VVictron TCPAn MCP (Model Context Protocol) server that connects to Victron Energy GX devices via Modbus TCP or MQTT on your local network. Get direct, low-latency access to real-time solar, battery, grid, and inverter data — no cloud required. Built from the official CCGX Modbus TCP register list (Rev 50, 900+ registers across 33 device categories). Features 30 specialized tools for reading Victron device data Dual transport — Modbus TCP (port 502) or MQTT (port 1883) 900+ registers across 33 device categories Network discovery — scan the local network to find GX devices, no IP needed One-shot setup — victron_setup probes both transports, discovers everything, generates ready-to-use config Read-only and safe — all tools annotated with readOnlyHint: true
mcp-so:victron-tcp_lubosstrejcek
View sourceFirst Seen
Feb 18, 2026
Last Scanned
Feb 18, 2026
Findings
2
Score
92/100
Findings (2)
Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation
"-y" Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.
Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.
Detects MCP server configs using npx to run packages without version pinning
"command": "npx" Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.
Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.