bosch-flow-mcp

Purpose bosch-flow-mcp is an MCP (Model Context Protocol) server for accessing data from Bosch eBike Flow (Smart System / BES3). It uses the user's own Bosch eBike Flow account to log in (via standard SingleKey ID login), only reads the user's own data, and is read-only—it does not modify the bike, battery, or account.

Main capabilities

• Snapshots of battery status over time: charge cycles, energy output, degradation trend
• Components and firmware versions: drive unit, battery, ConnectModule, head unit, remote control, ABS
• Service book history and software update log (EU Data Act clients only)
• Real-time state-of-charge from the ConnectModule via the mobile API
• Battery capacity test results (EU Data Act clients only)
• Data for each ride activity: distance, elevation gain, speed, cadence, measured rider power, calories, energy share of rider and motor, assistance mode distribution, CO2, ABS events, and point-by-point GPS/speed/elevation/power tracks
• Automatic sync on demand—tools fetch the latest data as needed, no cron job required

Data sources and authentication The server uses the Bosch Mobile API (obc-rider-profile.prod.connected-biking.cloud) as the primary data source, the rider-activity API (obc-rider-activity.prod.connected-biking.cloud) for per-ride data, and optionally supports the Data Act API (api.bosch-ebike.com) for additional endpoints. Authentication uses the one-bike-app public client (the same OAuth client as the Bosch eBike Flow mobile app), with PKCE, no API key or registration required, only the user's Bosch Flow account. If the user provides their own EU Data Act API credentials, the official Data Act API is used; otherwise, the same app API already used by the mobile app is queried with the user's own login.

How to use Requires Python 3.13+ (tested on 3.13 and 3.14, supports Linux, macOS, Windows), and uv (recommended) or pip. Also requires a Bosch eBike Flow account (free) and a BES3 Smart System e-bike registered in the app. Can be run without installation via uvx bosch-flow-mcp, or developed from a cloned repository. Authentication opens a browser redirecting to the Bosch login. Important: before logging in, open the browser developer tools (F12) and switch to the Network tab; after logging in, the browser redirects to an iOS URI (onebikeapp-ios://) that a desktop browser cannot open, so copy the full redirect URL from DevTools (right-click the oauth2redirect entry > Copy URL) and paste it at the prompt. The token is saved to config/bosch_tokens.json and automatically refreshed via offline_access. EU Data Act users: if you have registered your own euda client and put its ID in config/bosch_config.json, authentication will use that client, via the local http://localhost:4200 Callback completes automatically, with no DevTools step required. Data types include: bikes, batteries, components, service, software_updates, capacity. You can use the bosch_sync MCP tool, or rely on automatic synchronization (each get_* tool triggers a sync when the data is stale). It can be registered for use with Claude Code, after which you can ask questions such as "How is my battery health this year?" "Show charging cycle trends by month" "What is my drive unit firmware version?" "Does my bike have a service history?" "What were my riding distance and intensity this week?"

Use cases Suitable for users who want read-only visibility into their Bosch Smart System e-bike battery health, component firmware, service history, and riding data, especially users who want to integrate with an AI assistant through MCP.

Limitations and notes

• This is an unofficial, community-built project and is not affiliated with, authorized by, or endorsed by Robert Bosch GmbH, Bosch eBike Systems, or SingleKey ID.
• It uses undocumented, unofficial interfaces and may change or stop working at any time if Bosch changes its systems.
• Users are responsible for ensuring that their use complies with the Bosch and SingleKey ID terms of service in their jurisdiction.
• Service book history, software update history, and capacity test results come only from the EU Data Act API and require the user to register their own euda client in the Bosch Data Act portal; under standard login these types will report unavailable (with an explanation) rather than silently returning empty results; the Data Act API returns nothing for accounts registered outside the EU.
• The software is provided under GPLv3+ with no warranty of any kind, and you use it at your own risk.
• OAuth tokens are created with 0600 on POSIX; Windows ignores that mode and controls access through inherited ACLs; token files and bosch_flow.db are already gitignored.
• A pre-commit hook (scripts/check-no-data.sh) prevents committing databases, token files, and secrets; tests use temporary SQLite databases and fictional identifiers, and no real bike or account data appears in the repository.