Own the glass. A dashboard, privacy controls and Home Assistant bridge for rooted LG webOS TVs.

Glasshouse is a server that runs directly on a rooted LG webOS TV, providing both a live browser dashboard and a dashboard app.

Use it for remote control, app installation and removal, OLED panel care, privacy controls, service menu access, and hardware telemetry. It also includes an MQTT bridge for integrating the TV with Home Assistant and other smart-home software.

• webOS: 3.4 through 26 confirmed; tested across 2016–2025 models. Other versions likely work as well
• Panels: OLED (full panel wear telemetry and burn-in controls) and LCD (core dashboard, controls, and telemetry; OLED Care tab hides automatically)
• Access: Rooted via Homebrew Channel. Telnet or SSH. No external dependencies or internet access needed on the TV
• Tested hardware: 28 models verified so far (UH6030, UH610V, UH635V, B7, B8, C8, C9, CX, C1, UP81, QNED82, C2, C3, B4, G3, C4, G4, UT81, C5, G5, CS, LX3). Other rooted models should work; see full table

Quick start • What it's for • Screenshots • Features • Installation • Tested TVs • Known issues • Home Assistant • Managing the server • Security

1. Root the TV and install the Homebrew Channel.
2. Clone this repository on a computer on the same network as the TV.
3. Run ./deploy.sh <tv-ip> from the server/ directory.
4. Open http://<tv-ip>:8080/ in a browser.

That's it. The dashboard is ready to use.

For compatibility, screenshots, the full feature list, troubleshooting and configuration details, continue below.

This project is intended to give a rooted webOS TV a useful local control surface instead of requiring the owner to work around the TV's built-in menus, vendor services and cloud dependencies.

1. Controlling the TV without the cloud. A D-pad to navigate the TV itself, volume, mute, media playback keys (play, pause, stop, skip), app launcher, picture presets, sound output routing, power and reboot.

2. Seeing what the TV is configured to collect, and switching it off. Whether LG's content-recognition engine is running and sampling the screen, the advertising identifier and whether ad tracking is limited, and every data agreement recorded on the TV with most of them switchable from the dashboard. Includes an on-TV blocker for LG's ad and telemetry endpoints, and a switch for the two diagnostics services that upload to LG.

3. App management, debloating and home screen cleanup. Install apps from the Homebrew Channel catalog, permanently uninstall apps to reclaim internal flash storage, disable unnecessary background system services to free up RAM and CPU cycles, and hide non-removable built-in LG system apps from the home launcher.

4. Replacing the screen saver. A clock, a starfield, fireworks, or the TV's own readings, each dim or bright, in place of LG's.

5. Integrating the TV with a smart home. The MQTT bridge exposes the TV as a single device with its controls and telemetry, with Home Assistant support through MQTT Discovery and the same underlying interface available to other MQTT clients.

6. Seeing what the TV is actually doing. SoC temperature, per-core CPU load, memory, swap, current draw, Wi-Fi signal and throughput.

7. Observing OLED panel wear. Cumulative panel hours, compensation cycle progress, Pixel Refresher countdown with scheduling, completed cycle counters and refresher failure alerts.

8. Controlling the OLED burn-in protections. What each one does and a switch for it: screen shift and logo dimming on any OLED, and on TVs that expose them, ASBL and Global Stress Reduction (normally reachable only from the TV's service menu, with a service remote and a PIN).

9. Opening the service menu, and unlocking it where it is locked. LG's own engineering menu, put on the TV screen from a browser which means no service remote is needed. Newer firmware shows a cut-down version of it until it is unlocked, which the dashboard can do as well.

10. Reading all of it on the TV itself. An optional app on the home screen puts the same readings and controls on the TV, driven by the remote, for when there is no phone or laptop to hand.

