FRITZ!Box MCP Server
About
Control AVM FRITZ!Box routers - manage devices, WiFi, network settings, parental controls, and schedule time-delayed actions
Details
- Author
- kambriso
- Categories
- Other, Infrastructure, Security
Jump to
Setup
Install FRITZ!Box MCP Server in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/kambriso/fritzbox-mcp-server
Follow the installation instructions in the repository README, then restart your MCP client.
Control your FRITZ!Box router through AI assistants like Claude using natural language.
](https://mcpservers.org/servers/kambriso/fritzbox-mcp-server)
This MCP server lets you interact with your FRITZ!Box router using AI assistants. Ask questions in plain language, analyze your network, manage devices, troubleshoot issues, and configure settings without touching the web interface.
1.2. How it works (Security Architecture)
The MCP server runs on your computer and acts as a secure bridge between AI agents (which run in the cloud) and your FRITZ!Box (which stays completely local).
Your FRITZ!Box credentials are stored locally in a.envfile on your computer. The MCP server uses these credentials to communicate with your FRITZ!Box over your local network only.
The AI agent receives only the results (like "3 devices connected" or "Router uptime: 5 days"), never your credentials or direct access to your router.
- Your FRITZ!Box never needs internet exposure
- No ports need to be opened
- No cloud connection to your router
- Credentials stay on your computer
- All router communication happens on your local network only
Works with ALL FRITZ!Box models and firmware versions. When AVM releases new features or models, this server adapts automatically. No updates needed.
Unlike other solutions that break with firmware updates or only work with specific models, this server discovers your router’s capabilities in real-time.
Download and install with automatic checksum verification:
curl -fsSL https://raw.githubusercontent.com/kambriso/fritzbox-mcp-server/main/install.sh | sh
- Detect your platform (OS and architecture) automatically
- Download the latest release from GitHub
- Verify SHA256 checksums for security
- Install to~/.local/bin/fritz-mcp
- Make the binary executable
Get the binary for your system fromReleases:
fritz-mcp-linux-amd64.tar.xzorfritz-mcp-linux-arm64.tar.xz
fritz-mcp-darwin-amd64.tar.xzorfritz-mcp-darwin-arm64.tar.xz
fritz-mcp-windows-amd64.ziporfritz-mcp-windows-arm64.zip
Extract the archive and make it executable (Linux/macOS):
tar -xJf fritz-mcp-linux-amd64.tar.xz chmod +x fritz-mcp
The easiest way to configure your FRITZ!Box is using the interactive setup mode. This will automatically discover your router on the network and guide you through the configuration process.
- Discover: Find FRITZ!Box devices using SSDP on your local network.
- Identify: Automatically detect the Mesh Master (gateway).
- Configure: Prompt for your host, username, password, and TLS preference.
- Secure: Save credentials to a.env file with 0600 permissions (read/write only by you).
Your FRITZ!Box user needs full settings access.
In the FRITZ!Box web interface (http://fritz.box):
- Go to System → FRITZ!Box-Benutzer → [Your User] → Berechtigungen
- Enable: "FRITZ!Box-Einstellungen" (or "The user can view and edit all FRITZ!Box settings")
For Windows and macOS, Claude Desktop is the most direct option. As of June 15, 2026, Anthropic does not provide an official Claude Desktop app for Linux. On Linux, use any MCP-compatible client or editor integration that can launch a local stdio server and addfritz-mcpthere with the same command shown below.
%APPDATA%\Claude\claude_desktop_config.json
~/Library/Application Support/Claude/claude_desktop_config.json
{ "mcpServers": { "fritzbox": { "command": "/path/to/fritz-mcp" } } }
Restart your MCP client after config changes.
"What’s my external IP address?"
"Show me all connected devices"
"How long has the router been running?"
"What’s my current internet speed?"
"Analyze my network health and tell me if everything looks good"
Claude will check your connection quality, identify issues, explain patterns in your logs, and provide recommendations.
Network Health Analysis Connection: Healthy ✓ - Speed: 112 / 37 Mbit/s (down/up) - Signal quality: Excellent - No errors detected Daily Reconnections at 04:00: This is normal. Your ISP enforces 24-hour session limits. FRITZ!Box reconnects proactively to avoid forced disconnection. One DSL resync on Dec 7 at 12:52: Single event, recovered in 4 minutes. Monitor for recurring patterns, but not concerning as an isolated incident. Overall: Network operating optimally.
"Which devices are using the most bandwidth?"
"List unknown devices in my network"
"Prioritize my laptop’s bandwidth - I have a video call"
2.2.4. Parental Controls & Scheduling
"Block the Nintendo Switch in 20 minutes"
"Disable internet for all gaming devices during work hours"
"Enable guest WiFi at 6 PM for the party"
"Check if there are any connection problems"
"Show me recent disconnections"
Prompt: "Analyze my network health and check if everything is running optimally"
- Queries device info and uptime
- Checks connection status and stability
- Analyzes line quality and error rates
- Reviews logs for patterns
- Distinguishes normal behavior from issues
- Provides recommendations
Prompt: "Show me all devices - which are online and are there any unknown devices?"
