
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
robotmcp-server
Advanced tools
Modular MCP server with Streamable HTTP, optional OAuth 2.1, Supabase auth, Cloudflare tunnel, and creator-only access control
A modular Model Context Protocol (MCP) server with automatic submodule integration, OAuth 2.1 authentication, Supabase user management, and Cloudflare tunnel support. Works with ChatGPT and Claude.ai.
# Using uv (recommended)
uv tool install robotmcp-server
robotmcp-server
# Using pip
pip install robotmcp-server
robotmcp-server
git clone --recursive https://github.com/robotmcp/robotmcp_server.git
cd robotmcp_server
# Using uv (recommended)
uv venv
uv pip install -e .
uv run robotmcp-server
# Using pip
pip install -e .
robotmcp-server
Edit submodule code directly in modules/ — changes take effect immediately.
You can also manage modules with robotmcp-server add/remove/update.
/mcp{name}.robotmcp.aiENABLE_OAUTH=falserobotmcp_server/
├── main.py # FastAPI app entry point
├── cli.py # CLI daemon management
├── config.py # Config management (~/.robotmcp-server/)
├── setup.py # Browser-based login flow
├── submodule_integration.py # Auto-discover & register submodule tools
├── submodule_deps.py # Auto-install submodule dependencies
├── logging_config.py # Logging with Supabase support
├── sse.py # Legacy SSE endpoints
├── oauth/ # OAuth module (optional)
│ ├── endpoints.py # OAuth routes
│ ├── middleware.py # Token validation
│ ├── jwt_utils.py # JWT token generation/validation
│ ├── stores.py # Session stores
│ └── templates.py # HTML templates
└── modules/ # MCP tool modules (git submodules)
├── ros-mcp-server/ # ROS integration module
└── test-mcp-server/ # Test/example module
Cloud Service: CLI login and tunnel creation are handled by robotmcp-cloud at https://app.robotmcp.ai.
See docs/project_plan.md for architecture details.
| Command | Description |
|---|---|
robotmcp-server | Start server in background |
robotmcp-server stop | Stop server and tunnel |
robotmcp-server status | Show current status |
robotmcp-server verify | Comprehensive verification (server, tunnel, DNS, connectivity) |
robotmcp-server list | List installed MCP server modules with compatibility status |
robotmcp-server list-tools | List all available MCP tools from compatible modules |
robotmcp-server add <url> | Add an MCP server module (git submodule) |
robotmcp-server remove <name> | Remove an MCP server module |
robotmcp-server update | Update all MCP server modules to latest |
robotmcp-server logout | Clear credentials and stop |
The verify command performs comprehensive diagnostics:
robotmcp-server verify
Checks performed:
localhost:8766/, /health)Output includes:
Use this command to diagnose connectivity issues, verify DNS configuration, and ensure your tunnel is working correctly.
| Variable | Description |
|---|---|
SUPABASE_URL | Supabase project URL |
SUPABASE_ANON_KEY | Supabase anonymous key |
SUPABASE_JWT_SECRET | JWT secret for token validation |
ENABLE_OAUTH | Set false to disable OAuth (default: true) |
ROBOTMCP_CLOUD_URL | Cloud service URL (default: https://app.robotmcp.ai) |
| Endpoint | Description |
|---|---|
GET / | Server info |
POST /mcp | Streamable HTTP transport (recommended) |
GET /sse | Legacy SSE (backward compat) |
/.well-known/oauth-authorization-server | OAuth metadata |
Two endpoints are available:
| Endpoint | Transport | Usage |
|---|---|---|
/mcp | Streamable HTTP | Try first (recommended) |
/sse | Legacy SSE | Use if /mcp doesn't work |
Client Compatibility:
/mcp (recommended)/mcp (recommended)/sse if /mcp doesn't workExample URL:
https://{your-name}.robotmcp.ai/mcp
See docs/workflow.md for connection flow diagrams.
The server automatically discovers and integrates MCP tools from git submodules:
# Add a module using the CLI
robotmcp-server add https://github.com/example/my-mcp-tools.git
# Or add tracking a specific branch
robotmcp-server add -b develop https://github.com/example/my-mcp-tools.git
# List installed modules and their compatibility status
robotmcp-server list
# List all available tools
robotmcp-server list-tools
# Update all modules to latest
robotmcp-server update
# Remove a module
robotmcp-server remove my-mcp-tools
Your submodule needs:
pyproject.toml with a package nameintegration.py with a register(mcp, **kwargs) functionCompatibility: Modules without an integration module will show as "not compatible" in list and list-tools commands. The server checks for compatibility at startup and warns about incompatible modules.
# my_mcp_tools/integration.py
from fastmcp import FastMCP
def register(mcp: FastMCP, **kwargs) -> None:
@mcp.tool()
def my_tool(param: str) -> str:
"""Process a parameter."""
return f"Result: {param}"
See docs/submodule-integration.md for the complete guide including:
integration.py examples with configurationSee CHANGELOG.md for version history.
Copyright (c) 2025 Contoro. All rights reserved.
This software is proprietary and confidential. Unauthorized copying, modification, distribution, or use of this software is strictly prohibited without express written permission.
FAQs
Modular MCP server with Streamable HTTP, optional OAuth 2.1, Supabase auth, Cloudflare tunnel, and creator-only access control
The pypi package robotmcp-server receives a total of 27 weekly downloads. As such, robotmcp-server popularity was classified as not popular.
We found that robotmcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.