 
_{Metrics and Control tabs, shown in dark and light themes.}

The TV arrives over MQTT Discovery as a single unified device:

_{MQTT Discovery entities exposed by the TV.}

A custom Home Assistant dashboard for an LG TV:

_{A custom Home Assistant dashboard using the TV's MQTT entities.}

Each has a tab of its own in the dashboard, and a deep link to it. OLED Care appears on OLED TVs only. The page works with no internet access, and has a dark/light mode toggle (via the UI or /?theme=light).

The Control tab, /?tab=control, turns the TV itself into a locally controlled device. Instead of relying on LG's cloud services or a phone app, the dashboard talks directly to webOS over the local network.

From a browser, the dashboard can navigate the TV, change inputs, control playback and volume, launch applications, change picture and sound settings, blank the screen, set a sleep timer, and send notifications.

• A D-pad — arrows, OK, Back and Home — to navigate the TV's own interface.
• Volume, mute, input select, and media playback — play, pause, stop, skip.
• App launching, picture presets and sound output routing. The presets on offer are the ones the TV will accept for whatever is playing: a Dolby Vision source has its own presets.
• Screen blanking, sleep timer, on-screen notifications, and power and restart.
• Opening a web page on the TV: type an address and the TV's browser takes it.

The Advanced tab, /?tab=advanced, holds the TV's own settings that LG keeps several menus deep: Quick Boot, Wake-on-LAN, staying connected when off, LG's Always Ready screen, the LG logo shown at power on and off, sound (output, sound mode, digital sound output, balance, automatic volume, eARC and Bluetooth speaker mode), each HDMI input's Deep Colour and audio format, SIMPLINK (HDMI-CEC) and its auto power sync, IP control, auto device detection, and the front lights. Sound mode and balance apply to the TV speakers only, and an HDMI input's settings can be changed only while that input is on screen, as in LG's own menu. Auto device detection finds devices the TV can show on its Home Dashboard and control, from a set-top box to smart lights, plugs and switches; on newer TVs it does so by looking up every address on the home network each time the TV switches on, and switching it off stops those lookups. Each setting appears only on TVs that have it. On the TV itself they are under System.

_{The TV's own settings, grouped as Power, Display, Devices and Front lights.}

The Metrics tab, /?tab=metrics, exposes information about what the TV is doing and what hardware it contains — most of which is absent from its own settings menu.

This is useful both for monitoring and for troubleshooting. It shows whether a high-temperature condition is accompanied by CPU load, what Wi-Fi signal the TV actually has, what HDMI mode a connected device negotiated, and what software is currently running.

• SoC temperature and current draw, CPU and per-core load, GPU clock, memory and swap, Wi-Fi RSSI and network throughput.
• eMMC flash wear with JEDEC health translation, and free space on the app partition.
• HDMI link state per port, refresh rate, colour depth, pixel clock, and HDMI 2.1 diagnostics where supported (link rate, chroma format, HDCP version, cable error counter, ALLM, VRR, QMS and colorimetry).
• Dolby Vision / HDR / SDR detection, picture mode, OLED light level, the raw HDMI signal (3840x2160 @ 120Hz), audio output routing, and the running app with friendly input names (Apple TV (HDMI2)).
• Magic Remote battery and model; webOS and firmware version, SoC architecture, OLED cell ID and TCON firmware where the platform exposes them.
• On demand: what is resident in memory, and which processes are using the processor right now.

_{Metrics including processor, memory, swap and current draw.}

The Apps tab, /?tab=apps, offers four different ways to manage software on the TV.

Install adds an app from the Homebrew Channel catalog. Uninstall removes an application completely and frees its storage. Disable stops selected background services without deleting them. Hide removes built-in LG system apps from the home launcher without touching the underlying application.

