arr-mcp

One MCP server for your whole self-hosted media stack — not one per service.

Ask questions no single service can answer. "Why isn't the film I requested on Tuesday showing up in Jellyfin?" spans Seerr, Radarr, Prowlarr, SABnzbd and Jellyfin. arr-mcp correlates them and gives you the causal chain.

• A web config page that diagnoses connections instead of printing pass/fail, and shows live logs while you debug.

• Tool output is treated as untrusted data, never instruction. Release names from public indexers are attacker-controllable and flow straight into model context; arr-mcp fences them.

• Safe by default. Deletion is off until you deliberately enable it, and then still asks per call.

Status: 0.3 — all eight services

Every service reachable, with stack_health reporting versions, disk space, failing checks and library scan staleness across the whole stack. The read tools that answer questions about your library land in the same release; the cross-service diagnose arrives in 0.4. See the roadmap.

Services

Radarr · Sonarr · Prowlarr · Bazarr · Jellyfin · Seerr · SABnzbd · Transmission

All eight are supported as of 0.3.

Related MCP server: arr-stack-mcp

Tools

Every tool takes detail (minimal/standard/full) and limit, and reports { total, returned, truncated } — a truncated answer always says so. Tools spanning several services also report which ones they could not reach, and how many results each contributed, so a long answer from one service can never silently hide another.

Reads only. Writes arrive in 0.5, behind per-service permission toggles and per-call confirmation.

Quick start

services:
  arr-mcp:
    image: ghcr.io/bardesss/arr-mcp:0.3
    ports: ['6060:6060']
    volumes: ['./config:/config']
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Amsterdam
    restart: unless-stopped

Tags are X.Y.Z, X.Y, X and latest for releases, plus main for bleeding edge. Pin a minor while the tool surface is still moving.

On first start, config/config.yaml is created and the bearer token for the MCP endpoint is printed to the container log — docker logs arr-mcp. Add your services to that file:

services:
  radarr:
    url: http://192.168.1.20:7878
    api_key: "…"
  jellyfin:
    url: http://192.168.1.20:8096
    api_key: "…"
    default_user: "you"      # whose watched state `watched` means
  transmission:
    url: http://192.168.1.20:9091
    username: "…"            # Transmission has no API key
    password: "…"

All eight are supported: radarr, sonarr, prowlarr, bazarr, jellyfin, seerr, sabnzbd, transmission. Configure only what you run — anything you leave out is simply absent, not broken.

A misspelled key, an unknown service, or an api_key on Transmission fails at startup with the offending field named, rather than being silently ignored.

Until the config UI arrives in 0.6, edit the file by hand and restart the container to pick up changes.

Roadmap

Each version is a self-contained, shippable slice — the goal is that 0.4 already answers questions no individual service can, with 0.5–0.7 making it complete.

0.1 and 0.2 are the same code under two tags. Dropping the component prefix from the release configuration made the release tooling treat the package as new and re-cut it; the changelog shows the same features twice. Not two releases.

Requirements

• A LAN-reachable install of at least one supported service, at or above its minimum version

• Docker, or Node 24+ to run from source

• An MCP client speaking protocol revision 2026-07-28

A service below its floor is reported unhealthy — no disk space, no failing health checks, no scan state, not just a version complaint — and contributes nothing to stack_health until it is upgraded.

Security

arr-mcp is not designed to be exposed to the internet. The /mcp endpoint requires a bearer token because "LAN-only" is a network assumption rather than a security control — the endpoint fronts up to eight API keys and, once enabled, file deletion, and a home network contains guest phones and IoT devices.

Thanks

arr-mcp is glue. The hard parts belong to other people.

The services it speaks to — none of this exists without them, and every one is free software maintained largely by volunteers:

Radarr · Sonarr · Prowlarr · Bazarr · Jellyfin · Seerr · SABnzbd · Transmission

The libraries it is built on:

If you find arr-mcp useful, consider supporting the services above first.

Licence

MIT