github · ros-mcp-server91fa6664e4e1

Evidence

The server will start listening at `http://127.0.0.1:9000/mcp`.

To make it accessible from other machines on the network, use `--host 0.0.0.0`.

## Configure Your AI Client

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Evidence

epilog="""

Examples:

  python -m ros_mcp.main                                    # Use stdio transport (default)

  python -m ros_mcp.main --transport http --host 0.0.0.0 --port 9000

  python -m ros_mcp.main --transport streamable-http --host 127.0.0.1 --port 8080

  python server.py                                           # Or use the top-level entry point

        """,

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Evidence

except socket.gaierror as e:

        return (False, None, f"DNS resolution error: {str(e)}")

    except Exception as e:

        return (False, None, f"DNS resolution error: {str(e)}")

def ping_ip_and_port(

Remediation

Log the full exception server-side with a correlation ID; return only {"error_id": id, "message": "internal error"} to the caller. Never enable Flask debug mode in production.

Evidence

else:

            return (False, None, "DNS resolution returned no results")

    except socket.gaierror as e:

        return (False, None, f"DNS resolution error: {str(e)}")

    except Exception as e:

        return (False, None, f"DNS resolution error: {str(e)}")

Remediation

Log the full exception server-side with a correlation ID; return only {"error_id": id, "message": "internal error"} to the caller. Never enable Flask debug mode in production.

Evidence

}

        except json.JSONDecodeError as e:

            return {"error": f"Failed to parse status response: {str(e)}"}

        except Exception as e:

            return {

                "action_name": action_name,

Remediation

Log the full exception server-side with a correlation ID; return only {"error_id": id, "message": "internal error"} to the caller. Never enable Flask debug mode in production.

Evidence

return False, "Unexpected response format", None

    except Exception as e:

        return False, f"Error checking parameter: {str(e)}", None

def register_parameter_tools(

Remediation

Log the full exception server-side with a correlation ID; return only {"error_id": id, "message": "internal error"} to the caller. Never enable Flask debug mode in production.

Evidence

with ws_manager:

                    value_response = ws_manager.request(value_message)

            except Exception as e:

                return _error_response(f"Error getting parameter details: {str(e)}")

        # Handle string responses (fallback for malformed responses)

        if isinstance(value_response, str):

Remediation

Log the full exception server-side with a correlation ID; return only {"error_id": id, "message": "internal error"} to the caller. Never enable Flask debug mode in production.

Evidence

return {"robot_specifications": robot_names, "count": len(robot_names)}

    except Exception as e:

        return {"error": f"Failed to read robot specifications directory: {str(e)}"}

Remediation

Log the full exception server-side with a correlation ID; return only {"error_id": id, "message": "internal error"} to the caller. Never enable Flask debug mode in production.

Evidence

# ROS2 Humble with Turtlesim

FROM osrf/ros:humble-desktop

ENV ROS_DISTRO=humble

SHELL ["/bin/bash", "-c"]

# Install turtlesim and rosbridge packages

RUN apt-get update && apt-get install -y \

    ros-humble-turtlesim \

    ros-humble-rosbridge-suite \

    && rm -rf /var/lib/apt/lists/*

# Auto-source ROS environment in container shell

RUN echo "source /opt/ros/humble/setup.bash" >> ~/.bashrc

# Set working directory

WORKDIR /ros2_ws

# Default command to keep container running

CMD ["/bin/bash"

Remediation

Create and switch to a non-root user before the CMD / ENTRYPOINT: RUN adduser --system --uid 1000 app USER 1000 Or reuse the base image's shipped non-root account (e.g. `USER nobody`, `USER nonroot` on distroless). Multi-stage builds only need the USER directive in the final stage.

Evidence

id-token: write  # REQUIRED for PyPI Trusted Publishing (OIDC)

    steps:

      - name: Checkout

        uses: actions/checkout@v4

      - name: Validate version matches tag

        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

- name: Generate GitHub App token

        id: generate_token

        uses: tibdex/github-app-token@v2.1.0

        with:

          app_id: ${{ secrets.APP_ID }}

          private_key: ${{ secrets.APP_PRIVATE_KEY }}

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

uses: actions/checkout@v4

      - name: Set up Python

        uses: actions/setup-python@v5

        with:

          python-version: "3.11"

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

steps:

      - name: Checkout repository

        uses: actions/checkout@v4

        with:

          fetch-depth: 0  # Fetch all history for proper branch operations

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

python-version: "3.11"

      - name: Install uv

        uses: astral-sh/setup-uv@v4

      - name: Install dependencies

        run: uv sync --extra dev

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

id-token: write  # REQUIRED for MCP Registry GitHub OIDC login

    steps:

      - name: Checkout

        uses: actions/checkout@v4

      - name: Install MCP Publisher

        run: |

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

id-token: write 

    steps:

      - name: Checkout

        uses: actions/checkout@v4

      - name: Set up Python

        uses: actions/setup-python@v5

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

run: uv build

      - name: Publish to PyPI

        uses: pypa/gh-action-pypi-publish@release/v1

        with:

          packages-dir: dist

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

steps:

