirm bool
shelly_script_start
annotations: none low

Start a script by ``id``. Returns ``was_running``. Audit-logged.

id int device str
shelly_script_stop
annotations: none low

Stop a script by ``id``. Returns ``was_running``. Audit-logged.

id int device str
shelly_script_eval
annotations: none low

Evaluate an expression inside a running script. **Arbitrary code** → ``confirm:true``. Returns the stringified result. Audit-logged.

id int code str device str confirm bool
shelly_script_delete
annotations: none low

Delete a script by ``id``. Requires ``confirm:true``. Audit-logged.

id int device str confirm bool
shelly_scene_list
annotations: none low

List defined scenes (name, description, action count). Read-only.

shelly_scene_get
annotations: none low

Show a scene's full definition (its ordered actions). Read-only.

name str
shelly_scene_create
annotations: none low

Define (save) a named scene from an ordered list of ``{device, method, params}``. Every method must be a non-destructive mutating method; every device must be known. Fails if the name already exists unless ``overwrite=true``. Prefer absolute ``Set`` methods over ``Toggle`` so the scene is safe to run twice (you'll get a warning otherwise).

name str actions string overwrite bool description string
shelly_scene_run
annotations: none low

Run a named scene: attempt every action in order, report per-action results. Best-effort and sequential — a failing action does **not** abort the rest. ``status`` is ``ok`` (all succeeded), ``partial`` (some failed), or ``failed`` (none succeeded). A partial run can simply be re-run later to finish it (scenes use absolute states, so re-running is safe). Every action is audit-logged.

name str
shelly_scene_delete
annotations: none low

Delete a named scene. Requires ``confirm:true``.

name str confirm bool
shelly_switch_set
annotations: none low

Turn a switch/relay channel on or off (optionally auto-revert after N seconds). Returns the post-action ``ChannelState``. Audit-logged.

on bool device str channel int toggle_after_s string
shelly_switch_toggle
annotations: none low

Toggle a switch/relay channel. Returns the post-action ``ChannelState``. Audit-logged.

device str channel int
shelly_light_set
annotations: none low

Set a light/dimmer/RGB(W)/CCT channel (Gen1 /color,/light ↔ Gen2 Light/RGB/RGBW/CCT.Set). Only the provided fields are changed. ``brightness`` 0-100, ``rgb`` three 0-255 values, ``temp_k`` white colour temperature. Returns the post-action ``LightState``. Audit-logged.

on string rgb string white string device str temp_k string channel int brightness string transition_s string
shelly_cover_move
annotations: none low

Move a roller/cover: ``action`` is open|close|stop, or pass ``position`` (0-100) to go to it. Returns the post-action ``CoverState``. Audit-logged.

action str device str channel int position string
shelly_kvs_list
annotations: none low

List KVS keys (with their etags). ``match`` is a wildcard pattern (default all).

match str device str
shelly_kvs_get
annotations: none low

Get one KVS value (with its etag) by key.

key str device str
shelly_kvs_set
annotations: none low

Set a KVS key to a JSON value. Audit-logged.

key str value Any device str
shelly_kvs_delete
annotations: none low

Delete a KVS key. Requires ``confirm:true``. Audit-logged.

key str device str confirm bool

Permissions 4

network medium
Server uses network capabilities via: aiohttp, urllib
filesystem low
Server uses filesystem capabilities via: open(), os, pathlib
shell high
Server uses shell capabilities via: subprocess
env_vars low
Server uses env_vars capabilities via: os.environ

