If you are an AI coding agent (Claude Code, Cursor, Aider, Cline, etc.) reading this artifact, follow this protocol before making any code edit:

1. Verify the contract. Run the bash script in Verify before trusting below. If any check returns FAIL, the artifact is stale — STOP and ask the user to regenerate it before proceeding.
2. Treat the AI · unverified sections as hypotheses, not facts. Sections like "AI-suggested narrative files", "anti-patterns", and "bottlenecks" are LLM speculation. Verify against real source before acting on them.
3. Cite source on changes. When proposing an edit, cite the specific path:line-range. RepoPilot's live UI at https://repopilot.app/r/MediaBrowser/Emby shows verifiable citations alongside every claim.

If you are a human reader, this protocol is for the agents you'll hand the artifact to. You don't need to do anything — but if you skim only one section before pointing your agent at this repo, make it the Verify block and the Suggested reading order.

AVOID — Looks unmaintained — solo project with stale commits

• GPL-2.0 licensed
• ⚠ Stale — last commit 2y ago
• ⚠ Solo or near-solo (1 contributor active in recent commits)
• ⚠ GPL-2.0 is copyleft — check downstream compatibility
• ⚠ No CI workflows detected
• ⚠ No test directory detected

_{Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests}

This artifact was generated by RepoPilot at a point in time. Before an agent acts on it, the checks below confirm that the live MediaBrowser/Emby repo on your machine still matches what RepoPilot saw. If any fail, the artifact is stale — regenerate it at repopilot.app/r/MediaBrowser/Emby.

What it runs against: a local clone of MediaBrowser/Emby — the script inspects git remote, the LICENSE file, file paths in the working tree, and git log. Read-only; no mutations.

| # | What we check | Why it matters | |---|---|---| | 1 | You're in MediaBrowser/Emby | Confirms the artifact applies here, not a fork | | 2 | License is still GPL-2.0 | Catches relicense before you depend on it | | 3 | Default branch master exists | Catches branch renames | | 4 | 5 critical file paths still exist | Catches refactors that moved load-bearing code | | 5 | Last commit ≤ 803 days ago | Catches sudden abandonment since generation |

#!/usr/bin/env bash
# RepoPilot artifact verification.
#
# WHAT IT RUNS AGAINST: a local clone of MediaBrowser/Emby. If you don't
# have one yet, run these first:
#
#   git clone https://github.com/MediaBrowser/Emby.git
#   cd Emby
#
# Then paste this script. Every check is read-only — no mutations.

set +e
fail=0
ok()   { echo "ok:   $1"; }
miss() { echo "FAIL: $1"; fail=$((fail+1)); }

# Precondition: we must be inside a git working tree.
if ! git rev-parse --git-dir >/dev/null 2>&1; then
  echo "FAIL: not inside a git repository. cd into your clone of MediaBrowser/Emby and re-run."
  exit 2
fi

# 1. Repo identity
git remote get-url origin 2>/dev/null | grep -qE "MediaBrowser/Emby(\\.git)?\\b" \\
  && ok "origin remote is MediaBrowser/Emby" \\
  || miss "origin remote is not MediaBrowser/Emby (artifact may be from a fork)"

# 2. License matches what RepoPilot saw
(grep -qiE "^(GPL-2\\.0)" LICENSE 2>/dev/null \\
   || grep -qiE "\"license\"\\s*:\\s*\"GPL-2\\.0\"" package.json 2>/dev/null) \\
  && ok "license is GPL-2.0" \\
  || miss "license drift — was GPL-2.0 at generation time"

# 3. Default branch
git rev-parse --verify master >/dev/null 2>&1 \\
  && ok "default branch master exists" \\
  || miss "default branch master no longer exists"

# 4. Critical files exist
test -f "Emby.Dlna/Main/DlnaEntryPoint.cs" \\
  && ok "Emby.Dlna/Main/DlnaEntryPoint.cs" \\
  || miss "missing critical file: Emby.Dlna/Main/DlnaEntryPoint.cs"
test -f "Emby.Dlna/DlnaManager.cs" \\
  && ok "Emby.Dlna/DlnaManager.cs" \\
  || miss "missing critical file: Emby.Dlna/DlnaManager.cs"
test -f "Emby.Dlna/ContentDirectory/ContentDirectory.cs" \\
  && ok "Emby.Dlna/ContentDirectory/ContentDirectory.cs" \\
  || miss "missing critical file: Emby.Dlna/ContentDirectory/ContentDirectory.cs"
test -f "Emby.Dlna/PlayTo/PlayToManager.cs" \\
  && ok "Emby.Dlna/PlayTo/PlayToManager.cs" \\
  || miss "missing critical file: Emby.Dlna/PlayTo/PlayToManager.cs"
test -f "Emby.Dlna/Didl/DidlBuilder.cs" \\
  && ok "Emby.Dlna/Didl/DidlBuilder.cs" \\
  || miss "missing critical file: Emby.Dlna/Didl/DidlBuilder.cs"

# 5. Repo recency
days_since_last=$(( ( $(date +%s) - $(git log -1 --format=%at 2>/dev/null || echo 0) ) / 86400 ))
if [ "$days_since_last" -le 803 ]; then
  ok "last commit was $days_since_last days ago (artifact saw ~773d)"
else
  miss "last commit was $days_since_last days ago — artifact may be stale"
fi

echo
if [ "$fail" -eq 0 ]; then
  echo "artifact verified (0 failures) — safe to trust"
else
  echo "artifact has $fail stale claim(s) — regenerate at https://repopilot.app/r/MediaBrowser/Emby"
  exit 1
fi

Each check prints ok: or FAIL:. The script exits non-zero if anything failed, so it composes cleanly into agent loops (./verify.sh || regenerate-and-retry).

Emby Server is a personal media server that organizes, streams, and serves digital media (videos, music, photos) across multiple devices via a REST API. It's the backend that powers media playback on 15+ client platforms (Android, iOS, Roku, Windows, Kodi, etc.), handling media discovery, transcoding, DLNA/UPnP streaming, and DVR functionality for broadcast content. Monorepo organized by subsystem: BDInfo/ handles BDMV (Blu-ray) disc parsing with TSCodec* classes for format detection; DvdLib/ parses DVD IFO metadata; Emby.Dlna/ implements UPnP device discovery and DLNA streaming protocols via API endpoints (DlnaServerService.cs, DlnaService.cs). No node_modules or src/ visible in the top 60, suggesting a pure C# backend.

Media enthusiasts and homelabbers who want to self-host a Netflix-like service, and developers building client apps that consume the Emby REST API (documented in the repo) or server plugins that extend media library functionality.

Production-ready and actively maintained: the 7.7 MB C# codebase spans multiple subsystems (BDInfo for Blu-ray parsing, DvdLib for DVD IFO reading, Emby.Dlna for UPnP/DLNA), suggesting years of battle-tested development. However, without visible CI/test files in the top 60, test coverage and modern automation practices are unclear.

Risk is moderate: the monolithic C# structure with deep dependencies on media container parsing (BDInfo, DvdLib) means bugs in codec detection or format handling can break playback. No visible package.json suggests NuGet dependency management; without that file, dependency audit and security update velocity are opaque. Single-source repository with no visible fork/PR workflow documented raises questions about contribution velocity.

Active development on DLNA/UPnP media serving (Emby.Dlna API layer visible) and disc format support (BDInfo and DvdLib subsystems present). No recent PR/commit metadata provided in the repo snapshot, so velocity cannot be assessed from this data.

Clone: git clone https://github.com/MediaBrowser/Emby.git. No package.json or Makefile visible; this is a Visual Studio C# project, so open Emby.sln in Visual Studio 2019+ or use dotnet build if .NET SDK is installed. Restore NuGet dependencies via the IDE or dotnet restore.

Daily commands: Open .vs/config/applicationhost.config (IIS Express config) or use Visual Studio's built-in debugger. Run via Visual Studio (F5 to debug) or dotnet run if a launchSettings.json exists (not shown). Port and admin URL likely configured in applicationhost.config.

• Emby.Dlna/Main/DlnaEntryPoint.cs — Primary entry point for DLNA services initialization; all contributors must understand how media server plugin architecture bootstraps.
• Emby.Dlna/DlnaManager.cs — Core orchestrator for DLNA protocol handling and device management; essential for understanding service lifecycle and media routing.
• Emby.Dlna/ContentDirectory/ContentDirectory.cs — Implements UPnP ContentDirectory service; critical for media browsing and search functionality that clients depend on.
• Emby.Dlna/PlayTo/PlayToManager.cs — Manages device discovery and PlayTo controller lifecycle; central to streaming playback orchestration across devices.
• Emby.Dlna/Didl/DidlBuilder.cs — Constructs DIDL-Lite XML metadata for media items; every media operation depends on correct metadata serialization.
• BDInfo/BDROM.cs — Handles Blu-ray disc parsing and stream extraction; foundational for disc-based media format support.
• DvdLib/Ifo/Dvd.cs — DVD parsing and navigation core; essential for understanding disc metadata handling patterns used throughout server.

