# Port OS Smart Home > Control your Philips lights, Sonos speakers, Roborock vacuums and more with Port OS cloud. - name: io.github.portpowered/portos - version: 1.0.1-metadata.1 - connection class: R0 (autonomous) - trust: 80/100 flags: no-repository - quality: 73/100 (needs work) - owner: not claimed - descriptor: https://api.protogrid.dev/v1/servers/io.github.portpowered%2Fportos - tools: https://api.protogrid.dev/v1/servers/io.github.portpowered%2Fportos/tools **An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe. ## Connection (mcpServers) ```json { "mcpServers": { "portos": { "type": "http", "url": "https://api.portoperatingsystem.com/mcp" } } } ``` ## Trust - hygiene: 80 - liveness: 100 - freshness: 100 - provenance: 45 - drivers: +website +reachable +uptime-100% +updated-11d-ago -no-repository - Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. ## Quality 73/100 (needs work) ### protocol: 88 (weight 25) - pass `protocol.modern`: supports 2026-07-28 (server/discover) - pass `protocol.stateless`: answers without a session - pass `protocol.transport`: streamable HTTP - warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use ### authorization: n/a (weight 15) - n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth - n/a `auth.secret_in_url`: no templated URL ### tool hygiene: 86 (weight 30) - pass `tools.descriptions`: every tool has a description - warn `tools.description_length`: 4 tools have descriptions over 1,024 characters, which crowds the context - pass `tools.schemas`: every tool has an object input schema - pass `tools.annotations`: 10 of 10 tools declare readOnlyHint or destructiveHint - pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint - warn `tools.token_cost`: about 11,147 tokens to load every tool - pass `tools.api_dump`: tools are not a one-to-one API dump ### stability: 25 (weight 15) - warn `stability.changes`: 52 tool changes in 30 days - fail `stability.rug_pull`: 6 tools kept their name but changed most of their description in 30 days; review before trusting them ### dependencies: n/a (weight 15) - n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package - tools: 10, about 11,147 tokens to load them all - tool set hash: 0656557d999106a5a3726335c7bcb182 - tools last changed: 2026-11-07T14:23:40.119Z - badge: [![protogrid quality](https://protogrid.dev/badge/io.github.portpowered/portos.svg)](https://protogrid.dev/servers/io.github.portpowered/portos) - Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. ### Tool changes - 2026-11-07 `group_query` changed (description) - before: Find rooms/groups with IDs, etags, hierarchy, members, controllers, providers and declared controls. Query a named room; omit query for inventory. Follow relevant pages. Clarify ambiguous names using parentPath. id reads one group; merged IDs return redirectedFrom. Copy IDs/etags. Use control on the complete logical group; Port OS selects native/equivalent member delivery. Native capabilities/membershipComplete prove no aggregate coverage. membershipComplete=false means incomplete; absent means unknown. Empty resolved members do not prove an empty native group. Disabled routes cannot control; disabled groups need re-enablement through group_manage. Controllers accept group-scoped actions: to clean a room, find the room group by name, read its controllers (endpointId and the messages each accepts, such as clean-room), then control that vacuum with {"groupIds":[""]}. To list a vacuum's rooms, query {"controllers": {"has": ""}}. Requested maps use endpoint_show on that controller, primary house-map; never draw geometry. expand selects observations; forceDeviceAttributeQuery refreshes them. Omitted/failed fresh values are unavailable. Disabled groups are hidden unless enablement=DISABLED or *. - after: Find rooms/groups with IDs, etags, hierarchy, members, controllers, providers and messages. Query by name; follow pages; disambiguate by parentPath. Pages omit route declarations; id reads one group with them and payload shapes; merged IDs return redirectedFrom. Copy IDs/etags. Use control on the complete logical group; Port OS selects native/equivalent member delivery. Native capabilities/membershipComplete prove no aggregate coverage. membershipComplete=false means incomplete; absent means unknown. Empty resolved members do not prove an empty native group. Disabled routes cannot control; disabled groups need re-enablement through group_manage. Controllers accept group-scoped actions: to clean a room, find the room group by name, read its controllers (endpointId and the messages each accepts, such as clean-room), then control that vacuum with {"groupIds":[""]}. To list a vacuum's rooms, query {"controllers": {"has": ""}}. Requested maps use endpoint_show on that controller, primary house-map; never draw geometry. expand selects observations; forceDeviceAttributeQuery refreshes them. Omitted/failed fresh values are unavailable. Disabled groups are hidden unless enablement=DISABLED or *. - 2026-11-07 `control` changed (description, inputSchema) - before: Control devices/services. Dispatch a declared message with the payload its discovery entry shows ({} if fieldless) to one discovered logical id or endpoint_query-style query. Control only sends device messages; read with endpoint_query or group_query. Query values are operator objects: {"type":{"in":["LIGHT","SWITCH"]}}, never {"type":"LIGHT"}. Named devices, including dim/color, require their endpoint; groups require room/group intent. Unqualified vacuum start is whole-device. Queries freeze 1-100 authorized matches; zero/over-limit sends nothing. Copy references/account; Port OS selects routes. Whole-home lights: one complete lighting query; rooms: resolved lighting group. Query adds no exclusions. Include switches/plugs whose names indicate lamps; exclude appliances, fans, catalogs and duplicates; simulated devices count like any other. Discover missing scope only; report unresolved coverage. Dim/brighten: adjust-brightness {"brightnessDelta":-25} where declared; otherwise read brightness first and set a value below (dim) or above (brighten) it. Lights that are all off cannot dim: say so. Blind lift is percent open: open is liftPercent100thsValue 10000, closed 0. Commands: waitForResult=false; acknowledge accepted/pending and stop, without auto-poll/read/card. State/settings: endpoint_query with expand and forceDeviceAttributeQuery:true. Replies (snapshots, SDP, searches, queues, scene creation, authorization challenges): wait true. A snapshot image arrives as a separate image content block in the tool result, not in the structured body. Remote-control start-session and move finish before they return: send them with wait true (start-session returns once the robot is under remote control, move after its duration plus a short settle, so add no waits), then verify with endpoint_query expand spatial plus forceDeviceAttributeQuery:true; a move with no pose change was ignored. Empty QUEUED/IN_PROGRESS remains pending; acceptance proves no physical state. Exception: after play-media or launch-application on a TELEVISION, confirm once before saying it plays (an app can stop on a profile picker): endpoint_query forceDeviceAttributeQuery:true, or snapshot/get-snapshot {"responseFormat":"BASE64"} (the default URL cannot be viewed), and follow the TV description if it is stuck. Tools-only recipes: media-search/search-media {"query":"","type":"track"} (type is lower case; supportedSearchTypes lists TRACK upper case); media-queue/play-queue {"mediaIds":[""]}; get-queue {}; add-to-queue {"mediaId":""}, plus fresh queueVersion only when requiresQueueVersion=true. Match declared resources/bounds. Queue differs from saved playlist; failed search proves no state. Scenes: group_query expand:["scene"], forceDeviceAttributeQuery:true; scene/activate {"sceneId":""}; scene/create-scene {"name":""} captures current settings ("like this" means as they are now; change no light first), wait true, only on a group whose messages list it; otherwise change nothing and say saving is unsupported. Recover uncertain creation before another write. Full workflows: skills or portos://guides/index. New action: new idempotencyKey; copy caller keys exactly. Never auto-repeat TIMED_OUT/ambiguous failure (including 404): without a receipt, the same key can dispatch anew. Recover authorized receipt/fresh state; authorized retry retains all arguments/key/wait mode. MESSAGE_UNSUPPORTED/MESSAGE_AMBIGUOUS sent nothing: correct from discovery. Inspect partial/errors; unreachable rejected delivery, conflicting observations prove no success. Inventory: management tools. - after: Control devices/services. Dispatch a declared message with the payload its discovery entry shows ({} if fieldless) to one discovered logical id or endpoint_query-style query. Control only sends device messages; read with endpoint_query or group_query. Query values are operator objects: {"type":{"in":["LIGHT","SWITCH"]}}, never {"type":"LIGHT"}. Named devices, including dim/color, require their endpoint; groups require room/group intent. Unqualified vacuum start is whole-device. Queries freeze 1-100 authorized matches; zero/over-limit sends nothing. Copy references/account; Port OS selects routes. Whole-home lights: one complete