- Lists all registered devices
- Categorizes by status (online/offline)
- Groups by connection type (WiFi/Ethernet)
- Identifies unknown or suspicious devices
- Provides security analysis
Prompt: "Block the gaming console in 20 minutes"
Claude schedules the action to execute automatically, even after you close the chat.
This uses the server’s CLI mode for persistent background execution.
Ensure your FRITZ!Box user has full settings permission enabled.
2.4.2. Your MCP client doesn’t see the server
If you use Claude Desktop on Windows or macOS, verify the path inclaude_desktop_config.jsonis absolute and correct.
On Linux, verify the command/path in your MCP client’s server configuration is absolute and correct.
Windows users: Use double backslashes in paths.
Restart your MCP client after config changes.
Your FRITZ!Box user needs "FRITZ!Box-Einstellungen" permission enabled. See configuration section above.
All communication stays on your local network. Your credentials are stored locally in a.envfile and used only to communicate with your FRITZ!Box. The AI receives only the results of operations, never your credentials.
No cloud services. No external servers. Everything runs locally.
2.5.2. Supply chain Levels for Software Artifacts (SLSA)
GitLab releases include SLSA Level 2 provenance viaartifacts-metadata.json.
# Download binary and SLSA metadata glab release download <tag> -R kambriso/fritzbox-mcp-server \ -n 'fritz-mcp-linux-amd64' -n 'artifacts-metadata.json' # (1) # Examine provenance cat artifacts-metadata.json | jq '.predicateType' # Output: "https://slsa.dev/provenance/v1" # Verify artifact digest matches sha256sum fritz-mcp-linux-amd64 # Compare with digest in artifacts-metadata.json subjects
make verify-slsa-gitlab-linux-amd64 SLSA_TAG=<tag>
- In-toto statement format (https://in-toto.io/Statement/v0.1)
- SLSA v1 predicate with build definition
- SHA256 digests for all artifacts
- GitLab CI environment parameters
GitHub releases include SLSA Level 3 provenance via theslsa-github-generator.
# Download binary and provenance gh release download <tag> -R kambriso/fritzbox-mcp-server \ -p 'fritz-mcp-linux-amd64' -p '*.intoto.jsonl' # Verify provenance go run github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@latest \ verify-artifact fritz-mcp-linux-amd64 \ --provenance-path multiple.intoto.jsonl \ --source-uri github.com/kambriso/fritzbox-mcp-server \ --source-tag <tag> # (1)
make verify-slsa-github-linux-amd64 SLSA_TAG=<tag>
All binaries are signed usingCosignwith keyless signing (OIDC). Signatures and certificates are included in the release artifacts.
# Download binary, signature, and certificate # (from GitLab artifacts or GitHub release) # Verify signature cosign verify-blob \ --signature fritz-mcp-linux-amd64.sig \ --certificate fritz-mcp-linux-amd64.pem \ --certificate-oidc-issuer https://gitlab.com \ fritz-mcp-linux-amd64
All verification can be performed offline using standard tools:
# 1. Verify checksums match across forges diff <(curl -sL gitlab-SHA256SUMS) <(curl -sL github-SHA256SUMS) # 2. Verify binary matches checksum sha256sum -c SHA256SUMS # 3. Verify SLSA provenance (slsa-verifier or manual inspection) # 4. Verify cosign signature (requires network for certificate chain) # Full trust chain: source code -> CI build -> signed artifact -> your machine
This project publishes identical releases on both GitLab and GitHub. Cross-forge verification proves that neither forge has been compromised - if an attacker modified binaries on one forge, the checksums would not match.
This is independent of SLSA: while SLSA proves "this binary came from this source", cross-forge verification proves "both forges serve the same binary".
# Download checksums from both forges curl -sL "https://gitlab.com/.../SHA256SUMS" -o gitlab-SHA256SUMS curl -sL "https://github.com/.../SHA256SUMS" -o github-SHA256SUMS # Compare - must be identical diff gitlab-SHA256SUMS github-SHA256SUMS && echo "Cross-forge verification passed" # Or using CLI tools: gh release download <tag> -R kambriso/fritzbox-mcp-server -p 'SHA256SUMS' -D github glab release download <tag> -R kambriso/fritzbox-mcp-server -n 'SHA256SUMS' -D gitlab diff github/SHA256SUMS gitlab/SHA256SUMS
- Protects against single-forge compromise
- Validates reproducible builds work correctly
- No trust in any single platform required
- Users can verify with standard tools (curl, diff, sha256sum)
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
