
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
@switchbot/openapi-cli
Advanced tools
Command-line interface for the SwitchBot API v1.1. List devices, query live status, send control commands, run scenes, and manage webhooks β all from your terminal or shell scripts.
@switchbot/openapi-cliThree entry points, same binary β pick the one that matches how you use it:
| Audience | Where to start | What you get |
|---|---|---|
| Human | this README (Quick start) | Colored tables, helpful hints on errors, shell completion, switchbot doctor self-check. |
| Script | Output modes, Scripting examples | --json, --format=tsv/yaml/id, --fields, stable exit codes, history replay, audit log. |
| Agent | docs/agent-guide.md | switchbot mcp serve (stdio MCP server), schema export, plan run, destructive-command guard. |
Under the hood every surface shares the same catalog, cache, and HMAC client β switching between them costs nothing.
/v1.1 endpoint (devices, scenes, webhooks)--json passthrough for jq and scripting0600; env-var override for CInpm install -g @switchbot/openapi-cli
This adds the switchbot binary to your $PATH.
git clone https://github.com/OpenWonderLabs/switchbot-openapi-cli.git
cd switchbot-openapi-cli
npm install
npm run build
npm link # optional β expose `switchbot` globally
Verify:
switchbot --version
switchbot --help
# 1. Save your credentials (one-time)
switchbot config set-token <token> <secret>
# 2. List every device on your account
switchbot devices list
# 3. Control a device
switchbot devices command <deviceId> turnOn
The CLI reads credentials in this order (first match wins):
SWITCHBOT_TOKEN and SWITCHBOT_SECRET~/.switchbot/config.json (written by config set-token, mode 0600)Obtain the token and secret from the SwitchBot mobile app: Profile β Preferences β Developer Options β Get Token.
# One-time setup (writes ~/.switchbot/config.json)
switchbot config set-token <token> <secret>
# Or export environment variables (e.g. in CI)
export SWITCHBOT_TOKEN=...
export SWITCHBOT_SECRET=...
# Confirm which source is active and see the masked secret
switchbot config show
| Option | Description |
|---|---|
--json | Print the raw JSON response instead of a formatted table |
--format <fmt> | Output format: tsv, yaml, jsonl, json, id |
--fields <cols> | Comma-separated column names to include (e.g. deviceId,type) |
-v, --verbose | Log HTTP request/response details to stderr |
--dry-run | Print mutating requests (POST/PUT/DELETE) without sending them |
--timeout <ms> | HTTP request timeout in milliseconds (default: 30000) |
--config <path> | Override credential file location (default: ~/.switchbot/config.json) |
--profile <name> | Use a named credential profile (~/.switchbot/profiles/<name>.json) |
--cache <dur> | Set list and status cache TTL, e.g. 5m, 1h, off, auto (default) |
--cache-list <dur> | Set list-cache TTL independently (overrides --cache) |
--cache-status <dur> | Set status-cache TTL independently (default off; overrides --cache) |
--no-cache | Disable all cache reads for this invocation |
--retry-on-429 <n> | Max 429 retry attempts (default: 3) |
--no-retry | Disable automatic 429 retries |
--backoff <strategy> | Retry backoff: exponential (default) or linear |
--no-quota | Disable local request-quota tracking |
--audit-log [path] | Append mutating commands to a JSONL audit log (default path: ~/.switchbot/audit.log) |
-V, --version | Print the CLI version |
-h, --help | Show help for any command or subcommand |
Every subcommand supports --help, and most include a parameter-format reference and examples.
switchbot --help
switchbot devices command --help
--dry-runIntercepts every non-GET request: the CLI prints the URL/body it would have
sent, then exits 0 without contacting the API. GET requests (list, status,
query) are still executed so you can preview the state involved.
