Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

GenieACS

OCI · DRUMSERGIO/GENIEACS-MCP · 2 COMPONENTS

MCP server bridging GenieACS TR-069 ACS instances to LLMs for CPE device management

+3 this week 49 Trust /100

Last scanned (9 hours ago)

Scores higher than 74% of OCI servers

Category IoT and Hardware

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security0
  • No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
  • Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
  • Install-script risk not yet assessed.Unverified
  • Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
Provenance & Transparency35
Schema Quality & AI Usability79
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3724 tokens (~248/item across 15 items; 12 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management69
  • Stability check failed: the tool surface changed between v0.3.6 and v0.4.1: 0 tool removals, 1 breaking changes, 0 additions. See how to fix → Fail
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (50% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 66 to 69.

  • 3 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 59 to 63.

  • 31 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 49 to 53.

  • 29 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 46.

  • 28 Oct 26 0
    • Stability: fail → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Tool coverage: 100 → unverified ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Schema quality: 100 → unverified ▼ functional
    • Package version: v0.4.0 → v0.4.1 functional
  • 27 Oct 26 0
    • Stability: 0.40 → fail ▼ security
    • First check of Tool coverage: 50 functional
    • MCP protocol: Implements a current MCP spec version (2026-07-28). functional
    • Package version: v0.3.7 → v0.4.0 functional
  • 25 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

  • 23 Oct 26 +1
    • Security disclosure: unverified → pass ▲ functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed oci/drumsergio/genieacs-mcp@v0.4.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem oci
Reason No attestation published

Background: How many MCP packages publish verified provenance →

MCP tools · 12 exposed · ~3,180 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
connection_request ~197

Send a TR-069 connection request so a CPE device contacts GenieACS now instead of at its next periodic inform. Use it to run tasks that are already queued, or to apply a preset change without waiting. It queues nothing itself. Succeeds when the device answered; fails with ACS error 504 when the device is unreachable (offline, or behind NAT without STUN). Example: connection_request(device_id="202BC1-BM632w-000001").

NameTypeReqDescription
device_idstringyesThe GenieACS device id (the _id field), exactly as GenieACS stores it, usually OUI-ProductClass-SerialNumber, e.g. "202BC1-BM632w-000001". GenieACS escapes characters other than letters and digits in…

No output schema declared.

No examples provided.

delete_task ~166

Remove a task from the GenieACS queue before the device runs it, for example a firmware download or reboot queued by mistake, or a faulted task you do not want retried. GenieACS already deletes a task once the device has run it, so every task you can see in genieacs://tasks/{device_id} is either waiting or faulted. Fails with ACS error 503 while the device is in a session with GenieACS; try again a few seconds later. Use retry_task instead to run a faulted task again. Example: delete_task(task_id="67abc123def4560012345678").

NameTypeReqDescription
task_idstringyesThe task's _id, from genieacs://tasks/{device_id} or from the task_id a task tool returned.

No output schema declared.

No examples provided.

download_firmware ~323

Tell a CPE device to download and apply a file stored on GenieACS: a firmware image, a configuration file or another file the device accepts. A wrong image can leave a device unusable, so check the file's metadata (genieacs://file/{name}: OUI, product class, version) against the device first. GenieACS queues a download task and sends a connection request at once; the transfer itself can take minutes after the tool returns. Check genieacs://tasks/{device_id} and genieacs://faults/{device_id} afterwards. Example: download_firmware(device_id="202BC1-BM632w-000001", file_id="firmware-v2.0.bin").

NameTypeReqDescription
device_idstringyesThe GenieACS device id (the _id field), exactly as GenieACS stores it, usually OUI-ProductClass-SerialNumber, e.g. "202BC1-BM632w-000001". GenieACS escapes characters other than letters and digits in…
file_idstringyesThe _id of the file on GenieACS, which is its filename, e.g. "firmware-v2.0.bin". Check it exists with genieacs://file/{name}.
filenamestring–Optional target file name sent to the device (TR-069 TargetFileName). Omit it to let the device choose.
NameTypeReqDescription
device_idstringyesThe device the task was queued on.
messagestringyesWhat happened, in one sentence.
statusstringyesdone: the device ran the task in the session GenieACS opened at once. queued: the device did not answer within 3 seconds, so the task runs at its next inform or connection request.
task––The task document GenieACS returned.
task_idstring–The GenieACS task id; use it with delete_task or retry_task, or look for it in genieacs://tasks/{device_id}.