• Install apps from the catalog: The Install homebrew apps section lists the Homebrew Channel catalog with each app's download size, and offers Install, Update or Uninstall for each. Choosing an app downloads it, checks it against the catalog's sha256 hash and installs it. It stops at a preview first when there is something to decide or read: replacing an LG store copy, a different processor, an older version, or a screen saver that would replace the dashboard's own. An app whose services need root gets it when the Homebrew Channel is installed, as it would through the Homebrew Channel, and gets it again after each update. The Homebrew Channel and the dashboard's own package are left to the Homebrew Channel to update. Only one install runs at a time. Settings changes, restarts and server updates wait while one is downloading or installing, but not while a preview is only waiting for confirmation.
• Install from a URL or a file: From URL... downloads an .ipk from an http or https address, with an optional sha256 to check it against, and Upload .ipk sends one from the browser. Both show the same preview as a catalog install. They are in their own section at the bottom of the tab, and are off until switched on there (after a warning), a token is set, or the request comes from the TV itself. Root access for such a package asks for a second confirmation naming each service, is never applied again by an update, and replacing an app that came from the LG store needs its own tick, since store updates stop afterwards.
• Uninstall applications: Store downloads and sideloaded packages with version and vendor details, and a one-click uninstall action to permanently delete apps and free up internal eMMC flash storage.
• Turn off background services: Safely disable unnecessary background services and daemons that consume RAM and CPU cycles (such as USB camera watcher, Connected Car listeners, and browser preloading). Only services actually present on the TV are displayed, and disabled states are persisted across reboots.
• Hide home screen system apps: Hide non-removable LG system apps (Gallery, Music, Sports, Always Ready, Camera, User Guide, Device Connector, Alexa, Google Assistant, etc.) from the home launcher ribbon. Operates non-destructively via reversible appinfo.json bind-mounts. Includes a master toggle to instantly return to stock behavior. Not available on webOS 10 and later for now; see Known issues.
• Strict system safeguards: Core TV services (Live TV, Settings, Launcher, input switchers, and the dashboard itself) are strictly protected and can never be hidden or uninstalled.
• Available on TV and Web: Catalog installs, uninstalling, services and hiding work from any browser or from the on-TV dashboard app. Installing from a URL or a file is in the browser dashboard only.

Apps that check for an installation from the LG store may refuse to run when installed this way, and apps built for a newer webOS than the TV runs may not launch.

_{Installed applications, background services and saved web pages.}

The Privacy tab, /?tab=privacy, reports what the TV is configured to do rather than hiding these settings behind its normal menus.

It opens with a summary of screen recognition, ad tracking and usage reports, what is still on under each, and a button that switches all of it off while leaving voice and LG Channels alone. Everything below it is the detail.

It shows whether the content-recognition engine is running and sampling frames, the advertising ID and whether ad tracking is limited, recorded data agreements, and toggles to disable LG's background collection and diagnostics services.

Most data agreements can be switched off from here (persisting across reboots), and the advertising ID can be reset and its cookies cleared. Acceptance of new terms is left to the TV's own menus.

LG's on-screen ads and promotions have their own switches: ads in the screen saver, Sponsored tiles and recommendations on the Home screen, ads while watching, and Smart Tips. Each shows only on TVs that have it.

The ad & telemetry blocker blackholes LG's tracking, ad and ACR endpoints on the TV itself, by bind-mounting a hosts table over /etc/hosts, and is restored on boot.

Two tiers are available:

• ads & telemetry blocks LG's ad, diagnostics and customer-data hosts and the Alphonso screen recognition servers, and leaves LG's service platform reachable.
• everything adds the hosts that carry the Content Store and firmware delivery, so on that tier the app store and updates may stop working.

What ACR collects and what LG Ad Solutions does with it is set out in What LG's ACR does.

_{Privacy controls, data agreements, advertising ID and LG telemetry blocking.}

The OLED Care tab, /?tab=oledcare, brings together the panel's own wear figures with the protections that affect OLED wear.

The aim is not to encourage disabling OLED protections blindly. Instead, the dashboard shows what each control does and exposes the controls that the particular panel makes available.

• Cumulative panel hours, panel maintenance and Pixel Refresher countdowns with scheduling, completed cycle counters and refresher failure alerts.
• GSR stress events on supported panels — counts how many times static elements (such as logos, HUDs, or news tickers) triggered active panel dimming to prevent burn-in.
• Screen shift and logo dimming on any OLED.
• Temporal peak control (ASBL) and global stress reduction on supported models (the two normally reachable only from the TV's service menu, with a service remote and a PIN).

