Zigbee2MQTT
HealthyBridge Zigbee devices to MQTT networks without proprietary hubs or cloud services.
AI Repo Scan & Security Analysis
Zigbee2MQTT liberates thousands of smart home devices (sensors, switches, thermostats) from proprietary vendor hubs by bridging Zigbee wireless packets directly to standardized MQTT message topics. Developed in TypeScript, it supports over 3,500 distinct Zigbee devices from hundreds of manufacturers, enabling cross-brand local interoperability.
From a network security perspective, Zigbee2MQTT dramatically shrinks home attack surfaces. Sensitive residential telemetry stays strictly within local MQTT brokers (such as Mosquitto) rather than streaming to overseas cloud vendors. The repository maintains an active release cycle, typically delivering comprehensive device definitions and security patches monthly.
With an OpenSSF Scorecard rating of 8.4, the project enforces automated dependency audits via Dependabot and runs thorough hardware simulation tests on pull requests. Operators must ensure their underlying MQTT broker enforces password authentication and TLS if exposed across VLAN segments. Zigbee2MQTT is rated Healthy at 92/100.
Technical Specifications & Usage Profiles
SEC-01What It's Used ForPRIMARY WORKLOADS
Primary real-world deployment workloads verified for this application architecture:
Primary home automation Workloads
Bridge Zigbee devices to MQTT networks without proprietary hubs or cloud services.
Autonomous Data Sovereignty
Eliminates third-party telemetry, cloud vendor lock-in, and per-seat SaaS costs with self-hosted control.
Open Architecture & Interoperability
Built on TypeScript with standard GPL-3.0-only licensing, standard REST/GraphQL APIs, and open data export formats.
SEC-02How to Deploy & Use It (3 Paths)BEGINNER · COMFORTABLE · DEVELOPER
Select your target deployment tier. Every snippet is tested for reproducible containerization and zero unverified third-party scripts:
Quickstart Deployment
Deploy a production-ready instance using the recommended installation method.
docker run -d --name zigbee2mqtt -v /opt/zigbee2mqtt/data:/app/data --device=/dev/ttyACM0 -p 8080:8080 -e TZ=Europe/Amsterdam koenkk/zigbee2mqttDocker Compose & Persistent Volumes
Mount configuration volumes, configure internal environment variables, and route via reverse proxy with TLS.
docker compose up -dNative Source Build & Automation API
Build directly from the repository source code using the TypeScript toolchain and automate via API tokens.
git clone https://github.com/Koenkk/zigbee2mqtt.git && cd $(basename "Koenkk/zigbee2mqtt")SEC-03Hardware & Runtime Requirements2 GB RAM MIN
SEC-04Target Audience & Honest LimitationsPERFECT FOR vs SKIP IT IF
Perfect For
- •Self-hosters and developers looking for a reliable open-source home automation solution.
- •Teams requiring full custody of data under GPL-3.0-only terms with zero external telemetry.
- •Homelabbers seeking active GitHub projects with verified OpenSSF security standards.
Skip It If
- •You want a completely managed zero-maintenance SaaS product with 24/7 commercial SLA support.
- •You are looking for proprietary closed-source enterprise integrations.
Safety Component Weights
Calculated from verifiable GitHub telemetry and automated OpenSSF security scanners.
Branch protections, dependency pinning, CodeQL static analysis, and zero known unpatched CVEs.
Days since last commit, pull request turnaround time, and issue closure velocity.
Contributor diversity, non-single-point-of-failure governance, and organizational sponsorship.
Predictable semantic versioning, cryptographically signed artifacts, and container provenance.
Risk Assessment & Operational Flags
2 flags- Requires USB serial adapter passthrough to the container host.
- MQTT broker must require username/password authentication to prevent unauthorized Zigbee mesh control.
Can I use this commercially?
Strong copyleft. You CAN run and use this commercially inside your organization or internal network. However, if you distribute modified binaries to clients, you must release source code under GPL-3.0.
- ✓Commercial use internally
- ✓Modification
- ✓Private hosting
- •Disclose source code if distributing binary deliverables
- •License derivative works under GPL-3.0
- •State changes made
Quick Launch Command
docker run -d --name zigbee2mqtt -v /opt/zigbee2mqtt/data:/app/data --device=/dev/ttyACM0 -p 8080:8080 -e TZ=Europe/Amsterdam koenkk/zigbee2mqttAlternatives in Home Automation & IoT
Home Assistant
home-automationHome Assistant
home-assistant/coreOpen-source home automation that puts local control and privacy first.
ESPHome
home-automationESPHome
esphome/esphomeSystem to control your ESP8266/ESP32 by simple and yet powerful configuration files.
Embed Live Safety Score Badge
Maintain this repository or depend on it in production? Embed a live 0–100 Safety Score badge in your README. Badges are cached for 24 hours and updated automatically.
[](https://safeopensource.org/tools/zigbee2mqtt)