Scan Findings 224

low
Tool 'shelly_rpc' has no annotations annotation_checker · 100%
low
Tool 'shelly_rpc_write' has no annotations annotation_checker · 100%
low
Tool 'shelly_list_methods' has no annotations annotation_checker · 100%
low
Tool 'shelly_energy_live' has no annotations annotation_checker · 100%
low
Tool 'shelly_energy_history' has no annotations annotation_checker · 100%
low
Tool 'shelly_system_reboot' has no annotations annotation_checker · 100%
low
Tool 'shelly_system_update' has no annotations annotation_checker · 100%
low
Tool 'shelly_system_set_auth' has no annotations annotation_checker · 100%
low
Tool 'shelly_virtual_list' has no annotations annotation_checker · 100%
low
Tool 'shelly_virtual_add' has no annotations annotation_checker · 100%
low
Tool 'shelly_virtual_delete' has no annotations annotation_checker · 100%
low
Tool 'shelly_webhook_list' has no annotations annotation_checker · 100%
low
Tool 'shelly_webhook_create' has no annotations annotation_checker · 100%
low
Tool 'shelly_webhook_update' has no annotations annotation_checker · 100%
low
Tool 'shelly_webhook_delete' has no annotations annotation_checker · 100%
low
Tool 'shelly_version' has no annotations annotation_checker · 100%
low
Tool 'shelly_discover' has no annotations annotation_checker · 100%
low
Tool 'shelly_list_devices' has no annotations annotation_checker · 100%
low
Tool 'shelly_get_info' has no annotations annotation_checker · 100%
low
Tool 'shelly_get_status' has no annotations annotation_checker · 100%
low
Tool 'shelly_list_components' has no annotations annotation_checker · 100%
low
Tool 'shelly_get_config' has no annotations annotation_checker · 100%
low
Tool 'shelly_schedule_list' has no annotations annotation_checker · 100%
low
Tool 'shelly_schedule_create' has no annotations annotation_checker · 100%
low
Tool 'shelly_schedule_update' has no annotations annotation_checker · 100%
low
Tool 'shelly_schedule_delete' has no annotations annotation_checker · 100%
low
Tool 'shelly_script_list' has no annotations annotation_checker · 100%
low
Tool 'shelly_script_get_code' has no annotations annotation_checker · 100%
low
Tool 'shelly_script_create' has no annotations annotation_checker · 100%
low
Tool 'shelly_script_put_code' has no annotations annotation_checker · 100%
low
Tool 'shelly_script_start' has no annotations annotation_checker · 100%
low
Tool 'shelly_script_stop' has no annotations annotation_checker · 100%
low
Tool 'shelly_script_eval' has no annotations annotation_checker · 100%
low
Tool 'shelly_script_delete' has no annotations annotation_checker · 100%
low
Tool 'shelly_scene_list' has no annotations annotation_checker · 100%
low
Tool 'shelly_scene_get' has no annotations annotation_checker · 100%
low
Tool 'shelly_scene_create' has no annotations annotation_checker · 100%
low
Tool 'shelly_scene_run' has no annotations annotation_checker · 100%
low
Tool 'shelly_scene_delete' has no annotations annotation_checker · 100%
low
Tool 'shelly_switch_set' has no annotations annotation_checker · 100%
low
Tool 'shelly_switch_toggle' has no annotations annotation_checker · 100%
low
Tool 'shelly_light_set' has no annotations annotation_checker · 100%
low
Tool 'shelly_cover_move' has no annotations annotation_checker · 100%
low
Tool 'shelly_kvs_list' has no annotations annotation_checker · 100%
low
Tool 'shelly_kvs_get' has no annotations annotation_checker · 100%
low
Tool 'shelly_kvs_set' has no annotations annotation_checker · 100%
low
Tool 'shelly_kvs_delete' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: fastmcp@3.4,<4 (GHSA-5h2m-4q8j-pqpj) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (GHSA-c2jp-c369-7pvx) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (GHSA-m8x7-r2rg-vh5g) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (GHSA-mxxr-jv3v-6pgc) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (GHSA-rcfx-77hg-w2wv) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (GHSA-rj5c-58rq-j5g5) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (GHSA-rww4-4w9c-7733) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (GHSA-vv7q-7jx5-f767) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (PYSEC-2026-1364) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (PYSEC-2026-1365) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (PYSEC-2026-2474) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (PYSEC-2026-2475) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (PYSEC-2026-2476) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.4,<4 (PYSEC-2026-338) dependency_analyzer · 95%
medium
Vulnerable dependency: zeroconf@0.132,<1 (GHSA-9663-mqmp-p9mm) dependency_analyzer · 95%
medium
Vulnerable dependency: zeroconf@0.132,<1 (GHSA-9pgc-3ccv-5297) dependency_analyzer · 95%
medium
Vulnerable dependency: zeroconf@0.132,<1 (GHSA-phvx-9mgw-67r5) dependency_analyzer · 95%
