// the take
A web UI and automation layer that sits in front of Dispatcharr to manage IPTV channels, M3U accounts, and EPG sources, adding drag-and-drop channel editing, a rules-based auto-creation pipeline, stream health probing, and an optional MCP sidecar for controlling it via Claude. It's for self-hosted IPTV/Dispatcharr users who want a friendlier interface and automation Dispatcharr doesn't provide on its own.
The Channel Pipeline (rules engine) is genuinely substantial: conditions with AND/OR logic, dry-run preview, execution rollback, and full snapshot restore of a run — that's real safety engineering for something that bulk-mutates channel data. The MCP sidecar's isolation is unusually careful for a self-hosted project: separate credential-projection volume the main app can't read from, read-only root filesystem, dropped capabilities, no-new-privileges, and a remote-access mode that hard-rejects wildcard trust values instead of silently accepting them. The backend has 50 Alembic migrations tracking a non-trivial schema evolution (session telemetry, multi-viewer attribution, pending merges), which is more schema discipline than most hobby-scale IPTV tools bother with. Test layout includes e2e, backup/restore (DBAS), and auth-boundary tests, suggesting the restore and auth paths have actually been exercised, not just hand-tested.
Storage is SQLite (ecm.db) under a workload that includes concurrent stream probing, stats rollups, and now LLM-driven MCP writes — that's a concurrency ceiling that will bite anyone running more than a modest number of channels. It's a hard dependency on Dispatcharr's own API and auth staying stable; ECM's SSO, stream matching, and EPG features only work as well as Dispatcharr's backend does, so upstream breaking changes propagate straight through. The TLS/session story has clearly caused real operator pain — there's a dedicated emergency-recovery mode (env var to re-enable plaintext session cookies) and detailed HSTS-pinning workarounds, which points to self-rolled cert/session handling rather than just delegating to a reverse proxy. Handing an LLM 130 tools including bulk delete, bulk merge, and backup restore is a lot of blast radius for a single API key with no per-tool scoping — a bad prompt plus one of the destructive bulk tools is one mistake away from wrecking a production channel lineup, container sandboxing notwithstanding.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →