ROMM_READ_ONLY=1 turns the whole server into a browse-only surface — every create, update, delete and scan refuses at the server rather than trusting the client to behave — which is the setting for an agent that is not entirely yours. Separately, deletions need confirm_delete: true on the call itself, so a host that ignores tool annotations still cannot drop a collection by accident. What this adds over the RomM web UI is the ability to ask across the whole library — which platforms carry the most unmatched files, what has been played this week — rather than clicking through pages to find out.
An MCP server for RomM, the self-hosted game and ROM management platform. It browses and searches the library, reads full ROM metadata, manages collections and notes, lists saves, states, screenshots and firmware, and can trigger a library scan. Both stdio and Streamable HTTP transports are supported, so it runs locally or in Docker for remote clients.
- romm_browse_roms pages and filters by platform, collection, favourites or unmatched with sorting; romm_search_roms finds a game by name and romm_get_rom returns the full record with genres, companies, file info and notes
- romm_list_platforms gives every platform with its ROM count and metadata, and romm_stats totals platforms, ROMs, saves, states, screenshots and overall file size
- romm_manage_collections lists, gets, creates, updates and deletes collections including smart and virtual ones, and romm_get_collection_roms reads what is inside one
- romm_update_rom edits name, notes and favourite status, and romm_rom_notes lists, adds, updates and deletes the notes attached to a ROM
- romm_manage_saves, romm_manage_states and romm_screenshots list files filtered by ROM, romm_list_firmware lists firmware by platform, and romm_download_rom returns a download URL
- romm_activity is the recent feed of plays, saves, screenshots and notes, and romm_system covers the heartbeat check, config, a library scan and a metadata refresh
- Every tool carries MCP annotations — readOnlyHint on browsing and listing, destructiveHint on anything that deletes, idempotentHint on create and update — so a compliant host can prompt before the risky ones
Node.js 20 or newer and a RomM instance at v5.0 or later. ROMM_BASE_URL and ROMM_API_KEY are both required, with the rmm_ token generated in RomM under Settings → API Keys. Run it as npx romm-mcp over stdio, or set MCP_TRANSPORT=http with MCP_PORT (default 3000) and MCP_HOST (default 0.0.0.0) for Streamable HTTP, which is what the bundled Docker setup uses. ROMM_READ_ONLY=1 refuses every mutating tool at the server itself, and deletions additionally require confirm_delete: true on the call. ROMM_DEBUG=1 turns on debug logging.
One command plus a key — npx romm-mcp, then supply credentials