What is Meshtastic MCP?
Meshtastic MCP comes from the Meshtastic project itself and lets an MCP client work with Meshtastic radios, the low-cost LoRa devices that relay text messages across a mesh without a phone network. Its core tools find devices over USB serial or TCP, read node lists, telemetry and logs, change settings, send text and reboot. Optional capabilities switch on when their prerequisites are present: firmware builds and flashing, Android and iOS app automation, a software-defined-radio check of what actually went on air, a BLE sniffer, a local model for summaries, and read-only access to the Meshtastic Discord.
It is GPL-3.0, written for Python 3.11+, and installed from PyPI with uv. PyPI still carries 0.1.0, uploaded on 3 July 2026, while GitHub has a v0.2.0 tag from 29 September 2026 and commits as recent as 13 November 2026. It has about 21 stars.
How to install Meshtastic MCP
uv tool install meshtastic-mcp && meshtastic-mcp installIs Meshtastic MCP worth it?
Meshtastic MCP is built for the people who make Meshtastic, and its scope shows it. By our count of server.py it registers 68 core tools and about 65 more behind optional capabilities, plus resources, prompts and 3 bundled agent skills. Someone with one radio gets device_info, list_nodes, send_text and a packet recorder; a firmware developer gets PlatformIO builds, OTA flashing, USB hub power cycling and a tiered hardware test suite; an app developer gets Android emulator and iOS Simulator automation for end-to-end tests with no radio at all.
The replay engine is the most unusual part. It serves a recorded or synthetic mesh as a fake radio over TCP, so an app can connect and receive a paced stream of packets. The synthetic generator defaults to 800 nodes and takes its proportions from real captures of about 1,800 nodes at Burning Man and DEF CON 33, and a fuzzer can lace the stream with malformed packets, spoofed positions and rogue admin commands to test how an app copes.
Security gets more care than in most hardware servers. SECURITY.md names the risk directly: packets from strangers on the mesh are untrusted text, device details are private, and send_text can carry them out, so a hostile node could attempt prompt injection. Reboot, factory reset, erase-and-flash and USB power tools require confirm=True, send_text is marked destructive so clients should prompt, and the raw esptool, nrfutil and picotool passthroughs block write and erase commands without that flag.
The catch: parts of it open ports or transmit. In our reading of the replay engine it listens on 0.0.0.0, port 4403 by default, and advertises itself over mDNS, so anyone on your network can find and connect to a replay session; it is read-only, but it is visible. FleetSuite, the optional web bench, stays on 127.0.0.1:8765. And send_text puts a real LoRa transmission on the air under your region's rules. The PyPI release also trails GitHub by months, so the documented features need the git install.
Our take: for a firmware or app contributor, this replaces a shelf of scripts and does it with sensible guards. For someone who just wants an agent to read messages from one node, it is far more than needed, and the right posture is the one SECURITY.md recommends: never let the agent read mesh traffic and send text in the same unattended task.
Where it earns its place
A Meshtastic firmware contributor with four boards on a USB hub
Flash my branch to every board and check they still mesh
Point MESHTASTIC_FIRMWARE_ROOT at a checkout, have the agent build and flash each board, then run the mesh test tier; uhubctl power-cycles a stuck board. Free; destructive steps wait for confirm=True.
An Android developer working on the Meshtastic app
Test how the app handles a crowded conference mesh without owning hundreds of radios
Start a replay with the conference-stress preset, connect the emulator to 10.0.2.2 and watch the node list fill. The fuzzer's adversary preset adds spoofed and malformed traffic for robustness checks.
A community emergency-comms volunteer with one T-Echo
Check which nodes are reachable and send a test message before a drill
Run list_nodes and device_info over USB, then send_text, and confirm the transmission in packets_window. Keep that session away from tasks that read incoming messages, as SECURITY.md advises.
Before you commit
- Setup
- uv tool install meshtastic-mcp (add the ui, web or sdr extras as needed), then meshtastic-mcp install registers it with Claude Code, Claude Desktop, Cursor or Windsurf and copies the skills. meshtastic-mcp doctor lists missing dependencies with install commands. The README's quick start takes about 60 seconds with a radio plugged in.
- Integrations
- Meshtastic devices over serial or TCP, PlatformIO, esptool, nrfutil and picotool, the Android emulator and adb, Xcode simulators, RTL-SDR, Nordic's BLE sniffer, Ollama or llama-server, and a read-only Discord bot.
- Data and privacy
- Runs locally over stdio. The recorder writes packets and logs to a local data directory. Mesh messages, node lists and device config go to your model provider; SECURITY.md says PII, location and keys must never be logged. Replay listens on 0.0.0.0:4403 with mDNS; FleetSuite on 127.0.0.1:8765.
- Cost at scale
- Free under GPL-3.0. Hardware is your own Meshtastic boards, plus an RTL-SDR or nRF sniffer dongle for those capabilities.
- Limits
- PyPI has only 0.1.0, so newer features need the git install. FleetSuite takes over the bench's serial ports while it runs. The iOS UI dependency fb-idb needs Python 3.12 or older, and the Kotlin SDK bridge is experimental.
What’s good
- Maintained by the Meshtastic project, active in November 2026
- Destructive operations gated behind confirm=True
- Replay and fuzzer test apps without hardware
- Written prompt-injection threat model in SECURITY.md
What’s not
- Replay listens on all interfaces and advertises over mDNS
- PyPI 0.1.0 lags the GitHub v0.2.0 tag
- send_text transmits over real LoRa radio
- Very large tool surface for single-radio users
Best for
Meshtastic firmware and app developers, and bench operators running several boards, who want an agent to flash, drive and test devices.
Meshtastic MCP: common questions
- Is Meshtastic MCP worth it?
- A thorough, safety-conscious toolkit that is really a test bench for Meshtastic developers, with a send tool that broadcasts over real radio. We rate it 4.1 out of 5.
- How much does Meshtastic MCP cost?
- Free and open source (GPL-3.0). Needs your own Meshtastic radios for anything beyond the simulator.
- What are the downsides of Meshtastic MCP?
- Replay listens on all interfaces and advertises over mDNS; pyPI 0.1.0 lags the GitHub v0.2.0 tag; send_text transmits over real LoRa radio; very large tool surface for single-radio users.
- Who is Meshtastic MCP best for?
- Meshtastic firmware and app developers, and bench operators running several boards, who want an agent to flash, drive and test devices.
- How much does Meshtastic MCP cost for a team or in production?
- Free under GPL-3.0. Hardware is your own Meshtastic boards, plus an RTL-SDR or nRF sniffer dongle for those capabilities.
- Is Meshtastic MCP safe for company data?
- Runs locally over stdio. The recorder writes packets and logs to a local data directory. Mesh messages, node lists and device config go to your model provider; SECURITY.md says PII, location and keys must never be logged. Replay listens on 0.0.0.0:4403 with mDNS; FleetSuite on 127.0.0.1:8765.
Answers checked Nov 14, 2026.
Make Meshtastic MCP? Show this rating on your site