lighting query; rooms: resolved lighting group. Query adds no exclusions. Include switches/plugs whose names indicate lamps; exclude appliances, fans, catalogs and duplicates; simulated devices count like any other. Discover missing scope only; report unresolved coverage. Dim/brighten: adjust-brightness {"brightnessDelta":-25} where declared; otherwise read brightness first and set a value below (dim) or above (brighten) it. Lights that are all off cannot dim: say so. Blind lift is percent open: open is liftPercent100thsValue 10000, closed 0. Commands: waitForResult=false, except remote-control start-session/move: always true, SUCCEEDED means the robot finished (false only returns QUEUED), then verify with endpoint_query expand spatial plus forceDeviceAttributeQuery:true; a move with no pose change was ignored. Otherwise acknowledge accepted/pending and stop, without auto-poll/read/card. State/settings: endpoint_query with expand and forceDeviceAttributeQuery:true. Replies (snapshots, SDP, searches, queues, scene creation, authorization challenges): wait true. A snapshot image arrives as a separate image content block in the tool result, not in the structured body. Empty QUEUED/IN_PROGRESS remains pending; acceptance proves no physical state. Exception: after play-media or launch-application on a TELEVISION, confirm once before saying it plays (an app can stop on a profile picker): endpoint_query forceDeviceAttributeQuery:true, or snapshot/get-snapshot {"responseFormat":"BASE64"} (the default URL cannot be viewed), and follow the TV description if it is stuck. Tools-only recipes: media-search/search-media {"query":"","type":"track"} (type is lower case; supportedSearchTypes lists TRACK upper case); media-queue/play-queue {"mediaIds":[""]}; get-queue {}; add-to-queue {"mediaId":""}, plus fresh queueVersion only when requiresQueueVersion=true. Match declared resources/bounds. Queue differs from saved playlist; failed search proves no state. Scenes: group_query expand:["scene"], forceDeviceAttributeQuery:true; scene/activate {"sceneId":""}; scene/create-scene {"name":""} captures current settings ("like this" means as they are now; change no light first), wait true, only on a group whose messages list it; otherwise change nothing and say saving is unsupported. Recover uncertain creation before another write. Full workflows: skills or portos://guides/index. New action: new idempotencyKey; copy caller keys exactly. Never auto-repeat TIMED_OUT/ambiguous failure (including 404): without a receipt, the same key can dispatch anew. Recover authorized receipt/fresh state; authorized retry retains all arguments/key/wait mode. MESSAGE_UNSUPPORTED/MESSAGE_AMBIGUOUS sent nothing: correct from discovery. Inspect partial/errors; unreachable rejected delivery, conflicting observations prove no success. Inventory: management tools. - 2026-11-07 `endpoint_query` changed (inputSchema) - 2026-11-07 `control` changed (description) - before: Control devices/services. Dispatch a declared message with the payload its discovery entry shows ({} if fieldless) to one discovered logical id or endpoint_query-style query. Control only sends device messages; read with endpoint_query or group_query. Query values are operator objects: {"type":{"in":["LIGHT","SWITCH"]}}, never {"type":"LIGHT"}. Named devices, including dim/color, require their endpoint; groups require room/group intent. Unqualified vacuum start is whole-device. Queries freeze 1-100 authorized matches; zero/over-limit sends nothing. Copy references/account; Port OS selects routes. Whole-home lights: one complete lighting query; rooms: resolved lighting group. Query adds no exclusions. Include switches/plugs whose names indicate lamps; exclude appliances, fans, catalogs and duplicates; simulated devices count like any other. Discover missing scope only; report unresolved coverage. Dim/brighten: adjust-brightness {"brightnessDelta":-25} where declared; otherwise read brightness first and set a value below (dim) or above (brighten) it. Lights that are all off cannot dim: say so. Blind lift is percent open: open is liftPercent100thsValue 10000, closed 0. Commands: waitForResult=false; acknowledge accepted/pending and stop, without auto-poll/read/card. State/settings: endpoint_query with expand and forceDeviceAttributeQuery:true. Replies (snapshots, SDP, searches, queues, scene creation, authorization challenges): wait true. Empty QUEUED/IN_PROGRESS remains pending; acceptance proves no physical state. Exception: after play-media or launch-application on a TELEVISION, confirm once before saying it plays (an app can stop on a profile picker): endpoint_query