Radarr · Sonarr · Whisparr · Lidarr · Prowlarr · Bazarr · Jellyfin · Plex · Seerr · SABnzbd · NZBGet · Transmission · qBittorrent · Profilarr · Cleanuparr · Reclaimerr · Dispatcharr · Shelfmark · Grimmory
That difference is the whole point, because the interesting questions live between services:
"Why isn't the film I requested on Tuesday showing up in Jellyfin?"
No single service can answer that. It spans Seerr, Radarr, Prowlarr, SABnzbd and Jellyfin. Five APIs, five sets of ids, five half-answers. arr-mcp correlates them and hands back the causal chain:
diagnose_media { query: "Blade" }
No file on disk yet. Trigger a search in Radarr or Sonarr. Nothing is downloading and no indexer reported a failure.
It even answers with a service down, and tells you which part it could not check rather than guessing across the hole.
🔍 diagnose_media answers what no single service can |
Walks the whole chain (requested, managed, monitored, downloaded, indexed, imported, scanned) and names the first thing that explains the absence. |
| 🗂️ A record that outlives the title | Deleting a title deletes its history. Turn on the library event log and arr-mcp keeps what Radarr, Sonarr and Lidarr report, so get_history and diagnose_media can still tell you what happened to it. |
| 🧮 Quality profiles that cannot do what they say | A minimum score nothing can reach, a language preferred but never required, a format scored where its wider twin sits at zero. Hand-built or synced from TRaSH Guides through Profilarr, the same checks apply. The arithmetic ones are proved rather than guessed, and every fix names a change to make in Profilarr, which owns them. |
| 🛡️ Indexer text is data, never instruction | Release names from public indexers are attacker-controllable and flow straight into model context. arr-mcp fences every one of them. |
| ✋ Writes are opt-in, previewed, recorded | Off until you turn them on, per service. Every write shows you exactly what it would do and waits for confirmation, and lands in an audit trail either way. |
| 🖥️ A config page that diagnoses | Add services from a browser, see what is broken and what to do about it, read the logs and the write audit. No YAML required. |
| 📚 Forty-four tools, one vocabulary | Every list pages the same way and answers readably whether or not your client reads structuredContent, every error names the config key that would fix it, every write takes ids rather than titles. |
Also in the repo as docker-compose.example.yml.
On Unraid, use unraid/arr-mcp.xml instead: a
Community Applications template with the appdata path and 99:100 ownership
already set. It is not listed in CA yet, so for now drop it into
/boot/config/plugins/dockerMan/templates-user/ and pick it from the template
list under Add Container. Steps 1 to 3 below are the same once it starts.
On Proxmox VE, proxmox/ builds an unprivileged Debian LXC
from source instead, no Docker anywhere. Run it on the host, not in a guest:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/bardesss/arr-mcp/main/proxmox/ct/arr-mcp.sh)"It defaults to 2 cores, 2 GB and 8 GB of disk. The memory is sized for the
optional IMDb ingest, not for serving. config.yaml, the MCP
tokens (hashed) and the databases live in /config, which an update does not touch; run
update inside the container to rebuild it from the latest release. Re-running
the command above on the host builds a second container instead. If it installs
but never answers, journalctl -u arr-mcp is the log.
It follows the Community Scripts conventions but is not in their catalogue. One tester has reported a clean install so far, and arm64 has not been tried, so the script asks rather than assuming. Either way, open an issue. Steps 1 to 3 below are the same once it boots.
services:
arr-mcp:
image: ghcr.io/bardesss/arr-mcp:latest
container_name: arr-mcp
ports:
- 6060:6060
volumes:
- ./config:/config
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Amsterdam
restart: unless-stopped1. Open http://<host>:6060: the bare host, no path. Nothing to read out
of the container log.
2. Claim it. The first page is a setup form rather than a sign-in: choose a username and a password of at least 12 characters.
Important
Do this before exposing the port. Until it is claimed, whoever loads that page first owns the instance, and it holds every service's API key.