No examples provided.

get_parameter ~262

Read TR-069 parameter values GenieACS has cached for a device, without contacting the device: firmware version, serial number, uptime, WiFi SSID, IP addresses and so on. Values are what the device reported at its last inform or refresh, with a timestamp each; call refresh_parameter first when you need a value from the device now. Give one path or a comma-separated list; an object path such as "Device.WiFi" returns every cached leaf under it. Returns found=false for an unknown device id, and lists paths with no cached value under missing.

NameTypeReqDescription
device_idstringyesThe GenieACS device id (the _id field), exactly as GenieACS stores it, usually OUI-ProductClass-SerialNumber, e.g. "202BC1-BM632w-000001". GenieACS escapes characters other than letters and digits in…
parameter_pathstringyesComma-separated TR-069 paths. Example: "Device.DeviceInfo.SoftwareVersion" or "InternetGatewayDevice.DeviceInfo.SoftwareVersion,InternetGatewayDevice.DeviceInfo.UpTime".
NameTypeReqDescription
device_idstringyes–
foundbooleanyesfalse when no device has this id.
missingnull|arrayyesRequested paths with no cached value; refresh_parameter can fetch them.
parametersobjectyesEvery cached leaf parameter at or under the requested paths, keyed by full path.

No examples provided.

manage_preset ~289

Create, replace or delete a GenieACS preset. A preset is a fleet-wide rule: at their next inform, every device matching its precondition gets its configurations applied, so a broad precondition (or an empty one) reconfigures the whole fleet. Confirm the precondition and the devices it matches (search_devices with the same filter) before a put. action="put" creates or overwrites the preset with body; action="delete" removes it. body is a JSON object: weight (integer, higher wins), precondition (a MongoDB-style filter as a JSON string, e.g. "{\"_tags\":\"office\"}"), and configurations (an array of {type: "value" | "provision" | "add_object" | "delete_object", ...}). Example body: {"weight":0,"precondition":"{\"_tags\":\"pilot\"}","configurations":[{"type":"provision","name":"myScript"}]}. Read genieacs://presets/list first.

NameTypeReqDescription
actionstringyes"put" creates or replaces the preset, "delete" removes it.
bodystring–For action="put": the preset document as a JSON object string, with weight, precondition and configurations. Ignored for "delete".
namestringyesThe preset name, its id on GenieACS. It cannot contain a dot.

No output schema declared.

No examples provided.

manage_provision ~221

Create, replace or delete a GenieACS provision script. A provision is JavaScript that GenieACS runs during the inform session of every device a preset applies it to, so replacing one changes how those devices are configured. Scripts use the GenieACS sandbox API (declare, commit, clear, ext, log); ext() calls extension scripts that run on the ACS host with full privileges, so treat a provision as code running on your ACS. action="put" uploads or overwrites the script (raw JavaScript, not JSON; GenieACS answers 400 on a syntax error); action="delete" removes it. Presets reference provisions by name. Read genieacs://provisions/list first. Example script: log("Device " + DeviceID.ID + " informed");

NameTypeReqDescription
actionstringyes"put" creates or replaces the script, "delete" removes it.
namestringyesThe provision name, its id on GenieACS.
scriptstring–For action="put": the JavaScript source. Ignored for "delete".

No output schema declared.

No examples provided.

reboot_device ~233

Reboot a CPE device through GenieACS. Use it when a device needs a restart, for example after a configuration change or to recover an unresponsive device. The device drops its service while it restarts. GenieACS queues the task and sends a connection request at once: status "done" means the device ran it in that session, "queued" means it runs at the device's next inform. A reboot does not confirm the device came back; read Device.DeviceInfo.UpTime (or InternetGatewayDevice.DeviceInfo.UpTime) with refresh_parameter afterwards. Example: reboot_device(device_id="202BC1-BM632w-000001").

NameTypeReqDescription
device_idstringyesThe GenieACS device id (the _id field), exactly as GenieACS stores it, usually OUI-ProductClass-SerialNumber, e.g. "202BC1-BM632w-000001". GenieACS escapes characters other than letters and digits in…
NameTypeReqDescription
device_idstringyesThe device the task was queued on.
messagestringyesWhat happened, in one sentence.
statusstringyesdone: the device ran the task in the session GenieACS opened at once. queued: the device did not answer within 3 seconds, so the task runs at its next inform or connection request.
task––The task document GenieACS returned.
task_idstring–The GenieACS task id; use it with delete_task or retry_task, or look for it in genieacs://tasks/{device_id}.