forceDeviceAttributeQuery:true, or snapshot/get-snapshot {"responseFormat":"BASE64"} (the default URL cannot be viewed), and follow the TV description if it is stuck. Tools-only recipes: media-search/search-media {"query":"","type":"track"} (type is lower case; supportedSearchTypes lists TRACK upper case); media-queue/play-queue {"mediaIds":[""]}; get-queue {}; add-to-queue {"mediaId":""}, plus fresh queueVersion only when requiresQueueVersion=true. Match declared resources/bounds. Queue differs from saved playlist; failed search proves no state. Scenes: group_query expand:["scene"], forceDeviceAttributeQuery:true; scene/activate {"sceneId":""}; scene/create-scene {"name":""} captures current settings ("like this" means as they are now; change no light first), wait true, only on a group whose messages list it; otherwise change nothing and say saving is unsupported. Recover uncertain creation before another write. Full workflows: skills or portos://guides/index. New action: new idempotencyKey; copy caller keys exactly. Never auto-repeat TIMED_OUT/ambiguous failure (including 404): without a receipt, the same key can dispatch anew. Recover authorized receipt/fresh state; authorized retry retains all arguments/key/wait mode. MESSAGE_UNSUPPORTED/MESSAGE_AMBIGUOUS sent nothing: correct from discovery. Inspect partial/errors; unreachable rejected delivery, conflicting observations prove no success. Inventory: management tools. - after: Control devices/services. Dispatch a declared message with the payload its discovery entry shows ({} if fieldless) to one discovered logical id or endpoint_query-style query. Control only sends device messages; read with endpoint_query or group_query. Query values are operator objects: {"type":{"in":["LIGHT","SWITCH"]}}, never {"type":"LIGHT"}. Named devices, including dim/color, require their endpoint; groups require room/group intent. Unqualified vacuum start is whole-device. Queries freeze 1-100 authorized matches; zero/over-limit sends nothing. Copy references/account; Port OS selects routes. Whole-home lights: one complete lighting query; rooms: resolved lighting group. Query adds no exclusions. Include switches/plugs whose names indicate lamps; exclude appliances, fans, catalogs and duplicates; simulated devices count like any other. Discover missing scope only; report unresolved coverage. Dim/brighten: adjust-brightness {"brightnessDelta":-25} where declared; otherwise read brightness first and set a value below (dim) or above (brighten) it. Lights that are all off cannot dim: say so. Blind lift is percent open: open is liftPercent100thsValue 10000, closed 0. Commands: waitForResult=false; acknowledge accepted/pending and stop, without auto-poll/read/card. State/settings: endpoint_query with expand and forceDeviceAttributeQuery:true. Replies (snapshots, SDP, searches, queues, scene creation, authorization challenges): wait true. A snapshot image arrives as a separate image content block in the tool result, not in the structured body. Remote-control start-session and move finish before they return: send them with wait true (start-session returns once the robot is under remote control, move after its duration plus a short settle, so add no waits), then verify with endpoint_query expand spatial plus forceDeviceAttributeQuery:true; a move with no pose change was ignored. Empty QUEUED/IN_PROGRESS remains pending; acceptance proves no physical state. Exception: after play-media or launch-application on a TELEVISION, confirm once before saying it plays (an app can stop on a profile picker): endpoint_query forceDeviceAttributeQuery:true, or snapshot/get-snapshot {"responseFormat":"BASE64"} (the default URL cannot be viewed), and follow the TV description if it is stuck. Tools-only recipes: media-search/search-media {"query":"","type":"track"} (type is lower case; supportedSearchTypes lists TRACK upper case); media-queue/play-queue {"mediaIds":[""]}; get-queue {}; add-to-queue {"mediaId":""}, plus fresh queueVersion only when requiresQueueVersion=true. Match declared resources/bounds. Queue differs from saved playlist; failed search proves no state. Scenes: group_query expand:["scene"], forceDeviceAttributeQuery:true; scene/activate {"sceneId":""}; scene/create-scene {"name":""} captures current settings ("like this" means as they are now; change no light first), wait true, only on a group whose messages list it; otherwise change nothing and say saving is unsupported. Recover uncertain creation before another write. Full workflows: skills or portos://guides/index. New action: new idempotencyKey; copy caller keys exactly. Never