pylips-mcp

MCP server for controlling Philips Android TV via the JointSpace API and ADB.

Exposes 14 tools covering power, volume, ambilight, app launching, and YouTube playback. Handles the TP Vision SHA1 certificate chain transparently.

Recorded against the real TV with docs/demo/record.sh: a minimal MCP client (docs/demo/mcp_demo.py) starts the server over stdio with TV_HOST/TV_USER/TV_PASS in the environment, lists the tools and calls get_state (read-only). Credentials never appear on screen.

• Python 3.10+
• pylips installed and accessible
• Philips Android TV with JointSpace API enabled (2016+ models)
• ADB enabled on the TV (for YouTube deep linking)
• wakeonlan Python package (optional, for Wake-on-LAN)

pip install pylips
python -m pylips --host 192.168.0.XX --init

This generates credentials saved in ~/.config/pylips/pylips.conf.

pip install mcp requests wakeonlan

Copy config.example.yaml to config.yaml and fill in your TV credentials:

tv:
  host: "192.168.0.XX"
  user: "your_user"
  pass: "your_password"

pylips_path: "/path/to/pylips"  # or set PYLIPS_PATH env var

python server.py

Or set via environment variables:

TV_HOST=192.168.0.XX TV_USER=xxx TV_PASS=xxx python server.py

{
  "mcpServers": {
    "philips-tv": {
      "command": "python3",
      "args": ["/path/to/pylips-mcp/server.py"],
      "env": {
        "TV_HOST": "192.168.0.XX",
        "TV_USER": "your_user",
        "TV_PASS": "your_password",
        "PYLIPS_PATH": "/path/to/pylips"
      }
    }
  }
}

Philips TVs present a TP Vision certificate chain from 2015 signed with SHA1. Modern OpenSSL and the Fedora/RHEL crypto policy reject SHA1 signatures, so a classic CA verification is impossible, even with the bundled chain and SECLEVEL=0.

What this server does instead, honestly:

• CA verification is disabled (it cannot succeed);
• the SHA-256 fingerprint of the certificate presented by the TV must match the leaf certificate shipped in tpvision_ca.pem (checked by urllib3 after the TLS handshake, so a man-in-the-middle cannot impersonate the TV without the private key). Verified against a real 55OLED705 (JointSpace 6, port 1926);
• PYLIPS_TLS_FINGERPRINT=<sha256 hex> pins another TV, PYLIPS_TLS_PIN=0 disables pinning and logs a warning.

tpvision_ca.pem is the public TP Vision chain (leaf restfultv.tpvision.com, intermediate ca.tpvision.com, root www.tpvision.com, valid until 2042), extracted from a TV with openssl s_client -showcerts. It contains no secret.

MIT