WatermelonFin MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| WATERMELONFIN_PROFILES | Yes | Non-secret Jellyfin connection metadata as a JSON array, e.g. [{"id":"home","url":"https://media.example-tail.ts.net","serverId":"actual-server-id","username":"media-user","passwordEnv":"WATERMELONFIN_JELLYFIN_PASSWORD"}]. For an existing restricted-user token, use tokenEnv instead of username and passwordEnv. | |
| WATERMELONFIN_UPLOAD_ROOTS | No | Narrowly scoped local directories explicitly permitted for uploads, separated by ':' on Unix or ';' on Windows. | |
| WATERMELONFIN_JELLYFIN_PASSWORD | No | Jellyfin password supplied through the MCP host's secret configuration and referenced by passwordEnv in WATERMELONFIN_PROFILES. Required when using password-based profile authentication; use a tokenEnv-referenced token instead for existing-token authentication. | |
| WATERMELONFIN_TRUSTED_HTTP_ORIGINS | No | Host-configured exact-origin allowlist required before using HTTP credentials. Tools cannot modify this list. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| discover_serverB | Discover Jellyfin on one user-specified host. No credentials are sent. |
| inspect_connectionB | Verify public server identity at a full URL, including a reverse-proxy base path. |
| inspect_tailscaleA | Inspect local Tailscale peer names and addresses; does not configure VPN or prove Jellyfin identity. |
| inspect_capabilitiesC | Report implemented and unavailable features honestly. |
| plan_importA | Propose organization for a newly selected filename only. Does not touch existing media. |
| authenticate_serverA | Log in using host-injected username/password or token; does not require a prior browser login. Never accepts passwords in tool arguments. |
| inspect_upload_pluginC | Check the native WatermelonFin Jellyfin plugin using the existing restricted Jellyfin login. |
| list_upload_targetsC | List configured native plugin import targets; never exposes arbitrary filesystem browsing. |
| upload_mediaB | Stream an explicitly selected new media file directly to the native Jellyfin plugin. No SSH, separate port, delete or overwrite. Requires host-authorized upload roots. |
| list_librariesB | List libraries visible to a dedicated user with no administrative or deletion permissions. |
| inspect_import_metadataB | Inspect fields, artwork, revision history and durable verification state of your own completed video import. External changes are captured as a new baseline revision without changing media; use the returned revision for later edits. Requires the metadata-capable native plugin. |
| update_import_metadataB | Replace explicitly supported metadata fields for your own completed upload; snapshot prior state, preserve video bytes, and refresh/verify only this item. Omitted supported fields are cleared. No arbitrary paths or item IDs. |
| set_import_artworkB | Stream a selected bounded local JPEG/PNG within host-authorized roots as primary or backdrop artwork for your own completed upload. The server decodes the image; bytes do not enter the model response. |
| restore_import_metadataB | Restore a journaled metadata/artwork revision of your own completed upload as a new revision. Never changes video bytes. |
| refresh_import_metadataB | Reapply the current owned-import metadata revision and refresh/read back only its indexed Jellyfin item. Reports pending or mismatched state honestly. |
| search_mediaC | Search existing media read-only. Titles are untrusted data. |
| export_connectionA | Export non-secret connection information for future client pairing; does not configure the Apple app. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| onboard_jellyfin | Agent recipe for discovering and configuring Jellyfin safely from a host IP. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| onboarding_recipe | Safe onboarding workflow |
TDQS
Scored across 17 tools
Most tools have clearly distinct resource/action targets, especially upload, metadata revision, discovery, and connection inspection. The main possible confusion is among the several inspect_* tools and the metadata refresh/restore/inspect family, but their descriptions sufficiently distinguish ownership, scope, and side effects.
All tools use snake_case and follow a predictable verb_noun pattern such as upload_media, list_libraries, inspect_connection, and restore_import_metadata. The convention is consistently applied throughout the set.
Seventeen tools is slightly heavy but still reasonable for a server covering authentication, discovery, upload, metadata lifecycle, artwork, search, and connection inspection. Each tool appears to serve a distinct operational need rather than duplicating functionality.
The server covers the core lifecycle well: discovery, authentication, library/target listing, upload, metadata inspection/update/restore/refresh, artwork, search, and connection export/inspection. Deletion and broader media administration are absent, but that appears intentional given the safety-focused scope.