Administrator/real-debrid-downloader
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 512 Wiki Activity
v1.7.227
real-debrid-downloader/tools/rd-diagnostics-mcp
History
Sucukdeluxe 4543ac3c1a Ferndiagnose (MCP) erweitert: Live-Provider-Laufzeitzustand + Conversion-Log 
Motiviert durch die Mega-Debrid-Cooldown-Diagnose: der account-weite Cooldown musste
aus Log-Arithmetik rekonstruiert werden (alle Fehlerzeilen zeigten ms-genau auf
dieselbe Deadline). Genau diese Sicht-Luecke wird geschlossen.

Neu:
- GET /providers (debrid.ts getProviderRuntimeSnapshot): Live-Laufzeitzustand pro
  Mega-Account / Debrid-Link-Key — AKTIVER Cooldown (untilMs/remainingMs/Grund/
  Kategorie/untilRestart), in-flight-Tiefe, Mega-Rotationscursor + Sticky-Count,
  Empty-Response-Streaks, Debrid-Link Key-/Host-Cooldowns + Runtime-Status. Account-
  Keys sind nicht-umkehrbare Hashes (mda_<fnv1a64>), keine Logins/Tokens.
- GET /logs/conversion: der pro-Item Link-Aufloesungs-Lebenszyklus (Token, API
  getLink, Web, Account-Rotation, Abbrueche mit Zeiten) aus conversion.log.
- Beide auch im /diagnostics-Aggregat (providers + logs.conversion) -> rd_diagnostics
  zeigt die Cooldowns jetzt direkt.
- MCP-Bridge: neues Tool rd_providers + "conversion" in der rd_logs-Enum + README.

Test: getProviderRuntimeSnapshot spiegelt einen geprimten Account-Cooldown
(until/remaining/Grund) und ist vorher null. Suite 935 gruen, tsc 6.
2026-06-21 21:37:52 +02:00
..
src Ferndiagnose (MCP) erweitert: Live-Provider-Laufzeitzustand + Conversion-Log 2026-06-21 21:37:52 +02:00
test Ferndiagnose (MCP): Verbindungscode + abgesicherter Fernzugriff + stdio-Bridge 2026-06-19 17:05:28 +02:00
package-lock.json Ferndiagnose (MCP): Verbindungscode + abgesicherter Fernzugriff + stdio-Bridge 2026-06-19 17:05:28 +02:00
package.json Ferndiagnose (MCP): Verbindungscode + abgesicherter Fernzugriff + stdio-Bridge 2026-06-19 17:05:28 +02:00
README.md Ferndiagnose (MCP) erweitert: Live-Provider-Laufzeitzustand + Conversion-Log 2026-06-21 21:37:52 +02:00

README.md

rd-diagnostics-mcp

Standalone stdio MCP bridge to the Real-Debrid-Downloader debug-server. It runs on the machine where the MCP client runs, takes a connection code for a downloader server, and exposes that server's read-only HTTP diagnostics API (/diagnostics, /status, /errors, /logs/*, /accounts, …) as MCP tools. One bridge serves all 5–6 servers; you pass a code (or a configured server name) per call.

This bridge is not bundled into the Electron app and adds no dependencies to it.

Setup

cd tools/rd-diagnostics-mcp
npm install

Register it with your MCP client as a stdio server that launches the bridge:

node "<repo>/tools/rd-diagnostics-mcp/src/bridge.mjs"

Provide servers via environment variables (codes contain a token — treat like passwords):

  • RDDIAG_CODE — a single default connection code (rddiag:v1:...)
  • RDDIAG_SERVERS — JSON map of name → code, e.g. {"berlin":"rddiag:v1:...","fra":"rddiag:v1:..."}

Without env config, every tool simply takes a code argument.

Tools

rd_servers, rd_ping, rd_diagnostics, rd_status, rd_items, rd_packages, rd_errors, rd_logs (main|audit|rename|trace|session|conversion|package|item), rd_history, rd_accounts, rd_providers (live per-account/key cooldown + in-flight + rotation state), rd_host, rd_self_check, rd_get (raw escape-hatch, any read-only path).

Each tool accepts code or server to pick the target.

Connection code

Format: rddiag:v1:<base64url(JSON)> with { v:1, h:host, p:port, t:token, n?:name, fp?:certFingerprint, s?:scheme }. Generated by the app (Hilfe → Remote-Support → Ferndiagnose (MCP)) or via node src/gen-code.mjs --host H --port P --token T.

Security model (read before exposing a server)

  • The debug surface is read-only for state/logs; the one control endpoint is /trace/config (toggles the optional, time-bounded support trace). No persistent secrets are written into the logs it serves: passwords are redacted, debrid API keys/tokens and resolved download URLs are never logged; /settings and /accounts are redacted.
  • Auth is a bearer token (24 random bytes). Over plain HTTP on a public network the token is sniffable, so:
    • Preferred: keep the server bound to 127.0.0.1 ("Nur lokal") and reach it through a private tunnel (Tailscale / SSH / Cloudflare Tunnel). The tunnel encrypts and authenticates; no public exposure.
    • Direct network bind (0.0.0.0) requires a non-empty IP allowlist (enforced fail-closed: with an empty allowlist only loopback is accepted). Use only inside a trusted LAN/VPN.
  • Revoke instantly from the app ("Token neu" or "Deaktivieren") — the old code stops working immediately.
  • fp pins a self-signed cert fingerprint and is verified on secureConnect (before the token is sent). HTTPS is not the v1 default; plain HTTP behind a tunnel is the recommended transport.

Test

npm test    # spins a fake debug-server, runs the bridge as a stdio child, asserts the full protocol path