Milesight Gateway MCP Server

An MCP server that exposes the MilesightLoRaWAN gateway HTTP API as tools, so an MCP client (Claude Code, ClaudeDesktop, etc.) can manage applications, devices, profiles, multicast groups anddownlinks on a Milesight UG-series gateway.

It talks to the gateway's embedded network server over HTTPS (port 8080),handling the firmware's AES-encrypted login and JWT bearer-token authautomatically.

Features

One tool per action across the gateway API surface:

Applications — list / get / create / update / delete
Devices — list / get / create / update / delete
Device profiles — list / get / create / update / delete
Multicast groups — list / get / create / delete, list/add/remove members
Downlinks — enqueue / list / flush for both devices and multicast groups
Gateways — list
Packets — list / clear the frame log
Payload codecs — list
Settings — network-server settings, packet-forwarder network servers

Requirements

Python ≥ 3.10
Network access to a Milesight gateway (firmware that uses AES login, e.g.60.0.0.42-r5 / 56.0.0.4 and later)

Install

With uv:

uv sync

Configure

Copy .env.example to .env and fill in your gateway details:

MILESIGHT_HOST=192.168.1.1
MILESIGHT_PORT=8080
MILESIGHT_USER=admin
MILESIGHT_PASSWORD=your-password
MILESIGHT_ORG_ID=1
MILESIGHT_VERIFY_TLS=false

.env is gitignored. The server reads these from the environment, so you canalso pass them however your MCP client injects env vars.

TLS: gateways ship a self-signed certificate, so verification is off bydefault. Set MILESIGHT_VERIFY_TLS=true only with a trusted certificate.

Run

uv run milesight-mcp

The server speaks MCP over stdio.

Claude Code / Claude Desktop

Add to your MCP client config:

{
  "mcpServers": {
    "milesight": {
      "command": "uv",
      "args": ["run", "milesight-mcp"],
      "cwd": "/path/to/milesight_mcp",
      "env": {
        "MILESIGHT_HOST": "192.168.1.1",
        "MILESIGHT_USER": "admin",
        "MILESIGHT_PASSWORD": "your-password"
      }
    }
  }
}

Live smoke test

Runs read-only checks against the configured gateway (no writes):

uv run python test_live.py

How auth works

The gateway login endpoint expects the password AES-128-CBC encrypted(fixed key/IV from the firmware) and Base64-encoded. On success it returns a JWTvalid for 24 hours, sent as Authorization: Bearer <jwt> on every request. Theclient caches the token, refreshes it proactively, and re-logs-in automaticallyon a 401.

License

MIT

Milesight Gateway MCP Server