      - name: Checkout repository

        uses: actions/checkout@v4

        with:

          fetch-depth: 0  # Fetch all history for proper branch operations

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

name: Sync main to develop

    steps:

      - name: Checkout

        uses: actions/checkout@v4

        with:

          ref: main

          fetch-depth: 0

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

runs-on: ubuntu-latest

    steps:

      - name: Checkout code

        uses: actions/checkout@v4

      - name: Set up Python

        uses: actions/setup-python@v5

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

uses: actions/checkout@v4

      - name: Set up Python

        uses: actions/setup-python@v5

        with:

          python-version: "3.11"

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

steps:

      - name: Checkout repository

        uses: actions/checkout@v4

        with:

          fetch-depth: 0  # Fetch all history for proper branch operations

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

run: uv build

      - name: Publish to PyPI

        uses: pypa/gh-action-pypi-publish@release/v1

        with:

          packages-dir: dist

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

- name: Generate GitHub App token

        id: generate_token

        uses: tibdex/github-app-token@v2.1.0

        with:

          app_id: ${{ secrets.APP_ID }}

          private_key: ${{ secrets.APP_PRIVATE_KEY }}

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

uses: actions/checkout@v4

      - name: Set up Python

        uses: actions/setup-python@v5

        with:

          python-version: "3.10"

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

id-token: write  # REQUIRED for MCP Registry GitHub OIDC login

    steps:

      - name: Checkout

        uses: actions/checkout@v4

      - name: Wait for PyPI metadata propagation

        run: sleep 20

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

- name: Generate GitHub App token

        id: generate_token

        uses: tibdex/github-app-token@v2.1.0

        with:

          app_id: ${{ secrets.APP_ID }}

          private_key: ${{ secrets.APP_PRIVATE_KEY }}

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

skip: ${{ steps.check-sync.outputs.SKIP }}

    steps:

      - name: Checkout

        uses: actions/checkout@v4

        with:

          ref: main

          fetch-depth: 0

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

echo "All versions match: $TAG_VERSION"

      - name: Set up Python

        uses: actions/setup-python@v5

        with:

          python-version: "3.10"

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

name: ${{ matrix.ros-distro }}

    steps:

      - name: Checkout code

        uses: actions/checkout@v4

      - name: Set up Python

        uses: actions/setup-python@v5

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

if msg_data.get("op") == "status" and msg_data.get("level") == "error":

                        return {

                            "error": f"Advertise failed: {msg_data.get('msg', 'Unknown error')}"

                        }

                except json.JSONDecodeError:

                    pass  # Non-JSON response is usually fine for advertise

            # 2. Publish the message

            publish_msg = {"op": "publish", "topic": topic, "msg": msg}

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

# Detect ROS version and cache rosapi type resolver

        if ping_result.get("port_check", {}).get("open"):

            try:

                detect_rosapi_types(ws_manager)

            except Exception:

                pass  # Detection failure is non-fatal; tools will use defaults

        # Combine the results

        return {

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

feedback_msg = f"Action feedback #{feedback_count}: {str(feedback_values)[:100]}..."

                                    await ctx.report_progress(

                                        progress=feedback_count, total=None, message=feedback_msg

                                    )

                                except Exception:

                                    pass

                    except json.JSONDecodeError:

                        continue

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

if msg_data.get("op") == "status" and msg_data.get("level") == "error":

                        # Unadvertise before returning error

                        ws_manager.send({"op": "unadvertise", "topic": topic})

                        return {"error": f"Publish failed: {msg_data.get('msg', 'Unknown error')}"}

                except json.JSONDecodeError:

                    pass  # Non-JSON response is usually fine for publish

            # 3. Unadvertise the topic

            unadvertise_msg =

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

rclpy.init(args=args)

    node = ImagePublisher()

    try:

        rclpy.spin(node)

    except KeyboardInterrupt:

        pass

    finally:

        node.destroy_node()

        rclpy.shutdown()

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

# Check if already an IP address

    try:

        socket.inet_aton(hostname)

        return (True, hostname, None)  # Already an IP, no DNS needed

    except (socket.error, OSError):

        pass  # Not an IP, need DNS resolution

    # Try to resolve DNS

    try:

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

errors.append(

                                        f"Message {i + 1}: {msg_data.get('msg', 'Unknown error')}"

                                    )

                                    continue

                            except json.JSONDecodeError:

                                pass

                        published_count += 1

                        if duration:

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

progress=feedback_count,

                        total=None,

                        message=f"Action timed out after {timeout} seconds (received {feedback_count} feedback messages)",

                    )

                except Exception:

                    pass

            result = {

                "action": action_name,

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

completion_msg = f"Action completed successfully (received {feedback_count} feedback messages)"

                                    await ctx.report_progress(

                                        progress=feedback_count, total=None, message=completion_msg

                                    )

                                except Exception:

                                    pass

                            return {

                                "action": action_name,

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.