auto-repeat TIMED_OUT/ambiguous failure (including 404): without a receipt, the same key can dispatch anew. Recover authorized receipt/fresh state; authorized retry retains all arguments/key/wait mode. MESSAGE_UNSUPPORTED/MESSAGE_AMBIGUOUS sent nothing: correct from discovery. Inspect partial/errors; unreachable rejected delivery, conflicting observations prove no success. Inventory: management tools. - 2026-11-07 `group_query` changed (outputSchema) - 2026-11-07 `endpoint_show` changed (outputSchema) - 2026-11-07 `endpoint_query` changed (outputSchema) - 2026-11-07 `control` changed (outputSchema) - 2026-11-06 `group_query` changed (description) - before: Find rooms/groups with IDs, etags, hierarchy, members, controllers, providers and declared controls. Query a named room; omit query for inventory. Follow relevant pages. Clarify ambiguous names using parentPath. id reads one group; merged IDs return redirectedFrom. Copy IDs/etags. Use control on the complete logical group; Port OS selects native/equivalent member delivery. Native capabilities/membershipComplete prove no aggregate coverage. membershipComplete=false means incomplete; absent means unknown. Empty resolved members do not prove an empty native group. Disabled routes cannot control; disabled groups need re-enablement through group_manage. Controllers accept group-scoped actions: target the vacuum controller with {"groupIds":[""]} for room cleaning. Requested maps use endpoint_show on that controller, primary house-map; never draw geometry. expand selects observations; forceDeviceAttributeQuery refreshes them. Omitted/failed fresh values are unavailable. Disabled groups are hidden unless enablement=DISABLED or *. - after: Find rooms/groups with IDs, etags, hierarchy, members, controllers, providers and declared controls. Query a named room; omit query for inventory. Follow relevant pages. Clarify ambiguous names using parentPath. id reads one group; merged IDs return redirectedFrom. Copy IDs/etags. Use control on the complete logical group; Port OS selects native/equivalent member delivery. Native capabilities/membershipComplete prove no aggregate coverage. membershipComplete=false means incomplete; absent means unknown. Empty resolved members do not prove an empty native group. Disabled routes cannot control; disabled groups need re-enablement through group_manage. Controllers accept group-scoped actions: to clean a room, find the room group by name, read its controllers (endpointId and the messages each accepts, such as clean-room), then control that vacuum with {"groupIds":[""]}. To list a vacuum's rooms, query {"controllers": {"has": ""}}. Requested maps use endpoint_show on that controller, primary house-map; never draw geometry. expand selects observations; forceDeviceAttributeQuery refreshes them. Omitted/failed fresh values are unavailable. Disabled groups are hidden unless enablement=DISABLED or *. - 2026-11-06 `endpoint_show` changed (inputSchema, outputSchema) Full history: https://api.protogrid.dev/v1/servers/io.github.portpowered%2Fportos/changes ## Remotes - https://api.portoperatingsystem.com/mcp (streamable-http, auth none, reachable true, uptime30d 1) ## Packages _none_ ## Tools (10) - `control`: Control devices/services. Dispatch a declared message with the payload its discovery entry shows ({} if fieldless) to one discovered logical id or endpoint_query-style query. Control only sends device messages; read with endpoint_query or group_query. Query values are operator objects: {"type":{"in":["LIGHT","SWITCH"]}}, never {"type":"LIGHT"}. Named devices, including dim/color, require their endpoint; groups require room/group intent. Unqualified vacuum start is whole-device. Queries freeze 1-100 authorized matches; zero/over-limit sends nothing. Copy references/account; Port OS selects routes. Whole-home lights: one complete lighting query; rooms: resolved lighting group. Query adds no exclusions. Include switches/plugs whose names indicate lamps; exclude appliances, fans, catalogs and duplicates; simulated devices count like any other. Discover missing scope only; report unresolved coverage. Dim/brighten: adjust-brightness {"brightnessDelta":-25} where declared; otherwise read brightness first and set a value below (dim) or above (brighten) it. Lights that are all off cannot dim: say so. Blind lift is percent open: open is liftPercent100thsValue 10000, closed 0. Commands: waitForResult=false, except remote-control start-session/move: always true, SUCCEEDED means the robot finished (false only returns QUEUED), then verify with endpoint_query expand spatial plus forceDeviceAttributeQuery:true; a move