3. Add your services: Add a service, paste its URL and API key (for Plex,
its X-Plex-Token; for NZBGet, Transmission, qBittorrent and Grimmory, its username and password; a Shelfmark with no authentication needs no key), save. It applies immediately; there is
no restart. Configure only what you run. A config file that will not parse does
not take the container down: arr-mcp serves a repair page with the error and an
editor instead.
Your MCP client goes to http://<host>:6060/mcp with an MCP token. Create one on
the config page; it is shown once, so copy it into your client straight away.
Each token has its own tier and expiry, see
MCP tokens. A client that can only be given a
URL, not a header, can carry the token as ?token= instead; see
allow_token_in_url. If you already
run an identity provider, /mcp also accepts short-lived OAuth 2.1 access
tokens, each with a scope that caps what that client may do, never more than
config.yaml already permits. See auth.oauth. Everything
the UI does is still just config.yaml, and editing that by hand remains
supported. Clients that read the
MCP Registry find it there as
io.github.bardesss/arr-mcp. It is also listed on Glama:
A client that launches its servers as child processes can run arr-mcp
over stdio instead, with --stdio. That
connection is read-only; writes need /mcp and a token.
Works with whatever you point at it. A client asking for
Accept: application/json, or sending no Accept at all, gets one JSON object
back rather than a refusal for not also naming text/event-stream. A client
that accepts a stream still gets one. Even a refusal is JSON, so a plain curl
works as-is.
Image tags are X.Y.Z, X.Y, X and latest, plus main for bleeding edge.
Pin a major (:2) and no tool or parameter you rely on goes away; pin a minor
(:2.0) if you would rather approve each new tool surface yourself. Images are published for amd64 and arm64, so a Raspberry Pi or an
ARM NAS runs the same build as everything else.
Forty-four tools, but you never name them. You ask, and the model picks:
"What's downloading right now, and is anything stuck?" "What aired this week that I haven't watched?" "Which of my indexers are failing, and what did they say?" "Find me something highly rated from 1994 I don't already have." "Go and find Dutch subtitles for the film that just landed." "Not that release, grab the 1080p remux instead." "Why does this episode keep failing and never downloading?" "Pause SABnzbd, I need the bandwidth for an hour." "What are my seeding rules, and is anything still seeding past them?" "That download finished days ago and never got imported. Sort it out." "Put this series on the 4K profile and only monitor future seasons." "This profile says it wants Dutch but keeps grabbing English, why?" "Has anything in Radarr drifted from what Profilarr set?" "Why is the TV guide empty, and is my IPTV subscription about to run out?" "Which of my shows have metadata that does not match the files?" "These episode titles are wrong for the files. Fix them." "Unmonitor season 5 and delete its files." Previewed first, always.
In a client that renders MCP Apps
(Claude Desktop and claude.ai), a film or series comes back as a card rather
than a line of text. get_media_details shows one card: poster, blurred
backdrop, synopsis, genres, runtime or seasons, episode progress, a status badge
(available, monitored, downloading, unmonitored, not in library) with the
quality profile, and links to TMDB and IMDb. search_media and
get_library show a grid of up to twenty posters, each with its status.
Nothing to configure, and no TMDB key. The artwork is what Radarr and Sonarr
already hold (remoteUrl, from TMDB and TheTVDB) and the poster paths Seerr
returns from TMDB. The card loads those images straight from image.tmdb.org
and artworks.thetvdb.com, the only hosts its CSP allows; your services' own
addresses and API keys never reach it. A title with no artwork, or whose image
will not load, gets a plain tile with its name.
Nothing changes for any other client. The text answer and
structuredContent are identical. The cards ride in the result's _meta, which
is not model context, and are only built for a client that says it renders MCP
Apps, or one that says nothing (stateless HTTP). tools.media_cards: false turns
them off. The cards are read-only for now.
