Gaggiuino MCP

Gaggiuino MCP Server

A Remote MCP server for integrating a Gaggiuino espresso machine with AI tools. Ask your AI assistant to check machine status, analyze shot data, and get dial-in guidance.

Features

MCP Tools

Shot Analysis

• get_status - Current machine status (temperature, pressure, weight, water level)
• get_latest_shot_id - Most recent shot, id and headline numbers in one call
• list_recent_shots - The last few shots summarised, for trends over a session
• get_shot_data - Structured shot summary with metrics
• get_shot_raw_data - Complete time-series data
• view_shot_graph - Interactive shot graph, shown in hosts that support MCP Apps (other hosts get the text summary only) (pressure, flow, weight over time with target overlays and optional shot comparison)

Profiles and Settings

• list_profiles - Profiles on the machine, merged with this server's documentation
• get_profile_info - Everything known about one profile
• get_machine_settings - Boiler, steam, and scale configuration as the machine reports it
• get_maintenance_status - Descale and backflush history the machine tracks itself, with shots since each
• get_dial_in_guidance - Expert guidance for analyzing espresso shots
• select_profile - Switch the active profile (changes the machine; requires an authenticated server)
• upload_profile - Save a new brew profile to the machine (changes the machine; requires an authenticated server). Creates only — it never updates, and the machine assigns a fresh id every time, so uploading twice leaves two profiles
• delete_profile - Delete a profile from the machine (destructive and irreversible; requires an authenticated server). It demands the profile's exact name back as confirmation, refuses to delete the currently selected profile, and always prompts for approval in the host — even under a stored "always allow"

MCP Prompts - workflow templates your host surfaces as slash commands or menu items:

• dial_in_new_bag - first shots on a coffee you have not pulled before (bean, and optionally roast level, dose, and what you want in the cup)
• diagnose_last_shot - read the shot you just pulled against how it tasted (what was wrong, and optionally what you changed)
• choose_profile - pick a profile the machine actually holds for a coffee (roast level, and optionally drink and notes)
• espresso_shot_analyst - the dial-in guidance as a system prompt (same content as get_dial_in_guidance)

Each workflow prompt lays out the tools to call in order, so the analysis starts from the machine's own data rather than a guess.

MCP Resources - gaggiuino://profiles and gaggiuino://profiles/{id} for profile data

Quick Start

The server is published as a multi-arch image (linux/amd64, linux/arm64) at ghcr.io/ljcl/gaggiuino-mcp, so there is nothing to clone or build. It is also listed in the MCP Registry as io.github.ljcl/gaggiuino-mcp.

1. Download and Configure

mkdir gaggiuino-mcp && cd gaggiuino-mcp

curl -O https://raw.githubusercontent.com/ljcl/gaggiuino-mcp/main/docker-compose.yml curl -o .env https://raw.githubusercontent.com/ljcl/gaggiuino-mcp/main/.env.example

Edit .env with your Gaggiuino machine's address:

# Use the IP directly (recommended)

GAGGIUINO_URL=http://192.168.1.100

Or if mDNS works on your network

GAGGIUINO_URL=http://gaggiuino.local

2. Start the Server

docker compose up -d

3. Verify

curl http://localhost:8000/health

The server is available at http:// :8000/mcp.

Choosing a Version

The compose file tracks latest, which is always the newest release. To pin one instead, set GAGGIUINO_MCP_TAG in .env:

GAGGIUINO_MCP_TAG=5.0    # newest 5.0.x patch

GAGGIUINO_MCP_TAG=5.0.0 # exact release

Builds of unreleased main are published as edge (and main- ). They can carry a breaking change that no release has announced yet, so use them only to try a fix before it ships.