with no pose change was ignored. Otherwise acknowledge accepted/pending and stop, without auto-poll/read/card. State/settings: endpoint_query with expand and forceDeviceAttributeQuery:true. Replies (snapshots, SDP, searches, queues, scene creation, authorization challenges): wait true. A snapshot image arrives as a separate image content block in the tool result, not in the structured body. Empty QUEUED/IN_PROGRESS remains pending; acceptance proves no physical state. Exception: after play-media or launch-application on a TELEVISION, confirm once before saying it plays (an app can stop on a profile picker): endpoint_query forceDeviceAttributeQuery:true, or snapshot/get-snapshot {"responseFormat":"BASE64"} (the default URL cannot be viewed), and follow the TV description if it is stuck. Tools-only recipes: media-search/search-media {"query":"","type":"track"} (type is lower case; supportedSearchTypes lists TRACK upper case); media-queue/play-queue {"mediaIds":[""]}; get-queue {}; add-to-queue {"mediaId":""}, plus fresh queueVersion only when requiresQueueVersion=true. Match declared resources/bounds. Queue differs from saved playlist; failed search proves no state. Scenes: group_query expand:["scene"], forceDeviceAttributeQuery:true; scene/activate {"sceneId":""}; scene/create-scene {"name":""} captures current settings ("like this" means as they are now; change no light first), wait true, only on a group whose messages list it; otherwise change nothing and say saving is unsupported. Recover uncertain creation before another write. Full workflows: skills or portos://guides/index. New action: new idempotencyKey; copy caller keys exactly. Never auto-repeat TIMED_OUT/ambiguous failure (including 404): without a receipt, the same key can dispatch anew. Recover authorized receipt/fresh state; authorized retry retains all arguments/key/wait mode. MESSAGE_UNSUPPORTED/MESSAGE_AMBIGUOUS sent nothing: correct from discovery. Inspect partial/errors; unreachable rejected delivery, conflicting observations prove no success. Inventory: management tools. - `endpoint_manage`: Edit endpoint registry metadata; physical actions use control. Read endpoint ID, document and etag first. Metadata replacement requires complete name/type/enablement, etag and idempotencyKey; rename/type/disabled state survives rediscovery. Disabled endpoints remain explicitly readable but reject controls. DELETE may be rediscovered. MERGE_INTO disables the source and moves supported references; it creates no ID alias and preserves target enablement. Two simulator endpoints cannot merge (409 CONFLICT); disable/delete the duplicate instead. Confirm exact identity and explain MERGE_INTO/DELETE effects; matching names do not prove duplicates. - `endpoint_query`: Find devices/services, declarations and observations. Filter by name/type/capability; follow paginationContext.nextToken for the requested scope. endpointId reads one known endpoint and takes no query, maxResults or nextToken. Copy returned references/account; Port OS selects routes. Use group_query for rooms and management tools for inventory edits. State reads require declared expand capabilities and forceDeviceAttributeQuery=true. FRESH is current; STALE is last known with sampledAt and cannot support a safety claim. Missing/invalid/errored/PROVIDER_NO_STATE is unknown; PROVIDER_NO_STATE is not offline and retries cannot supply an absent provider value. FRESH UNREACHABLE is offline; STALE connectivity is last known. ID-only lookup reads metadata; an expanded read returns only the expanded capabilities, without the description. simulator:true means all routes are synthetic; routes[].simulator marks mixed routes. Missing flags are unknown. Treat simulated endpoints like any other device. Types alone do not identify lamps: nothing marks a switch/plug as lighting, so infer it from names and rooms and clarify when unclear. Temperature setpoints are distinct from ambient readings; clarify indoor/outdoor ambiguity. Check relevant authorized accounts before reporting absence; names alone prove no identity. Select concrete route-backed services, not provider catalogs or obsolete unrouted entries. Default lists include ENABLED; DISABLED or * selects others. Exact endpointId can read disabled metadata. An endpoint does not list its rooms: find them with group_query. Device workflows and payloads: matching Port OS skill or portos://guides/index. - `endpoint_show`: Open the Port OS device UI when requested; never draw a second card/map/controls. Answer with the relevant value in words. This tool shares endpoint_query selection, expand and pagination. One matching