bosch-flow-mcp

# bosch-flow-mcp

<!-- mcp-name: io.github.partymola/bosch-flow-mcp -->

[![CI](https://github.com/partymola/bosch-flow-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/partymola/bosch-flow-mcp/actions/workflows/ci.yml)
[![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
[![Python 3.13+](https://img.shields.io/badge/python-3.13+-blue.svg)](https://www.python.org/downloads/)
[![PyPI](https://img.shields.io/pypi/v/bosch-flow-mcp)](https://pypi.org/project/bosch-flow-mcp/)
[![Glama MCP Server](https://glama.ai/mcp/servers/partymola/bosch-flow-mcp/badges/score.svg)](https://glama.ai/mcp/servers/partymola/bosch-flow-mcp)

MCP server for Bosch eBike Flow (Smart System / BES3). Tracks battery health, charge cycles,
component versions, service history, live state-of-charge, and per-ride activity data
(distance, elevation, power, assist-mode, CO2).

## Disclaimer

This is an **unofficial**, community-built project. It is **not affiliated with, authorised
by, or endorsed by Robert Bosch GmbH, Bosch eBike Systems, or SingleKey ID**. "Bosch",
"eBike Flow", and related marks belong to their owners and are used here only to describe
interoperability.

- It signs in with **your own Bosch eBike Flow account** (via the standard SingleKey ID
  login) and reads **only your own data**. It is **read-only** - it never modifies your
  bike, battery, or account.
- It uses the same **public** OAuth client (`one-bike-app`, PKCE) that the official Bosch
  eBike Flow app uses. **No credentials, secrets, or protection measures are extracted,
  bypassed, or circumvented** - every identifier here is already publicly documented.
- When you supply your own EU Data Act API credentials, the official Data Act API is used.
  Otherwise the same app API your phone already uses is queried with your own login.
- This is an **undocumented, unofficial** interface that **may change or stop working at any
  time** if Bosch alters their systems.
- **You are responsible** for ensuring your use complies with Bosch's and SingleKey ID's
  terms of service in your jurisdiction.
- Provided **with no warranty** under GPLv3+ (see [LICENSE](https://github.com/partymola/bosch-flow-mcp/blob/main/LICENSE)). Use at your own risk.

## Features

- Battery state snapshots over time (charge cycles, energy delivered, degradation trends)
- Components and firmware versions (drive unit, battery, ConnectModule, head unit, remote, ABS)
- Service book history and software update log (EU Data Act client only)
- Live state-of-charge from ConnectModule via mobile API
- Battery capacity tester results (EU Data Act client only)
- Per-ride activities: distance, elevation, speed, cadence, measured rider power, calories,
  rider-vs-motor energy share, assist-mode split, CO2, ABS events, plus a per-point
  GPS/speed/elevation/power track
- Auto-sync on demand - tools fetch fresh data without a cron job

## Requirements

- Python 3.13+ (tested on 3.13 and 3.14, on Linux, macOS and Windows, in CI)
- [uv](https://docs.astral.sh/uv/) (recommended) or pip
- A Bosch eBike Flow account (free, register at the Bosch eBike Flow app)
- A BES3 Smart System eBike registered in the app

## Install

```bash
pip install bosch-flow-mcp
```

Or run it without installing with `uvx bosch-flow-mcp`. For development from a clone:

```bash
git clone https://github.com/partymola/bosch-flow-mcp
cd bosch-flow-mcp
uv venv --python 3.13 .venv
uv pip install -e .
```

## Auth

```bash
.venv/bin/bosch-flow-mcp auth
```

Opens your browser to Bosch login. The auth flow uses the `one-bike-app` public client
with PKCE - no API keys or registration needed. Just your Bosch Flow account.

**Important:** Open browser DevTools (F12) and switch to the Network tab **before** logging in.
After login, the browser redirects to an iOS URI (`onebikeapp-ios://`) that desktop browsers
can't open. Copy the full redirect URL from DevTools (right-click > Copy URL on the
`oauth2redirect` entry) and paste it at the prompt.

Tokens are saved to `config/bosch_tokens.json` and auto-refresh via `offline_access`.

**EU Data Act users:** if you have registered your own `euda` client and placed its ID in
`config/bosch_config.json`, `auth` uses that instead - it opens the browser and completes
automatically through a local `http://localhost:4200` callback, with no DevTools step.

