Add romm-mcp package #19

2026-11-02T10:09:47+01:00

hermes-agent commented

2026-11-02 10:09:47 +01:00

Adds the RomM MCP server as a package, so the gateway can expose it as a backend.

Why this package exists. RomM 5.x moved library scans behind the API (POST /api/tasks/scan); the web UI is the only other way to start one. With this server I can trigger a scan and then verify the result through romm_stats / romm_browse_roms?unmatched=true instead of asking someone to click a button and paste an error.

Packaging notes

Upstream (rodrigosiviero/romm-mcp 1.0.5, MIT) publishes no package-lock.json, and buildNpmPackage cannot compute npmDepsHash without one. The lock committed here is generated from the published tarball itself — npm install --package-lock-only --ignore-scripts inside the extracted 1.0.5 package — so it pins exactly the dependency tree that shipped with that version rather than resolving newer versions today.
dist/*.js (tsc output) is already inside the npm tarball, so dontNpmBuild = true, same arrangement as navidrome-mcp and n8n-mcp.
16 tools; 12 are readOnlyHint: true, and the two destructive ones (romm_manage_collections, romm_rom_notes) require an explicit confirm_delete. The server also supports ROMM_READ_ONLY=1 to disable all writes.

Expected first CI run to fail: npmDepsHash is a placeholder. It can only be derived from a lockfile by an actual build, and nix flake check builds every package in this flake, so the first run will print the correct got: sha256-... value for me to set. That is the second commit on this branch, not a separate PR.

Adds the RomM MCP server as a package, so the gateway can expose it as a backend. **Why this package exists.** RomM 5.x moved library scans behind the API (`POST /api/tasks/scan`); the web UI is the only other way to start one. With this server I can trigger a scan and then verify the result through `romm_stats` / `romm_browse_roms?unmatched=true` instead of asking someone to click a button and paste an error. **Packaging notes** - Upstream (`rodrigosiviero/romm-mcp` 1.0.5, MIT) publishes **no `package-lock.json`**, and `buildNpmPackage` cannot compute `npmDepsHash` without one. The lock committed here is generated from the published tarball itself — `npm install --package-lock-only --ignore-scripts` inside the extracted 1.0.5 package — so it pins exactly the dependency tree that shipped with that version rather than resolving newer versions today. - `dist/*.js` (tsc output) is already inside the npm tarball, so `dontNpmBuild = true`, same arrangement as `navidrome-mcp` and `n8n-mcp`. - 16 tools; 12 are `readOnlyHint: true`, and the two destructive ones (`romm_manage_collections`, `romm_rom_notes`) require an explicit `confirm_delete`. The server also supports `ROMM_READ_ONLY=1` to disable all writes. **Expected first CI run to fail:** `npmDepsHash` is a placeholder. It can only be derived from a lockfile by an actual build, and `nix flake check` builds every package in this flake, so the first run will print the correct `got: sha256-...` value for me to set. That is the second commit on this branch, not a separate PR.

hermes-agent added 1 commit 2026-11-02 10:09:47 +01:00

Add romm-mcp package

NixOS Configuration CI / Nix Flake Check (pull_request) Failing after 22s

Details

e9dc6f91b7

RomM MCP server: browse, search and administrate a self-hosted ROM library,
including triggering library scans (POST /api/tasks/scan), which RomM 5.x only
exposes through its API.

Upstream ships no package-lock.json, so the lock committed here is generated from
the published 1.0.5 tarball (npm install --package-lock-only --ignore-scripts),
pinning exactly the tree that shipped with that version. dist/ is prebuilt in the
tarball, hence dontNpmBuild.

npmDepsHash is a placeholder: it can only be derived from the lockfile by a build,
so CI (nix flake check, which builds every package) reports the real value.

hermes-agent added 1 commit 2026-11-02 10:13:47 +01:00

romm-mcp: pin the real source and npmDeps hashes

NixOS Configuration CI / Nix Flake Check (pull_request) Successful in 25s

Details

b55c7af097

Both come from the build, and both were non-obvious:

- fetchzip hashes the *unpacked* tree, not the .tgz bytes, so a hash computed
  from the published tarball does not match; the derivation reports the NAR hash
  of the extracted contents instead.
- npmDepsHash only exists once npm has materialised the dependency tree from the
  committed lockfile.

Verified with nix build .#romm-mcp: the derivation builds and ./result/bin/romm-mcp
starts and prints 'RomM MCP server running on stdio'.

hermes-agent merged commit ecf37568a3 into main

2026-11-02 12:59:33 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: luis/mcp-servers#19