endpoint opens controls; multiple matches open a selection list. It sends no control and starts no live video. primary selects a returned cardId (for example battery, fan, closure, camera, location or house-map) and refreshes its readings; unsupported IDs return available choices. Other cards remain in details. Results include cached readings for listed cards, so avoid a second read. FRESH is current; STALE is last known with its age. Ordinary commands require no automatic UI follow-up. - `group_manage`: Create/rename/delete groups, change members/enablement or merge inventory; physical actions use control. Read IDs/etags first. Every batch reference to a group uses its starting etag. MOVE_MEMBER needs memberEndpointId plus source/target IDs and both etags. List order cannot resolve contradictory edits; adding does not implicitly move exclusive membership. Native-capable changes default to BEST_EFFORT: provider change/readback precedes local intent; failure can fall back locally as PARTIALLY_APPLIED. PORTOS_ONLY sends nothing. FAIL_ON_PROVIDER_ERROR fails intent while retaining received provider facts. Native effects cannot roll back. NOT_DECLARED alone is not partial; OUTSIDE_PRINCIPAL prevents native changes through another principal. MERGE_INTO and aggregate/route enablement require PORTOS_ONLY. Require explicit user authorization for exact MERGE_INTO/DELETE_GROUP targets/effects. Deletion may delete native groups; unretired routes stay disabled/orphaned against rediscovery. Route enablement needs its native etag and groupEtag when grouped. Use declared provider support; robot room edits do not reshape maps. validateOnly=true authorizes/plans without sending/writing. Otherwise use a unique idempotencyKey per intent; identical retries retain it. Stale etag: reread/reconsider. Inspect batch status, per-item outcomes and providerDispatches, including on failure. Failed intent can retain provider changes; never claim full synchronization or automatically repeat native writes. - `group_query`: Find rooms/groups with IDs, etags, hierarchy, members, controllers, providers and messages. Query by name; follow pages; disambiguate by parentPath. Pages omit route declarations; id reads one group with them and payload shapes; merged IDs return redirectedFrom. Copy IDs/etags. Use control on the complete logical group; Port OS selects native/equivalent member delivery. Native capabilities/membershipComplete prove no aggregate coverage. membershipComplete=false means incomplete; absent means unknown. Empty resolved members do not prove an empty native group. Disabled routes cannot control; disabled groups need re-enablement through group_manage. Controllers accept group-scoped actions: to clean a room, find the room group by name, read its controllers (endpointId and the messages each accepts, such as clean-room), then control that vacuum with {"groupIds":[""]}. To list a vacuum's rooms, query {"controllers": {"has": ""}}. Requested maps use endpoint_show on that controller, primary house-map; never draw geometry. expand selects observations; forceDeviceAttributeQuery refreshes them. Omitted/failed fresh values are unavailable. Disabled groups are hidden unless enablement=DISABLED or *. - `subscription_cancel`: Stop watching by cancelling one Port OS event subscription using its exact ID from subscription_list or subscription_inspect. Cancellation is idempotent. Select the intended subscription by name, source endpoint and catalog event; names are not cancellation keys. A stopped monitor requires a new subscription to watch again. - `subscription_inspect`: Inspect one Port OS event subscription by its exact ID returned by subscription_list. Returns its safe query, source endpoint, catalog name and lifecycle status. A retained active subscription establishes registration; it does not prove that any client has received or acted on a camera event. - `subscription_label_edit`: Change only the display name of one Port OS event subscription by exact ID. Use a PLAIN name-value object. The event, endpoint, filter and destination are immutable; to change what is watched, establish a replacement monitor and cancel the old ID. - `subscription_list`: Enumerate the user's Port OS event subscriptions, including their exact IDs, names, source endpoint, catalog event and status. For requests to stop watching a camera, list subscriptions and follow every nextCursor, select the intended monitor, then use subscription_cancel with its exact ID. Creating a monitor uses the host's events/subscribe capability after discovering supported camera events; these tools never accept callback URLs or signing keys.