## Sync

```bash
.venv/bin/bosch-flow-mcp sync                     # all data types
.venv/bin/bosch-flow-mcp sync --types bikes,batteries
```

Data types: `bikes`, `batteries`, `components`, `service`, `software_updates`, `capacity`.

Fetches your data and stores it locally. The source depends on your sign-in:

- A standard Bosch eBike Flow account (the default) reads bikes, batteries, components,
  current firmware, and live state-of-charge from the **mobile app API** - works for any
  account, including non-EU.
- Service-book history, software-update history, and capacity-tester results come only
  from the **EU Data Act API**, which requires registering your own `euda` client at the
  [Bosch Data Act portal](https://portal.bosch-ebike.com/data-act). With a standard sign-in
  those types report `unavailable` (with a note) rather than a silent empty result, and the
  Data Act API returns nothing for accounts registered outside the EU.

You can also use the `bosch_sync` MCP tool, or rely on automatic sync (each `get_*` tool
triggers a sync if data is stale).

Run `bosch-flow-mcp --version` to print the installed package version.

## Register with Claude Code

```bash
claude mcp add -s user bosch-flow -- /full/path/to/bosch-flow-mcp/.venv/bin/bosch-flow-mcp
```

Then ask Claude questions like:
- "What's my bike's battery health this year?"
- "Show me charge cycle trends by month"
- "What firmware version is my drive unit on?"
- "Have there been any service records for my bike?"
- "How far and how hard were my rides this week?"

## Available tools

| Tool | Description |
|------|-------------|
| `bosch_sync` | Sync one or more data types (default: all) |
| `bosch_get_bikes` | List registered bikes |
| `bosch_get_bike` | Single bike with full details |
| `bosch_get_batteries` | Battery snapshots - latest or historical range |
| `bosch_get_soc` | Live state-of-charge from ConnectModule |
| `bosch_get_capacity` | Battery capacity tester results (EU Data Act client only) |
| `bosch_get_components` | Components with part numbers and firmware versions |
| `bosch_get_service_records` | Service book entries (EU Data Act client only) |
| `bosch_get_software_updates` | Software update history (EU Data Act client only) |
| `bosch_battery_trends` | Charge cycle and energy trends by period |
| `bosch_get_activities` | Per-ride summaries (distance, elevation, power, mode, CO2) over a date range |
| `bosch_get_activity_detail` | Per-point track for one ride (GPS/speed/elevation/cadence/power) |

## API credits

This server uses the **Bosch Mobile API** (`obc-rider-profile.prod.connected-biking.cloud`)
as the primary data source, the **rider-activity API**
(`obc-rider-activity.prod.connected-biking.cloud`) for per-ride data, and optional
**Data Act API** (`api.bosch-ebike.com`) support for additional endpoints.

Authentication uses the `one-bike-app` public client (the same OAuth client as the Bosch
eBike Flow mobile app). The auth approach was documented by the
[marq24/ha-bosch-ebike-flow](https://github.com/marq24/ha-bosch-ebike-flow) Home Assistant
integration and the [open-ebike/open-ebike-backend](https://github.com/open-ebike/open-ebike-backend)
project.

## Configuration

| Variable | Default | Description |
|----------|---------|-------------|
| `BOSCH_FLOW_MCP_DB_PATH` | `bosch_flow.db` in the package root | SQLite database path |
| `BOSCH_FLOW_MCP_CONFIG_DIR` | `config/` in the package root | Directory for tokens and client config |

## Data safety

- OAuth tokens are created at `0600` on POSIX - Windows ignores the mode and governs access by inherited ACLs; the token files and `bosch_flow.db` are gitignored.
- A pre-commit hook (`scripts/check-no-data.sh`) blocks committing databases, token files, and secrets. Install it after cloning:

  ```bash
  ln -sf ../../scripts/check-no-data.sh .git/hooks/pre-commit
  ```

- Tests use temporary SQLite databases and fictional identifiers - no real bike or account data ever enters the repo.

## Contributing

See [CONTRIBUTING.md](https://github.com/partymola/bosch-flow-mcp/blob/main/CONTRIBUTING.md) for development setup, the test workflow, and the pre-commit hook. Changes are tracked in [CHANGELOG.md](https://github.com/partymola/bosch-flow-mcp/blob/main/CHANGELOG.md).

## License

GPLv3+. See [LICENSE](https://github.com/partymola/bosch-flow-mcp/blob/main/LICENSE).