| Tools | All forty-four, what each answers, and the fields whose meaning is not obvious |
| Writes | Turning them on, the two tiers, and the preview-and-confirm handshake |
| Configuration | config.yaml, the nine services that take a list, Jellyfin's default_user, running Plex and Jellyfin side by side |
| Config UI | The four pages, and what each does that is not obvious |
| Management API | JSON API for companion apps to see and manage services, settings and tokens, with named read or admin keys you create on the config page |
| IMDb ratings | The only way to get an IMDb score for a series, and what it costs |
| Security | The threat model, walked against the OWASP MCP Top 10, including what it does not solve |
| Contributing | Which services qualify, how to add an adapter, and the rules an AI agent tends to break |
- At least one supported service, LAN-reachable: Radarr 4.0+, Sonarr 4.0+, Whisparr 2.x (V2 only, not Eros), Prowlarr 1.0+, Bazarr 1.4+, Jellyfin 10.9+, Plex Media Server (no minimum enforced; verified on 1.43), Seerr 1.0+, SABnzbd 3.0+, NZBGet 21.0+, Transmission 3.0+, qBittorrent 4.1+, Profilarr 2.2.0+, Cleanuparr 2.10.0+, Reclaimerr 0.6.0+, Dispatcharr 0.33.0+, Shelfmark 1.5.0+, Grimmory 3.5.0+
- Lidarr 2.1.3+ for reading, monitoring, adding, changing and deleting artists,
its queue, its wanted list and calendar, release search,
diagnose_media,trigger_scan,fix_metadataandget_stack_health. Artists join to Jellyfin and Plex on the MusicBrainz artist id; Tools says what each tool does with them. - Docker, or Node 24+ to run from source
- An MCP client. Protocol revision
2026-07-28is the native one; clients on a 2025-era revision are still served
The tool surface is the public API: renaming or removing a tool, a parameter or a response field is a major, because that break is silent: a model stops finding a renamed tool rather than raising an error. 2.0.0 removed what 1.x had deprecated; the changelog lists each name with its replacement.
Contributions are welcome, and new service adapters most of all: Emby and Deluge would both be accepted today, and the list says so in advance, along with the ones that would not be. An adapter is deliberately the most self-contained thing in the codebase. Two things to know first: not every service qualifies (which services qualify), and I cannot test a service I do not run, so the second bar is that you tested it against your own live instance and the PR says what you tested and against which version.
One adapter remains unverified: qBittorrent. The maintainer runs neither Plex, qBittorrent nor NZBGet, so testing means running a build against your own server and reporting what worked. Plex and NZBGet have been verified live by volunteers and contributors; qBittorrent still waits on that kind of report. The design behind Plex, and what else is on the list.
AI-assisted contributions are welcome, held to the same bar and no other; arr-mcp is itself built with a coding agent. Point yours at CONTRIBUTING.md.
Missing a tool? Open an issue describing the question you could not get answered rather than the tool you think should exist. Often the answer is a new parameter on one that already exists.
arr-mcp is not designed to be exposed to the internet. The /mcp endpoint
requires a bearer token because "LAN-only" is a network assumption rather than a
security control. It fronts every service credential you configure and, once enabled, file
deletion, and a home network contains guest phones and IoT devices. Put it
behind a reverse proxy with TLS if it needs to leave the LAN, and pin
allowed_hosts if you do.
Beyond the network: writes are off until you enable them, every write is previewed and confirmed before it acts, and everything a service returns is fenced as data rather than instruction. Security walks all of it against the OWASP MCP Top 10, and is equally explicit about what it does not solve. Found something? SECURITY.md.
Everyone who has had a pull request merged into arr-mcp. The grid updates on its own as new contributors land.
Testing counts as much as code here. Plex is verified because of @Svnow132 (#180) and @davidgibbons (#312).
arr-mcp is glue; the hard parts belong to other people. Nearly every service it speaks to is free software maintained largely by volunteers: Radarr, Sonarr, Whisparr, Lidarr, Prowlarr, Bazarr, Jellyfin, Seerr, SABnzbd, NZBGet, Transmission, qBittorrent, Profilarr, Cleanuparr, Reclaimerr, Dispatcharr, Shelfmark, Grimmory, as are the libraries it is built on: MCP TypeScript SDK, Hono, Zod, Pino, Vitest, yaml and TypeScript. If you find arr-mcp useful, consider supporting them first. Plex is the exception: a commercial product, but its API carries as much of the work as the rest.
When you enable the IMDb dataset: information courtesy of IMDb, used with permission, for personal and non-commercial use.