_{OLED panel wear information and burn-in protection controls.}

_{Panel life, maintenance and Pixel Refresher status.}

On TVs with LG's Game Optimizer, the Game tab, /?tab=game, shows the frame rate of a game in large type while the source uses VRR, and the signal's refresh rate otherwise. Beside it are the Game Optimizer's settings: game genre, prevent input delay, VRR & G-Sync, AMD FreeSync Premium, ALLM, dark room mode, the black and white stabilizers, and AI Game Sound. LG keeps them for each input and genre, and applies them while the picture mode is Game Optimizer. The TV dashboard has the same settings under Game.

The Service menu tab, /?tab=servicemenu, opens LG's engineering menu on the TV — EZ Adjust or In Start — without a service remote; the TV still asks for its PIN.

Newer firmware shows a cut-down version until it is unlocked, and the dashboard can unlock it. The TV has to be switched off and on again before that takes effect. TVs old enough not to lock it say so.

_{Service menu access, unlock state and low-level hardware controls.}

The Screensaver tab, /?tab=screensaver, provides five alternatives to LG's default:

• Clock
• Starfield
• Fireworks
• Bokeh, soft circles of light drifting in and out
• Panel vitals, showing the TV's own panel hours and refresher countdown

Each mode offers dim and bright variants, and visual elements continuously drift across the screen to prevent OLED burn-in or image retention.

A firmware update restores the LG default.

Not available on webOS 10 and later for now; see Known issues.

_{Built-in screen saver choices, including the panel-vitals display.}

_{The Starfield screen saver with continuously moving elements.}

The dashboard can also run directly on the TV's home screen, driven by the remote, for when there is no phone or laptop to hand.

The Apps tab there can install from the Homebrew Channel catalog: Install apps lists it by title, with updates first, and the preview with its services, root access switch and free space is read and confirmed with the remote.

A first install adds it; updating an existing one leaves the home screen alone. It can be added or removed at any time from the Server tab, which is also where it turns up for anyone who updated in place rather than re-running the installer.

Removing it changes nothing else, since the dashboard reaches any browser on the network regardless. Where a TV will not take the app, the control is hidden and everything else works as before.

The MQTT tab, /?tab=mqtt, publishes the TV to an MQTT broker, where it arrives in Home Assistant as a single auto-discovered device.

The tab holds the broker address, credentials, topic prefix and device identity, with the bridge's connection state and last publish time beside them.

Home Assistant & MQTT covers the setup.

Switched off, an LG TV sleeps within a couple of minutes, and the dashboard and the Home Assistant bridge sleep with it. On TVs that have LG's Always-on setting, Stay connected when off keeps the TV on the network with the screen dark instead: the dashboard keeps answering, Home Assistant keeps its readings and controls, and either can switch the TV back on.

The cost is power. On an OLED42C24LA it draws 12.5 W while off, against almost nothing in normal standby.

It does not hold all night. For five hours every night, 01:00 to 06:00 unless changed, LG suspends Always-on, and a TV switched off during those hours sleeps fully. It is offline until they end or it is switched on: the dashboard does not answer, and Home Assistant shows it asleep. LG fixes the length at five hours; Nightly power-down, next to the switch, moves them to hours the TV is not used.

The switch is under Advanced → Power in the web dashboard and System → Power on the TV, and setup offers it as a third step. TVs without the setting, such as webOS 4 models, do not show it; Wake-on-LAN still wakes them from standby.

On TVs that have LG's Always Ready, the Always Ready switch under Advanced → Power makes the TV show LG's Always Ready screen, such as a clock or artwork, when it is switched off with the remote, instead of going dark. It is close to being on: an OLED42C24LA draws 31 W showing the clock. The dashboard and Home Assistant show the TV as switched off while it is up. It takes effect the next time the TV is switched off. The first time, the TV asks for OK on the remote. Home turns the TV back on from the clock; the power button switches it fully off, as in LG's own menu.

