Server data from the Official MCP Registry
MCP server for Rachio sprinkler controllers — schedules, zones, and live watering control
MCP server for Rachio sprinkler controllers — schedules, zones, and live watering control
This is a well-structured MCP server for controlling Rachio sprinkler systems via a reverse-engineered gRPC API. Authentication is properly handled through environment variable-based bearer tokens with no hardcoded credentials. The main security concern is reliance on an unofficial, undocumented API that could change without notice, but this is disclosed transparently. Code quality is good with proper dependency management and appropriate permissions for its use case. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 5 high severity). Package verification found 1 issue.
3 files analyzed · 9 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: RACHIO_ACCESS_TOKEN
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-rwestergren-rachio-mcp": {
"env": {
"RACHIO_ACCESS_TOKEN": "your-rachio-access-token-here"
},
"args": [
"rachio-mcp"
],
"command": "uvx"
}
}
}From the project's GitHub README.
An MCP (Model Context Protocol) server for Rachio sprinkler controllers, built on the reverse-engineered Android-app gRPC API.
The public Rachio API exposes only read-only access to schedules and a handful of single-action endpoints. This server instead talks to the same internal gRPC backend (cloud.rach.io:443) that the official mobile app uses, giving an agent the full set of operations: listing devices and zones, inspecting schedules, creating and previewing new schedules, updating and deleting them, starting and stopping manual zone runs, setting rain delays, and more.
⚠️ Unofficial. This server uses a reverse-engineered API. It works as of Rachio Android v4.21.18 and is not supported by Rachio. The schema can change without notice.
curl -LsSf https://astral.sh/uv/install.sh | sh
The MCP server itself never sees your Rachio password. Instead you mint a long-lived (~25-year) access token once, and supply only the token to the MCP client.
uvx --from rachio-mcp rachio-mcp-token
It will prompt for your Rachio email and password, then print a RACHIO_ACCESS_TOKEN value to paste into your MCP client config. The token remains valid until you change your password or explicitly log out from another device.
Or, if you'd rather have the commands on your PATH permanently, install once:
uv tool install rachio-mcp
Then rachio-mcp-token (and rachio-mcp itself) are available as regular commands.
For scripting (e.g. pipe into a password manager):
RACHIO_EMAIL=you@example.com RACHIO_PASSWORD=... \
uvx --from rachio-mcp rachio-mcp-token --json | jq .access_token
uvx downloads and runs the server on demand — no separate install step required.
opencode.json){
"$schema": "https://opencode.ai/config.json",
"mcp": {
"rachio": {
"type": "local",
"command": ["uvx", "rachio-mcp"],
"environment": {
"RACHIO_ACCESS_TOKEN": "{env:RACHIO_ACCESS_TOKEN}"
},
"enabled": true
}
}
}
claude_desktop_config.json){
"mcpServers": {
"rachio": {
"command": "uvx",
"args": ["rachio-mcp"],
"env": {
"RACHIO_ACCESS_TOKEN": "paste-your-token-here"
}
}
}
}
If a tool call later returns a "token rejected" error, rerun rachio-mcp-token to mint a fresh one and update the config.
23 tools over stdio transport.
| Tool | Description |
|---|---|
list_devices | Every device on the account — controllers, sensors, weather stations |
get_device | Full details + live state for a single device |
list_zones | Zones configured on a controller, with agronomic metadata |
get_zone | Full detail for a single zone |
get_calendar | Scheduled runs + skip events for a date range |
get_active_alerts | Unresolved alerts on a device or zone |
get_weather | Observed + forecast weather readings for a location |
| Tool | Description |
|---|---|
list_schedules | Filter by device, location, zone, or schedule id |
get_schedule | Single schedule + its locations/devices |
preview_schedule | Dry-run — returns the Schedule that create_schedule would produce, including the server-generated human-readable summary. Never persists |
create_schedule | Create a new schedule |
update_schedule | Rename or toggle enabled/disabled |
delete_schedule | Permanent, destructive |
copy_schedule | Duplicate an existing schedule |
run_schedule | Trigger an immediate run |
skip_schedule | Skip or re-arm the next scheduled run |
get_schedule_runs | Past runs + skip events for a schedule |
| Tool | Description |
|---|---|
stop_watering | Stop whatever is running |
start_zones | Start one or more zones manually by zone number + duration |
set_rain_delay | Defer all schedules until a given time |
skip_current_zone | Skip to the next zone in the active run |
pause_watering | Pause the current zone for N seconds |
resume_watering | Resume a paused run |
All device_id, zone_id, schedule_id, and location_id parameters are UUIDs obtained from the list_* tools. Dates use YYYY-MM-DD (or MM-DD for annual-recurring schedules); times use HH:MM.
