Brivo Velocity
# Brivo Velocity
An MCP ([Model Context Protocol](https://modelcontextprotocol.io)) server that gives Claude read-only access to the [Brivo Access Control API](https://www.brivo.com/) — sites, access points, control panels, users, credentials, schedules, cameras, and more.
## What it does
Exposes every read-only (`GET`) endpoint of Brivo's Access API as an MCP tool — 75 in total — so Claude can look up and reason about your Brivo account's access-control data directly in conversation: list sites, check a door's live status, pull a user's photo, inspect schedules and holidays, and more. No write/control actions (unlock, credential changes, user edits, etc.) are implemented — this is a read-only tool by design.
## Status
Windows and macOS are both built and verified via CI on real `windows-latest`/`macos-latest` runners. macOS binaries are signed ad-hoc only (no Apple Developer account/notarization) — you'll need to right-click → Open the first time to get past Gatekeeper's "unidentified developer" warning.
## Requirements
- Windows or macOS
- Your own Brivo Access API credentials: a Client ID/Secret and API key from [developer.brivo.com](https://developer.brivo.com/apps/mykeys), plus either your Brivo admin username/password (`password` grant) or a registered redirect URI (`authorization_code` grant) — matching however your Brivo Application is registered in Brivo's Marketplace.
## Setup
1. Download the latest binary for your platform from [Releases](https://github.com/ThatGuyinIT/brivo-velocity/releases) (`brivo-velocity-<version>-windows-x64.exe` for Windows, `brivo-velocity-<version>-macos-arm64` for macOS) and put it somewhere permanent, e.g. alongside any other local MCP servers you run.
2. Run it once, or just add it to Claude Desktop's config and launch Claude — it creates a `brivo-velocity.env` file next to itself with blank placeholders on first run.
3. Fill in `brivo-velocity.env` with your own Brivo credentials. If any value contains a `#`, wrap it in double quotes (e.g. `BRIVO_PASSWORD="my#password"`) — otherwise everything after the `#` is silently dropped as a comment.
4. Add it to Claude Desktop's MCP config (`claude_desktop_config.json`):
```json
"brivo-velocity": {
"command": "C:\\path\\to\\brivo-velocity.exe",
"args": [],
"env": {}
}
```
On macOS, `command` is the path to the extensionless `brivo-velocity` binary instead.
5. Restart Claude Desktop. You should see all 75 tools under "Read-only tools" in that connector's Tool Permissions page.
## Building from source
Requires Node.js 24+.
```bash
npm install
npm run build # compiles TypeScript -> dist/
npm run package # bundles everything into dist/brivo-velocity(.exe)
```
## Development
```bash
npm run test:read-only # exercises every tool against a real Brivo account end to end
```
## License
MIT — see [LICENSE](./LICENSE).
TDQS
Scored across 75 tools
Many tools are scope-variant listings of the same underlying resources (e.g., List_sites/List_root_sites/List_sites_proximity, List_access_points/List_site_access_points, List_cameras/List_site_cameras/List_access_point_cameras). Descriptions clarify intent, but the 75-tool set still creates real misselection risk among similar list/get endpoints.
Almost all tools follow a predictable List_/Get_/Count_ + snake_case noun pattern, which is easy to parse. There are minor anomalies such as Get_admin_assignments and the generic List_activities, but the convention is largely consistent.
75 tools is an extreme count for an MCP surface, especially because many are granular read-only list/get endpoints that could be consolidated with filters or pagination. This far exceeds the typical 3-15 well-scoped range and creates a heavy cognitive load.
The surface appears entirely read-only (List, Get, Count); there are no create, update, delete, assign, lock/unlock, or other lifecycle operations. For an access-control domain, this leaves severe gaps in managing users, credentials, groups, sites, and access points.