The Server tab, /?tab=server, shows the installed version, whether a newer release is out, and buttons to install it or roll back to the version before.

Check daily looks on its own and lets Home Assistant offer the update.

It also adds or removes the app on the TV's home screen.

_{Server and TV software updates, the dashboard app and the theme.}

Updating covers installs from before the tab existed.

• A rooted LG webOS TV (Root tool here) with the Homebrew Channel.
• A computer on the same network to install from: a Mac, a Linux machine, or a Windows PC. The installation uses Git and requires no other software on the computer. The TV does not need internet access.

The MQTT bridge also needs an MQTT broker on the network. Home Assistant's Mosquitto add-on is one option, but any compatible MQTT broker works.

Tested across the following TVs so far. The Luna service names and /proc/lg paths this relies on may differ across webOS versions and panel types.

Tested on another model? Please open an issue with the TV model, webOS version, and the contents of /var/lib/tvweb/tvweb.log — whether everything worked or something broke — and we will add a row.

Black picture and no sound on webOS 10 and later (#366). On webOS 10 and 11, after a custom screen saver or tile hiding has been used, apps and HDMI inputs can show a black picture with no sound. HDMI-CEC stops working and sound plays only through the TV's own speakers. Standby does not clear it; unplugging the TV does. The cause is not yet known.

Both features are turned off on these TVs. One already in use stays until the TV is next fully restarted, then the TV goes back to stock. They can be turned back on, for example to help test a fix, by adding "allowOnWebos10": true to /var/lib/tvweb/config.json and fully restarting the TV. The dashboard then notes that they were turned back on.

If it happens, please add to #366 rather than opening a new issue, with the output of these, run before restarting the TV:

luna-send -n 1 -f luna://com.webos.service.tvpower/power/getPowerState '{}'
luna-send -n 1 -f luna://com.webos.service.videooutput/getStatus '{}'
cat /var/lib/webosbrew/tvweb-boot.log

Download the project onto a computer on the same network as the TV.

git clone https://github.com/rorygallagher2024/lg-webos-dashboard.git
cd lg-webos-dashboard/server

Find the TV's address under Settings → Network on the TV, or in the router's list of devices. The installer automatically uses SSH if the TV has it, and falls back to the Homebrew Channel's telnet if not.

Then, from the server/ directory in a terminal:

./deploy.sh <tv-ip>

For example, ./deploy.sh 192.168.1.50. It takes about ten seconds and finishes by checking that the dashboard answers. When it says done, open http://<tv-ip>:8080/ in a browser. If anything goes wrong, it stops and says why.

A first install also adds the dashboard to the TV's home screen as an app, so it can be opened on the TV itself with the remote — see The dashboard on the TV.

It can be removed again from the dashboard at any time. Updating an existing install leaves the home screen exactly as it is, so a removed app never comes back on its own.

--no-app skips it on a first install, and --app adds it to an existing one.

The server starts again by itself whenever the TV restarts. To try it without that, add --no-persist, and it runs only until the TV next restarts. Setting the router to always give the TV the same address saves looking it up again.

No configuration is needed for this part. Without a config file the dashboard runs on port 8080, the controls are live, including power off and reboot, and MQTT is off.

Nothing is sent anywhere: the server talks to the TV and to whoever opens the page, and reaches the internet only to look for a new release — when the dashboard's Server tab is opened, or daily if checking automatically is switched on.

• Connection refused or password prompt during install. The installer tries passwordless SSH first, then telnet. If SSH prompts for a password, make sure telnet is toggled ON in the TV's Homebrew Channel app settings, or run ./deploy.sh <tv-ip> --telnet to connect directly over telnet.
• Nothing on port 8080. On the TV, /var/lib/tvweb/tvwebctl status says whether the server is running and /var/lib/tvweb/tvweb.log says why it is not.
• Panel hours and OLED Care missing on an OLED TV, or showing on an LCD one. Panel detection went the wrong way: set "panel": "oled" or "panel": "lcd" in server/config.json before a first deploy, or in /var/lib/tvweb/config.json on a TV that already has one.