No examples provided.

refresh_parameter ~290

Ask a CPE device for the current value of a TR-069 parameter, or of every parameter under an object path, and store it in GenieACS. Use it when get_parameter's cached value may be stale. It changes nothing on the device. GenieACS queues a getParameterValues task and sends a connection request at once: status "done" means the fresh value is already stored, so read it with get_parameter; "queued" means it arrives at the device's next inform. Example: refresh_parameter(device_id="202BC1-BM632w-000001", parameter="Device.DeviceInfo.SoftwareVersion").

NameTypeReqDescription
device_idstringyesThe GenieACS device id (the _id field), exactly as GenieACS stores it, usually OUI-ProductClass-SerialNumber, e.g. "202BC1-BM632w-000001". GenieACS escapes characters other than letters and digits in…
parameterstringyesFull dotted TR-069 path in the device's data model. Examples: "Device.DeviceInfo.SoftwareVersion", "InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.SSID", or an object such as "Device.WiFi." fo…
NameTypeReqDescription
device_idstringyesThe device the task was queued on.
messagestringyesWhat happened, in one sentence.
statusstringyesdone: the device ran the task in the session GenieACS opened at once. queued: the device did not answer within 3 seconds, so the task runs at its next inform or connection request.
task––The task document GenieACS returned.
task_idstring–The GenieACS task id; use it with delete_task or retry_task, or look for it in genieacs://tasks/{device_id}.

No examples provided.

retry_task ~116

Run a faulted task again: GenieACS clears the task's fault, and the device runs the task at its next session. Read genieacs://faults/{device_id} first to see why it failed; retrying a task whose cause is unchanged faults again. A task that has not faulted is left as it is. Example: retry_task(task_id="67abc123def4560012345678").

NameTypeReqDescription
task_idstringyesThe faulted task's _id, from genieacs://tasks/{device_id}.

No output schema declared.

No examples provided.

search_devices ~413

Find CPE devices in GenieACS with a MongoDB-style filter: by tag, manufacturer, model, firmware version, last inform time or any TR-069 parameter. It only reads. Examples: {"_tags":"office"}; {"InternetGatewayDevice.DeviceInfo.Manufacturer":"Huawei"} (GenieACS adds ._value to parameter paths); {"_lastInform":{"$lt":"2026-01-01T00:00:00Z"}} for devices silent since that date; {"_id":{"$regex":"^202BC1-"}}. Query operators such as $eq, $ne, $gt, $lt, $in, $nin, $exists, $regex, $and and $or work; $where, $function, $accumulator and $expr are refused, and a $regex pattern may be at most 256 characters. By default each device comes back as a summary (id, last inform, tags, manufacturer, product class, serial); ask for other fields with projection. Results come in pages of limit (default 50, at most 200); page with skip.

NameTypeReqDescription
limitinteger–Most devices to return in this page, 1 to 200. Default 50.
projectionstring–Comma-separated fields to return per device, e.g. "_id,InternetGatewayDevice.DeviceInfo.SoftwareVersion". Default: the summary fields. "all" returns whole device documents, which can be large (tens o…
querystringyesThe filter, as a JSON object string. Example: {"_tags":"office"} or {"_id":"202BC1-BM632w-000001"}.
skipinteger–Matching devices to skip before this page, for paging. Default 0.
sortstring–Sort order as a JSON object string: 1 ascending, -1 descending. Example: {"_lastInform":-1} for the most recent first.
NameTypeReqDescription
countintegeryesDevices in this page.
devicesnull|arrayyesThe matching device documents, with the fields the projection asked for.
limitintegeryesThe page size used.
morebooleanyestrue when the page is full, so more devices may match: call again with skip = skip + count.
skipintegeryesDevices skipped before this page.