switchbot devices command ABC123 turnOn --dry-run
# [dry-run] Would POST https://api.switch-bot.com/v1.1/devices/ABC123/commands
# [dry-run] body: {"command":"turnOn","parameter":"default","commandType":"command"}
config β credential managementswitchbot config set-token <token> <secret> # Save to ~/.switchbot/config.json
switchbot config show # Print current source + masked secret
devices β list, status, control# List all physical devices and IR remote devices
# Default columns (4): deviceId, deviceName, type, category
# Pass --wide for the full 10-column operator view
switchbot devices list
switchbot devices list --wide
switchbot devices list --json | jq '.deviceList[].deviceId'
# IR remotes: type = remoteType (e.g. "TV"), category = "ir"
# Physical: category = "physical"
switchbot devices list --format=tsv --fields=deviceId,type,category
# Filter by family / room (family & room info requires the 'src: OpenClaw'
# header, which this CLI sends on every request)
switchbot devices list --json | jq '.deviceList[] | select(.familyName == "Home")'
switchbot devices list --json | jq '[.deviceList[], .infraredRemoteList[]] | group_by(.familyName)'
# Query real-time status of a physical device
switchbot devices status <deviceId>
switchbot devices status <deviceId> --json
# Send a control command
switchbot devices command <deviceId> <cmd> [parameter] [--type command|customize]
# Describe a specific device (1 API call): metadata + supported commands + status fields
switchbot devices describe <deviceId>
switchbot devices describe <deviceId> --json
# Discover what's supported (offline reference, no API call)
switchbot devices types # List all device types + IR remote types
switchbot devices commands <type> # Show commands, parameter formats, and status fields
switchbot devices commands Bot
switchbot devices commands "Smart Lock"
switchbot devices commands curtain # Case-insensitive, substring match
parameter is optional β omit it for commands like turnOn/turnOff (auto-defaults to "default").
Numeric-only and JSON-object parameters are auto-parsed; strings with colons / commas / semicolons pass through as-is.
For the exact commands and parameter formats a specific device supports, query the built-in catalog:
switchbot devices commands <type> # e.g. Bot, Curtain, "Smart Lock", "Robot Vacuum Cleaner S10"
Generic parameter shapes (which one applies is decided by the device β see the catalog):
| Shape | Example |
|---|---|
| (none) | devices command <id> turnOn |
<integer> | devices command <id> setBrightness 75 |
<R:G:B> | devices command <id> setColor "255:0:0" |
<direction;angle> | devices command <id> setPosition "up;60" |
<a,b,c,β¦> | devices command <id> setAll "26,1,3,on" |
<json object> | '{"action":"sweep","param":{"fanLevel":2,"times":1}}' |
| Custom IR button | devices command <id> MyButton --type customize |
For the complete per-device command reference, see the SwitchBot API docs.
devices expand β named flags for packed parametersSome commands require a packed string like "26,2,2,on". devices expand builds it from readable flags:
# Air Conditioner β setAll
switchbot devices expand <acId> setAll --temp 26 --mode cool --fan low --power on
# Curtain / Roller Shade β setPosition
switchbot devices expand <curtainId> setPosition --position 50 --mode silent
# Blind Tilt β setPosition
switchbot devices expand <blindId> setPosition --direction up --angle 50
# Relay Switch β setMode
switchbot devices expand <relayId> setMode --channel 1 --mode edge
Run switchbot devices expand <id> <command> --help to see the available flags for any device command.
devices explain β plain-language command descriptionswitchbot devices explain <deviceId> <command> # e.g. "explain ABC123 setAll"
Returns a human-readable description of what the command does and what each parameter means.
scenes β run manual scenesswitchbot scenes list # Columns: sceneId, sceneName
switchbot scenes execute <sceneId>
webhook β receive device events over HTTP# Register a receiver URL for events from ALL devices
switchbot webhook setup https://your.host/hook
# Query what is currently configured
switchbot webhook query
switchbot webhook query --details https://your.host/hook
# Enable / disable / re-submit the registered URL
switchbot webhook update https://your.host/hook --enable
switchbot webhook update https://your.host/hook --disable
# Remove the configuration
switchbot webhook delete https://your.host/hook
The CLI validates that <url> is an absolute http:// or https:// URL before calling the API. --enable and --disable are mutually exclusive.