MQTT is a lightweight messaging protocol: a device publishes state updates to a named topic, and any subscriber instantly receives them. It relies on a broker — a small server that relays those messages between publishers and subscribers. Mosquitto is the usual one, and Home Assistant ships it as a one-click add-on.

This project publishes the TV's telemetry to a broker, and describes its own entities using the MQTT Discovery convention. Home Assistant reads that description and creates the device with all its sensors and controls by itself.

There is no YAML to write.

Home Assistant is one consumer of the MQTT interface. Other MQTT clients can subscribe to the same topics, including Node-RED, Telegraf, scripts and other automation systems.

Open the dashboard, then the MQTT tab. Fill in the broker address and credentials, switch MQTT bridge on, and save.

The server writes config.json on the TV and restarts itself; the page reconnects on its own after a few seconds.

Home Assistant picks up the device within a few seconds of the bridge connecting.

_{MQTT bridge configuration and connection status.}

The panel reports whether the bridge is connected to the broker and how long ago it last published, so a wrong address or a rejected password shows up there rather than in the log on the TV.

Equivalent to the above, and the better route for installing several TVs from one machine or for keeping the settings under version control.

From server/, where step 1 left off:

cp ../config.example.json config.json

Set the broker under mqtt and set enabled to true, then run ./deploy.sh <tv-ip> again.

Leaving device.name and device.model empty makes the TV report its own model and firmware at runtime.

deploy.sh only installs this file if the TV does not already have one, so it will not overwrite settings saved from the dashboard.

To replace an existing config, edit it through the dashboard or remove /var/lib/tvweb/config.json first.

PicCap is an app capturing the TV's screen and sending it to a Hyperion client that transforms it into an ambient-light system. PicCap MQTT control is off by default. It can be enabled via config in /var/lib/tvweb/config.json

"piccap": {
  "enabled": true,
  "pollIntervalMs": 30000
}

Polling interval is optional, and defaults to 30 seconds. The retained state topic <topicPrefix>/state/piccap/power carries ON or OFF; the command topic <topicPrefix>/command/piccap/power accepts ON to start PicCap capturing and OFF to stop it. Commands require allowControl to be true. Telemetry includes boolean piccap.power when PicCap is available.

The bridge is a plain MQTT publisher, so anything that speaks MQTT can read it.

Telemetry is published as JSON to <topicPrefix>/telemetry, availability to <topicPrefix>/status, and commands are accepted on <topicPrefix>/command/*.

mosquitto_sub -h <broker> -t 'lgtv/#' -v

Node-RED, Telegraf into InfluxDB, or a script subscribing to that topic all work the same way. The Discovery messages are simply ignored by anything that is not Home Assistant.

Each TV on the same broker needs a unique topicPrefix and device.id, otherwise they overwrite each other's state and disconnect each other.

Both are editable from each TV's own dashboard.

For the config-file route, deploy.sh checks for server/config.<tv-ip>.json before falling back to server/config.json, which keeps per-TV settings from being flattened by a shared file.

See docs/HOME-ASSISTANT.md for the entity list and example automations.

ssh root@<tv-ip> /var/lib/tvweb/tvwebctl status    # start | stop | restart | status

How depends on the install. One with a Server tab in its dashboard updates itself; an older one is updated by deploying again, after which it has the tab.

With the Server tab. Opening it looks for a newer release, and Check now looks again. Install puts it on and restarts the server, and Roll back returns to the version it replaced.

Home Assistant can offer the same install while the daily check is on.

Over SSH:

ssh root@<tv-ip> /var/lib/tvweb/tvwebctl update           # install the latest release
ssh root@<tv-ip> /var/lib/tvweb/tvwebctl update --check   # report without installing
ssh root@<tv-ip> /var/lib/tvweb/tvwebctl rollback         # put the previous version back

Without it, or for something unreleased, pull the latest code into the clone from step 1 and deploy again, with the flags used the first time:

cd lg-webos-dashboard/server
git pull
./deploy.sh <tv-ip>

Only the server's own files are replaced; settings are kept.