list_devices → pick your controllerlist_zones(device_id=...) → note each zone's id and zone_numberlist_schedules(device_id=...) and get_schedule(schedule_id=...) → understand what's already configuredpreview_schedule(...) → dry-run your proposed schedule. Read the returned summary string and the per-zone breakdowncreate_schedule(...) (same arguments) → commitget_schedule(schedule_id=<new>) → confirmdelete_schedule(schedule_id=<new>) → rollback if neededpreview_schedule is safe to call repeatedly — it never writes anything.
This server talks to cloud.rach.io:443 over TLS-protected gRPC, the same backend used by the Rachio Android app. Authentication uses the OAuth 2 password grant against oauth.rach.io/oAuth/token with the Android app's hardcoded client credentials.
The gRPC .proto definitions were recovered by decompiling the Rachio Android APK (v4.21.18) with jadx, extracting the embedded FileDescriptorProto payloads from the generated Java classes, and round-tripping them through protoc to produce clean .proto source. Pre-compiled Python stubs for the 40-odd messages/services used by the 23 MCP tools ship in src/rachio_mcp/proto/.
Regenerate those stubs any time the app's proto surface changes:
scripts/build_protos.sh
The stub generator reads from reverse-engineering/protos/, which is not shipped in the wheel but is kept alongside the source for future updates.
The MCP server wraps a standalone client you can use directly:
from rachio_mcp import RachioClient
c = RachioClient()
# Discovery
for d in c.list_devices():
print(d["type"], d["id"], d.get("name"))
# Preview a proposed schedule
preview = c.preview_schedule(
name="Fall Lawn",
schedule_type="FIXED",
zones=[
{"device_id": "<controller>", "zone_id": "<zone>", "watering_time": 1200},
],
start_time="06:00",
days=["WED"],
annual_start="09-16",
annual_end="11-15",
smart_cycle=True,
)
print(preview["summary"])
# Commit
created = c.create_schedule(name="Fall Lawn", ...)
print("created", created["id"])
# Rollback
c.delete_schedule(created["id"])
The client reads RACHIO_ACCESS_TOKEN from the environment, derives the user's user_id lazily on first use (via LocationService.ListLocations), and keeps both in memory for the lifetime of the process. Nothing is written to disk.
| Variable | Required | Description |
|---|---|---|
RACHIO_ACCESS_TOKEN | Yes | Long-lived bearer token minted by rachio-mcp-token. Valid for ~25 years unless revoked. |
LOG_LEVEL | No | Python logging level (default: INFO). Logs go to stderr; stdio transport's stdout is reserved for the MCP protocol. |
| Variable | Used by | Description |
|---|---|---|
RACHIO_EMAIL | rachio-mcp-token only | Rachio account email. If unset, rachio-mcp-token prompts interactively. |
RACHIO_PASSWORD | rachio-mcp-token only | Rachio account password. If unset, rachio-mcp-token prompts interactively with a masked input. |
Neither RACHIO_EMAIL nor RACHIO_PASSWORD is ever read by the MCP server itself — they exist only to feed the one-time token-mint CLI.
stdio only. Remote HTTP with OAuth 2.1 is not supported in v0.1.
MIT — see LICENSE.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.