completion β shell tab-completion# Bash: load on every new shell
echo 'source <(switchbot completion bash)' >> ~/.bashrc
# Zsh
echo 'source <(switchbot completion zsh)' >> ~/.zshrc
# Fish
switchbot completion fish > ~/.config/fish/completions/switchbot.fish
# PowerShell (profile)
switchbot completion powershell >> $PROFILE
Supported shells: bash, zsh, fish, powershell (pwsh is accepted as an alias).
batch β run multiple commands# Run a sequence of commands from a JSON/YAML file
switchbot batch run commands.json
switchbot batch run commands.yaml --dry-run
# Validate a plan file without executing it
switchbot batch validate commands.json
A batch file is a JSON array of { deviceId, command, parameter?, commandType? } objects.
watch β poll device status# Poll a device's status every 30 s until Ctrl-C
switchbot watch <deviceId>
switchbot watch <deviceId> --interval 10s --json
Output is a stream of JSON status objects (with --json) or a refreshed table.
mcp β Model Context Protocol server# Start the stdio MCP server (connect via Claude, Cursor, etc.)
switchbot mcp serve
Exposes 8 MCP tools (list_devices, describe_device, get_device_status, send_command, list_scenes, run_scene, search_catalog, account_overview) plus a switchbot://events resource for real-time shadow updates.
See docs/agent-guide.md for the full tool reference and safety rules (destructive-command guard).
cache β inspect and clear local cache# Show cache status (paths, age, entry counts)
switchbot cache show
# Clear everything
switchbot cache clear
# Clear only the device-list cache or only the status cache
switchbot cache clear --key list
switchbot cache clear --key status
list/status, key-value tables for details.--json β raw API payload passthrough. Output is the exact JSON the SwitchBot API returned, ideal for jq and scripting. Errors are also JSON on stderr: { "error": { "code", "kind", "message", "hint?" } }.--format=json β projected row view. Same JSON structure but built from the CLI's column model (--fields applies). Use this when you only want specific fields.--format=tsv|yaml|jsonl|id β tabular text formats; --fields filters columns.# Raw API payload (--json)
switchbot devices list --json | jq '.deviceList[] | {id: .deviceId, name: .deviceName}'
# Projected rows with field filter (--format)
switchbot devices list --format tsv --fields deviceId,deviceName,type,cloud
switchbot devices list --format id # one deviceId per line
switchbot devices status <id> --format yaml
The CLI maintains two local disk caches under ~/.switchbot/:
| File | Contents | Default TTL |
|---|---|---|
devices.json | Device metadata (id, name, type, category, hub, roomβ¦) | 1 hour |
status.json | Per-device status bodies | off (0) |
The device-list cache powers offline validation (command name checks, destructive-command guard) and the MCP server's send_command tool. It is refreshed automatically on every devices list call.
# Turn off all cache reads for one invocation
switchbot devices list --no-cache
# Set both list and status TTL to 5 minutes
switchbot devices status <id> --cache 5m
# Set TTLs independently
switchbot devices status <id> --cache-list 2h --cache-status 30s
# Disable only the list cache (keep status cache at its current TTL)
switchbot devices list --cache-list 0
# Show paths, age, and entry counts
switchbot cache show
# Clear all cached data
switchbot cache clear
# Scope the clear to one store
switchbot cache clear --key list
switchbot cache clear --key status
status.json entries are automatically evicted after 24 hours (or 10Γ the configured status TTL, whichever is longer), so the file cannot grow without bound even when the status cache is left enabled long-term.