Upgrade with:

docker compose pull && docker compose up -d

Configuration

Environment Variables

Health and logs

GET /health returns JSON:

{

"status": "ok", "version": "3.2.0", "uptimeSec": 3412, "machine": { "url": "http://gaggiuino.local", "state": "unreachable", "lastCheckedAt": "2026-07-27T21:11:15.274Z", "lastError": "Unable to connect. Is the computer able to access the url?", "versions": { "coreVersion": "a06f97fd", "frontVersion": "a06f97fd", "staticVersion": "a06f97fd" } } }

It answers 200 whenever the process is alive, including while the machine is unreachable — your espresso machine is off most of the day, and the container healthcheck reads the status code. machine.state is ok, unreachable, or unknown, observed from the requests the server already makes rather than from a probe, so /health puts no extra load on the machine. machine.versions is observed the same way — remembered the first time anything reads the machine's settings (get_machine_settings), never fetched by /health itself — so null there means "this server has not read the settings yet", not "the machine reports no version". Only those three documented fields are published: /health is unauthenticated, so anything a future firmware adds under versions stays out of it until someone decides otherwise.

Logs are one JSON object per line, so you can pick out what you need:

docker compose logs -f | jq -c 'select(.event == "tool.call" and .outcome != "ok")'

Securing the endpoint

Turn on OAuth before exposing this server beyond your LAN. Every tunnel option below puts /mcp on the public internet, and without authentication anyone who learns the URL gets the full tool surface against a machine in your kitchen. The server prints a warning at startup while nothing is configured.

Three variables, all required together:

# 1. The public origin clients will reach the server on — no path, https only.

This is advertised as the OAuth resource, so it must match the URL you

type into Claude exactly.

MCP_PUBLIC_URL=https://your-machine.tail-scale.ts.net

2. The key your tokens are signed with. Keep it stable across restarts, or

every restart signs you out of your phone.

openssl rand -hex 32

3. The passphrase you will type on the consent page. Store the hash, never

the passphrase — this prompts and prints the whole line to paste in.

cd apps/server && bun run hash-passphrase >> ../../.env

Then recreate the container — a plain restart is not enough:

docker compose up -d --force-recreate

Compose tracks the *list* of env_file paths, not their contents, so editing .env and running docker compose up -d (or restart) can reuse the existing container along with the environment it was created with. The new variables never reach the process and the server comes up unauthenticated exactly as if you had not set them — with no error, because from its point of view nothing is configured. Check what actually arrived:

docker inspect gaggiuino-mcp --format '{{range .Config.Env}}{{println .}}{{end}}' | grep MCP_

Setting only some of them fails at startup and names the missing one. That is deliberate: silently falling back to an open endpoint is how somebody exposes a tunnel believing it is protected. The corollary is worth knowing when diagnosing: a server that is *running* and unauthenticated has seen none of the three — if you believe you set them, the container is stale, not the config wrong.

Why OAuth and not a shared token

OAuth is the only credential this server accepts, because it is the only one a Claude connector can present. A connector is added at the account level so one entry has to work on claude.ai, Claude Desktop and iOS, and on a personal plan the "Add custom connector" dialog offers an OAuth Client ID and Secret and no request-header field. A local stdio bridge is not a way around it either — it cannot run on iOS. A shared-secret header would sit in .env with no client able to send it, leaving the write tools permanently refused on exactly the deployment this project is built for. (If a long-lived .env still carries MCP_AUTH_TOKEN from a pre-2.0 install, delete the line: nothing reads it, and it does not gate /mcp.)

When you connect, Claude discovers the endpoint, sends you to a consent page served by this server, and you type the passphrase. There is nothing to register and no client secret to store.

What each part protects

/health and the /.well-known/* discovery documents are deliberately unauthenticated — the container's healthcheck presents no credential, and a document a client fetches *in order to* authenticate cannot itself require authentication.

select_profile, upload_profile and delete_profile — the tools that change the machine — need the espresso:write scope. A token without it gets a 403 that prompts Claude to ask you for the extra permission rather than failing silently. With nothing configured at all they refuse to run and say so, which is why an open server is a defensible default for a LAN and a machine-control tool on one is not.

Requests carrying an Origin header are rejected unless the origin is listed in MCP_ALLOWED_ORIGINS. This is what stops any web page you happen to visit from POSTing to a server running on your own network — a token does not help there, because the browser sends it for you. Requests with no Origin (Claude Desktop, curl, anything that is not a browser) are unaffected, so the default empty list is the right setting for almost everyone.

Listing an origin also makes /mcp answer