Previous versions are saved to allow instant rollback via tvwebctl rollback.

See docs/IMPLEMENTATION.md for client probing order and manual rollback details.

Off by default, because it reaches off the LAN without anyone asking.

Check daily in the Server tab switches it on, as does config.json:

{ "update": { "check": true, "intervalHours": 24 } }

With it on, the server asks GitHub for the latest release once a day, the dashboard footer shows a newer version next to the installed one, and Home Assistant gets the update entity.

The request says nothing about the TV beyond the address any HTTP request reveals.

ssh root@<tv-ip>
/var/lib/tvweb/tvwebctl stop
rm -rf /var/lib/tvweb /media/developer/temp/glasshouse-install
rm -f /var/lib/webosbrew/init.d/50-tvweb* /var/lib/webosbrew/init.d/20-tvweb-services /var/lib/webosbrew/init.d/20-services.sh
rm -f /var/lib/webosbrew/tvweb-boot.log*

Nothing on the TV's read-only rootfs is ever modified. What the dashboard changes on the TV lists everything else, including the settings that uninstalling leaves as they are.

The dashboard binds to 0.0.0.0 with no authentication by default, allowing frictionless control from any phone or browser on a trusted local network.

Never expose port 8080 directly to the internet (do not port-forward).

To narrow it, set one of these in config.json and restart the server:

"host": "127.0.0.1" is the one to use to keep the on-TV app while closing the port to everything else.

The app runs on the same server, so switching the web server off entirely leaves its tile with nothing to open — remove it from the Server tab first; a first install with the web server off does not add it.

The MQTT settings panel is part of that surface: on a default install, anyone who can reach the port can change the broker the TV publishes to, and so redirect its telemetry.

It is gated by token and by allowControl like the rest of the controls, and it cannot change port, host, allowControl, allowPower or token themselves — those stay file-only so the UI cannot widen its own exposure.

The stored broker password is never sent to the browser.

Installing apps runs code on the TV, so the install routes also refuse a request whose address is not an IP address, localhost or a name in apps.hosts. Catalog downloads must use https and match the catalog's sha256 hash. Installing from a URL or an uploaded file is off unless switched on from the Apps tab, a token is set, or the request comes from the TV. A catalog app whose services need root gets it, as through the Homebrew Channel; any other package's root is confirmed service by service. Details are in docs/SECURITY.md.

Setting a token affects the dashboard only. MQTT is a separate channel.

Full detail, including the MQTT ACL guidance and optional TLS, is in docs/SECURITY.md.

• docs/SECURITY.md — threat model, SSH migration, MQTT hardening
• docs/HOME-ASSISTANT.md — the entity reference, universal media player, example automations
• docs/IMPLEMENTATION.md — architecture, /proc/lg reference, platform quirks
• docs/TV-CHANGES.md — everything the dashboard changes on the TV, and what uninstalling leaves
• docs/ACR.md — what LG's content recognition collects
• docs/TV-SPECS.md — hardware specifications of the tested TVs
• docs/STRINGS.md — how the dashboards' text is keyed for translation

Use this software at your own risk.

• Root access and hardware. This runs custom software with root privileges on an embedded TV OS. It is designed to be lightweight and to leave the read-only rootfs untouched, but the authors accept no responsibility for damage, bootloops, bricked devices, voided warranties, data loss or OLED panel issues.
• Power and control commands. Reboot, power off, screen blanking and Pixel Refresher scheduling issue low-level luna-send calls. Understand what each does before using it.
• Trademarks. An independent, unofficial community project, not affiliated with or endorsed by LG Electronics. webOS is a trademark of LG Electronics.
• Fonts. Bundles Outfit and Manrope under the SIL Open Font License 1.1; licence texts ship in server/assets/fonts/.

MIT. See LICENSE.