| Code | Meaning |
|---|---|
0 | Success (including --dry-run intercept) |
1 | Runtime error β API error, network failure, missing credentials |
2 | Usage error β bad flag, missing/invalid argument, unknown subcommand, unknown device type, invalid URL, conflicting flags |
Typical errors bubble up in the form Error: <message> on stderr. The SwitchBot-specific error codes that get mapped to readable English messages:
| Code | Meaning |
|---|---|
| 151 | Device type error |
| 152 | Device not found |
| 160 | Command not supported by this device |
| 161 | Device offline (BLE devices need a Hub) |
| 171 | Hub offline |
| 190 | Device internal error / server busy |
| 401 | Authentication failed (check token/secret) |
| 429 | Request rate too high (10,000 req/day cap) |
| Variable | Description |
|---|---|
SWITCHBOT_TOKEN | API token β takes priority over the config file |
SWITCHBOT_SECRET | API secret β takes priority over the config file |
NO_COLOR | Disable ANSI colors in all output (automatically respected) |
# Turn off every Bot device
switchbot devices list --json \
| jq -r '.deviceList[] | select(.deviceType == "Bot") | .deviceId' \
| while read id; do switchbot devices command "$id" turnOff; done
# Dump each scene as `<id> <name>`
switchbot scenes list --json | jq -r '.[] | "\(.sceneId) \(.sceneName)"'
git clone https://github.com/OpenWonderLabs/switchbot-openapi-cli.git
cd switchbot-openapi-cli
npm install
npm run dev -- <args> # Run from TypeScript sources via tsx
npm run build # Compile to dist/
npm test # Run the Vitest suite (592 tests)
npm run test:watch # Watch mode
npm run test:coverage # Coverage report (v8, HTML + text)
src/
βββ index.ts # Commander entry; mounts all subcommands; global flags
βββ auth.ts # HMAC-SHA256 signature (token + t + nonce β sign)
βββ config.ts # Credential load/save; env > file priority; --config override
βββ api/client.ts # axios instance + request/response interceptors;
β # --verbose / --dry-run / --timeout wiring
βββ devices/
β βββ catalog.ts # Static device catalog (commands, params, status fields)
β βββ cache.ts # Disk + in-memory cache for device list and status
βββ lib/
β βββ devices.ts # Shared logic: listDevices, describeDevice, isDestructiveCommand
βββ commands/
β βββ config.ts
β βββ devices.ts
β βββ scenes.ts
β βββ webhook.ts
β βββ batch.ts # `switchbot batch run/validate`
β βββ watch.ts # `switchbot watch <deviceId>`
β βββ mcp.ts # `switchbot mcp serve` (MCP stdio server)
β βββ cache.ts # `switchbot cache show/clear`
β βββ history.ts # `switchbot history [replay]`
β βββ events.ts # `switchbot events`
β βββ quota.ts # `switchbot quota`
β βββ explain.ts # `switchbot explain <deviceId>`
β βββ plan.ts # `switchbot plan run <file>`
β βββ doctor.ts # `switchbot doctor`
β βββ schema.ts # `switchbot schema export`
β βββ catalog.ts # `switchbot catalog search`
β βββ completion.ts # `switchbot completion bash|zsh|fish|powershell`
βββ utils/
βββ flags.ts # Global flag readers (isVerbose / isDryRun / getCacheMode / β¦)
βββ output.ts # printTable / printKeyValue / printJson / handleError / buildErrorPayload
βββ format.ts # renderRows / filterFields / output-format dispatch
βββ audit.ts # JSONL audit log writer
βββ quota.ts # Local daily-quota counter
tests/ # Vitest suite (592 tests, mocked axios, no network)
Releases are cut on tag push and published to npm by GitHub Actions:
npm version patch # bump version + create git tag
git push --follow-tags
Then on GitHub β Releases β Draft a new release β select tag β Publish. The publish.yml workflow runs tests, verifies the tag matches package.json, and publishes @switchbot/openapi-cli to npm with provenance.
Bug reports, feature requests, and PRs are welcome.
npm test and npm run build locally β both must pass.main. CI runs on Node 18/20/22; all three must stay green.MIT Β© chenliuyun
https://api.switch-bot.comFAQs
SwitchBot smart home CLI β control devices, run scenes, stream real-time events, and integrate AI agents via MCP. Full API v1.1 coverage.
The npm package @switchbot/openapi-cli receives a total of 678 weekly downloads. As such, @switchbot/openapi-cli popularity was classified as not popular.
We found that @switchbot/openapi-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.