No examples provided.

set_parameter ~389

Write one or more TR-069 parameter values on a CPE device, overwriting the current values: WiFi SSID or key, periodic inform interval, management server URL, or any writable parameter. A wrong value can cut the device off (a wrong WAN or ACS URL setting, for example). parameter_values is a JSON array of [path, value] or [path, value, xsdType] tuples; xsd types include xsd:string, xsd:boolean, xsd:unsignedInt, xsd:int and xsd:dateTime, and GenieACS infers the type when it is omitted. Example: [["InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.SSID","Lab-2","xsd:string"]]. GenieACS queues the task and sends a connection request at once: status "done" means the device applied it, "queued" means it runs at the next inform. A read-only or unknown parameter makes the device fault the task; see genieacs://faults/{device_id}. Read the current value with get_parameter first.

NameTypeReqDescription
device_idstringyesThe GenieACS device id (the _id field), exactly as GenieACS stores it, usually OUI-ProductClass-SerialNumber, e.g. "202BC1-BM632w-000001". GenieACS escapes characters other than letters and digits in…
parameter_valuesstringyesJSON array of tuples, each [path, value] or [path, value, xsdType]. Example: [["Device.WiFi.SSID.1.SSID","NewName","xsd:string"],["Device.ManagementServer.PeriodicInformInterval",300,"xsd:unsignedInt…
NameTypeReqDescription
device_idstringyesThe device the task was queued on.
messagestringyesWhat happened, in one sentence.
statusstringyesdone: the device ran the task in the session GenieACS opened at once. queued: the device did not answer within 3 seconds, so the task runs at its next inform or connection request.
task––The task document GenieACS returned.
task_idstring–The GenieACS task id; use it with delete_task or retry_task, or look for it in genieacs://tasks/{device_id}.

No examples provided.

tag_device ~281

Add a tag to a CPE device or remove one. Tags group devices: presets match on them (precondition {"_tags":"office"}) and search_devices finds by them. Adding or removing a tag can therefore make a preset apply to the device, or stop applying, at its next inform. Tags are case-sensitive. Use letters, digits, "-" and "_": GenieACS rejects a tag with other characters (a "." for example) with a 404. Fails with ACS error 404 when the device id does not exist. Example: tag_device(device_id="202BC1-BM632w-000001", tag="office", action="add").

NameTypeReqDescription
actionstringyes"add" tags the device, "remove" untags it.
device_idstringyesThe GenieACS device id (the _id field), exactly as GenieACS stores it, usually OUI-ProductClass-SerialNumber, e.g. "202BC1-BM632w-000001". GenieACS escapes characters other than letters and digits in…
tagstringyesThe tag, e.g. "office", "floor-2", "firmware_pending".

No output schema declared.

No examples provided.

Install

How do I install the GenieACS MCP server?

GenieACS runs locally as a container image, launched with docker run --rm -i -e ACS_URL -e ACS_USER -e ACS_PASS -e DEVICE_LIMIT -e GENIEACS_READ_ONLY -e GENIEACS_TOOLS -e ACS_TIMEOUT -e ACS_MAX_RESPONSE_BYTES drumsergio/genieacs-mcp:v0.4.1. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

oci · drumsergio/genieacs-mcp

# add to Claude Code
claude mcp add geiserx-genieacs-mcp -- docker run --rm -i -e ACS_URL -e ACS_USER -e ACS_PASS -e DEVICE_LIMIT -e GENIEACS_READ_ONLY -e GENIEACS_TOOLS -e ACS_TIMEOUT -e ACS_MAX_RESPONSE_BYTES drumsergio/genieacs-mcp:v0.4.1

This image reads ACS_URL, ACS_USER, ACS_PASS, DEVICE_LIMIT, GENIEACS_READ_ONLY, GENIEACS_TOOLS, ACS_TIMEOUT and ACS_MAX_RESPONSE_BYTES. Set them in your client's env block for this server; docker run -e passes each one through to the container.

Common questions

What is the GenieACS MCP server?

GenieACS is an MCP server listed in the public MCP registry as io.github.GeiserX/genieacs-mcp. MCP server bridging GenieACS TR-069 ACS instances to LLMs for CPE device management. This page covers its container image (drumsergio/genieacs-mcp).

Is the GenieACS MCP server safe to use?

GenieACS scores 49 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the GenieACS MCP server expose?

GenieACS exposes 12 tools: connection_request, delete_task, download_firmware, get_parameter, manage_preset, and 7 more. Their descriptions and schemas cost roughly 3,180 tokens of context every time the server is loaded.

Is the GenieACS MCP server still maintained?

GenieACS is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.