medium
Vulnerable dependency: zeroconf@0.132,<1 (GHSA-qc2x-6f54-m6h9) dependency_analyzer · 95%
medium
Vulnerable dependency: zeroconf@0.132,<1 (GHSA-rfg2-pjw2-56x2) dependency_analyzer · 95%
medium
Vulnerable dependency: zeroconf@0.132,<1 (PYSEC-2026-3435) dependency_analyzer · 95%
medium
Vulnerable dependency: zeroconf@0.132,<1 (PYSEC-2026-3436) dependency_analyzer · 95%
medium
Vulnerable dependency: zeroconf@0.132,<1 (PYSEC-2026-3437) dependency_analyzer · 95%
medium
Vulnerable dependency: zeroconf@0.132,<1 (PYSEC-2026-3438) dependency_analyzer · 95%
medium
Vulnerable dependency: zeroconf@0.132,<1 (PYSEC-2026-3439) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.7,<3 (GHSA-5jqp-qgf6-3pvh) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.7,<3 (GHSA-mr82-8j83-vxmv) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.7,<3 (PYSEC-2021-47) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.7,<3 (PYSEC-2026-1812) dependency_analyzer · 95%
medium
Vulnerable dependency: pyyaml@6,<7 (GHSA-8q59-q68h-6hv4) dependency_analyzer · 95%
medium
Vulnerable dependency: pyyaml@6,<7 (GHSA-rprw-h62v-c2w7) dependency_analyzer · 95%
medium
Vulnerable dependency: pyyaml@6,<7 (PYSEC-2018-49) dependency_analyzer · 95%
medium
Vulnerable dependency: pyyaml@6,<7 (PYSEC-2021-142) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-2fqr-mr3j-6wp8) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-2vrm-gr82-f7m5) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-3wq7-rqq7-wx6j) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-45c4-8wx5-qw6w) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-4fvr-rgm6-gqmc) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-4m7w-qmgq-4wj5) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-54jq-c3m8-4m76) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-5m98-qgg9-wh84) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-63hf-3vf5-4wqf) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-63hw-fmq6-xxg2) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-69f9-5gxw-wvc2) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-6jhg-hg63-jvvf) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-6mq8-rvhq-8wgg) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-7gpw-8wmc-pm8g) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-8495-4g3g-x7pr) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-8qpw-xqxj-h4r2) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-9548-qrrj-x5pj) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-966j-vmvw-g2g9) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-9x8q-7h8h-wcw9) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-c427-h43c-vf67) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-cq5v-8q36-5273) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-fh55-r93g-j68g) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-g3cq-j2xw-wf74) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-g84x-mcqj-x9qq) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-gfw2-4jvh-wgfg) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-hcc4-c3v8-rx92) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-hg6j-4rv6-33pg) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-hpj7-wq8m-9hgp) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-jg22-mg44-37j8) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-jj3x-wxrx-4x23) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-m5qp-6w8w-w647) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-m6qw-4cw2-hm4m) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-mfx4-hv73-q22v) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-mq44-7p77-q5h7) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-mqqc-3gqh-h2x8) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-mwh4-6h8g-pg8w) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-p998-jp59-783m) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-pjjw-qhg8-p2p9) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-q3qx-c6g2-7pw2) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-qvrw-v9rv-5rjx) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-v6wp-4m6f-gcjg) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-w2fm-2cpv-w7v5) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-xcgm-r5h9-7989) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (GHSA-xx9p-xxvh-7g8j) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2021-76) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2023-120) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2023-246) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2023-247) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2023-250) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2023-251) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2024-26) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1097) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1098) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1099) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1100) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1101) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1102) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1103) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1104) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1105) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1106) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1107) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-1109) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2094) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2095) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2096) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2097) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2098) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2099) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2100) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2101) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2102) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2103) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2104) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2105) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2106) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2107) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2108) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2109) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2110) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2111) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2112) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-2113) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-237) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-3545) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-3546) dependency_analyzer · 95%
medium
Vulnerable dependency: aiohttp@3.9,<4 (PYSEC-2026-3547) dependency_analyzer · 95%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: shelly_rpc manifest_parser · 90%
info
Tool: shelly_rpc_write manifest_parser · 90%
info
Tool: shelly_list_methods manifest_parser · 90%
info
Tool: shelly_energy_live manifest_parser · 90%
info
Tool: shelly_energy_history manifest_parser · 90%
info
Tool: shelly_system_reboot manifest_parser · 90%
info
Tool: shelly_system_update manifest_parser · 90%
info
Tool: shelly_system_set_auth manifest_parser · 90%
info
Tool: shelly_virtual_list manifest_parser · 90%
info
Tool: shelly_virtual_add manifest_parser · 90%
info
Tool: shelly_virtual_delete manifest_parser · 90%
info
Tool: shelly_webhook_list manifest_parser · 90%
info
Tool: shelly_webhook_create manifest_parser · 90%
info
Tool: shelly_webhook_update manifest_parser · 90%
info
Tool: shelly_webhook_delete manifest_parser · 90%
info
Tool: shelly_version manifest_parser · 90%
info
Tool: shelly_discover manifest_parser · 90%
info
Tool: shelly_list_devices manifest_parser · 90%
info
Tool: shelly_get_info manifest_parser · 90%
info
Tool: shelly_get_status manifest_parser · 90%
info
Tool: shelly_list_components manifest_parser · 90%
info
Tool: shelly_get_config manifest_parser · 90%
info
Tool: shelly_schedule_list manifest_parser · 90%
info
Tool: shelly_schedule_create manifest_parser · 90%
info
Tool: shelly_schedule_update manifest_parser · 90%
info
Tool: shelly_schedule_delete manifest_parser · 90%
info
Tool: shelly_script_list manifest_parser · 90%
info
Tool: shelly_script_get_code manifest_parser · 90%
info
Tool: shelly_script_create manifest_parser · 90%
info
Tool: shelly_script_put_code manifest_parser · 90%
info
Tool: shelly_script_start manifest_parser · 90%
info
Tool: shelly_script_stop manifest_parser · 90%
info
Tool: shelly_script_eval manifest_parser · 90%
info
Tool: shelly_script_delete manifest_parser · 90%
info
Tool: shelly_scene_list manifest_parser · 90%
info
Tool: shelly_scene_get manifest_parser · 90%
info
Tool: shelly_scene_create manifest_parser · 90%
info
Tool: shelly_scene_run manifest_parser · 90%
info
Tool: shelly_scene_delete manifest_parser · 90%
info
Tool: shelly_switch_set manifest_parser · 90%
info
Tool: shelly_switch_toggle manifest_parser · 90%
info
Tool: shelly_light_set manifest_parser · 90%
info
Tool: shelly_cover_move manifest_parser · 90%
info
Tool: shelly_kvs_list manifest_parser · 90%
info
Tool: shelly_kvs_get manifest_parser · 90%
info
Tool: shelly_kvs_set manifest_parser · 90%
info
Tool: shelly_kvs_delete manifest_parser · 90%
info
Required env vars (7) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 80%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
No dependency files found for SBOM generation sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%