Metadata-Version: 2.4
Name: dahua-nvr-mcp
Version: 0.1.0
Summary: MCP stdio server for Dahua NVR JSON-RPC APIs
Author: bigoat
Keywords: mcp,dahua,nvr,onvif,rtsp,gb28181
Requires-Python: >=3.11
Description-Content-Type: text/markdown
Requires-Dist: mcp<2.0,>=1.0
Requires-Dist: httpx<1.0,>=0.27
Requires-Dist: psutil<8.0,>=6.0
Requires-Dist: cryptography<51,>=44
Requires-Dist: python-dotenv<2,>=1

# dahua-nvr-mcp

Python MCP stdio server for Dahua NVRs and cameras. Maintainer: **bigoat**.

Requires Python 3.11 or later. Device access happens from the machine running this server. No device address or credentials are bundled.

## Run with uv

```shell
uvx --from dahua-nvr-mcp==0.1.0 dahua-nvr-mcp --help
```

Create a private configuration file, for example `device.env`:

```dotenv
DAHUA_BASE_URL=https://192.168.1.100
DAHUA_USERNAME=admin
DAHUA_PASSWORD=REPLACE_WITH_YOUR_DEVICE_PASSWORD
DAHUA_VERIFY_TLS=true
DAHUA_TIMEOUT_SECONDS=15
```

Start the server through your MCP client, or run:

```shell
uvx --from dahua-nvr-mcp==0.1.0 dahua-nvr-mcp --env-file /absolute/path/device.env
```

No ordinary stdout output while waiting is expected: stdout is reserved for MCP JSON-RPC messages, and logs go to stderr.

## MCP client configuration

Replace the configuration-file path with your own absolute path. Windows paths may use forward slashes.

```json
{
  "mcpServers": {
    "dahua-nvr": {
      "command": "uvx",
      "args": [
        "--from", "dahua-nvr-mcp==0.1.0",
        "dahua-nvr-mcp",
        "--env-file", "/absolute/path/device.env"
      ]
    }
  }
}
```

Alternatively, install into an existing Python environment:

```shell
python -m pip install dahua-nvr-mcp==0.1.0
python -m dahua_nvr_mcp --help
```

## Tools

| Tool | Purpose |
| --- | --- |
| `list_network_interfaces` | List enabled non-loopback IPv4 interfaces |
| `discover_dahua_devices` | Discover local Dahua devices with UDP broadcast |
| `camera_list` | Read configured camera channels |
| `camera_add` | Add a camera to an existing unused remote slot |
| `camera_update` | Update an enabled camera's connection settings |
| `camera_delete` | Unbind a camera channel without deleting recordings |
| `gb28181_get_config` | Read GB28181 server/client configuration |
| `gb28181_update_config` | Update one platform in the complete server table |
| `device_info` | Read model, serial number, software and hardware versions |
| `stream_capabilities` | Read extra-stream capabilities |
| `record_search` | Search recordings in device-local time |

## Configuration and compatibility

- Priority: command-line parameters > process environment > `.env` > defaults. Without `--env-file`, the server reads `.env` in its working directory.
- Parameters: `--base-url`, `--username`, `--password`, `--verify-tls true|false`, `--timeout-seconds`, `--env-file`.
- Prefer an environment variable or protected configuration file for passwords: CLI passwords can appear in process listings and shell history.
- Tools/list and LAN discovery do not require NVR credentials. UDP discovery requires exclusive access to local port 5051; close Dahua ConfigTool before discovery.
- RPC channel numbers are zero-based. GB28181 defaults to platform 1 (`slot_index=0`), with ordinary JSON RPC (`transport=plain`). Optional secure RPC is firmware-dependent.
- Camera add supports Onvif, Private, RTSP and General. RTSP add accepts `main_stream_url`, optional `extra_stream_url` and `channel_name`; URL hosts must match the camera address. Camera update currently supports Onvif/Private connection settings.
- Write tools read the current configuration, preserve unrelated fields, and verify by reading back. An accepted write does not prove that a camera is connected or SIP registration is online. Ambiguous writes are not automatically repeated.
- Public results recursively redact credential fields and remove URL userinfo/query credentials. Raw configuration remains private in runtime memory for comparison and writeback. Do not write redacted output back as an original configuration.
- Unknown password masks are rejected; native placeholders are preserved only for a specifically verified firmware profile. GB28181 client-table writes are not supported.
- Prefer HTTPS with certificate verification. HTTP carries sensitive data in plaintext and should only be used on a trusted network. `--verify-tls false` disables certificate verification, not login authentication.

Firmware behavior varies. Validate read operations first, and only use write tools on devices you are authorized to manage. This is an independent integration, not an official Dahua product.