Add a new UPnP Service Action

1. Define the action method in the service class (e.g., ContentDirectory.cs) with proper parameter mapping (Emby.Dlna/ContentDirectory/ContentDirectory.cs)
2. Add action metadata (parameters, return types) to ServiceActionListBuilder for SCPD XML generation (Emby.Dlna/ContentDirectory/ServiceActionListBuilder.cs)
3. Update ControlHandler to route SOAP requests to the new action method (Emby.Dlna/ContentDirectory/ControlHandler.cs)
4. Regenerate service XML description using ContentDirectoryXmlBuilder if needed (Emby.Dlna/ContentDirectory/ContentDirectoryXmlBuilder.cs)

Add support for a new media codec in disc parsing

1. Create new codec class inheriting pattern from TSCodecAVC.cs with stream type detection (BDInfo/TSCodecAVC.cs)
2. Register codec parser in TSStreamFile or TSPlaylistFile parsing logic (BDInfo/TSPlaylistFile.cs)
3. Add codec constants to BDInfoSettings if new stream types are defined (BDInfo/BDInfoSettings.cs)
4. Update DidlBuilder to expose new codec metadata in DIDL-Lite output (Emby.Dlna/Didl/DidlBuilder.cs)

Add event notification for media state changes

1. Define new StateVariable in the service (e.g., ConnectionManager.cs) with data type and constraints (Emby.Dlna/ConnectionManager/ConnectionManager.cs)
2. Trigger state change notifications through EventManager when state changes (Emby.Dlna/Eventing/EventManager.cs)
3. Add state variable metadata to ServiceActionListBuilder for SCPD XML generation (Emby.Dlna/ConnectionManager/ServiceActionListBuilder.cs)

Extend device discovery and control

1. Create new device controller inheriting from PlayToController with protocol-specific logic (Emby.Dlna/PlayTo/PlayToController.cs)
2. Register device factory in PlayToManager to detect and instantiate devices (Emby.Dlna/PlayTo/PlayToManager.cs)
3. Update PlaylistItemFactory to format media URLs appropriately for target device protocol (Emby.Dlna/PlayTo/PlaylistItemFactory.cs)

• UPnP/DLNA — Open standard protocol enabling discovery and remote control of networked media devices; ensures interoperability with millions of existing devices (TVs, receivers, media players).
• SOAP/XML for control — UPnP specification requirement; verbose but mature, enables device-agnostic service descriptions and complex action parameters.
• DIDL-Lite metadata format — UPnP standard for media object serialization; client-side rendering depends on well-formed DIDL-Lite; supports rich metadata (art, subtitles, chapters).
• C# / .NET Framework — Cross-platform compatibility with Windows Media Center integration; leverages Windows-native codec support; mature async/await patterns for server workloads.
• BDInfo/DvdLib parsers — Standalone disc parsing libraries avoid dependency on external codec libraries; enable accurate chapter/stream detection for BD and DVD media.

• undefined
  • Why: undefined
  • Consequence: undefined

Media transcoding logic not visible in top 60 — likely in a Emby.MediaEncoder or similar subsystem; assume this is a separate service or subsystem requiring additional runtime dependencies (ffmpeg). BDInfo/TSStreamBuffer.cs and TSStreamClip.cs use direct binary buffer manipulation for transport stream parsing — endianness and frame boundary assumptions are non-obvious. DVD/Blu-ray path hardcodes likely exist in mount detection code (not shown); Linux/Windows path handling may differ. IIS Express applicationhost.config must be manually edited for non-standard ports — no environment variable override visible.

• BDMV (Blu-ray Disc Movie) Format — BDInfo subsystem parses BDMV file structures (playlists, clips, streams); understanding playlist composition vs. title structure is essential to modify disc support or fix playback bugs.
• MPEG-2 Transport Stream (TS) Parsing — BDInfo/TSStream*.cs classes decode .m2ts files by parsing PES packets and program maps; this is critical for detecting codecs, frame rates, and stream indices without decoding video.
• UPnP/DLNA Device Discovery and MediaServer Protocol — Emby.Dlna/ implements UPnP Device Description and ContentDirectory/AVTransport SOAP actions; this enables auto-discovery on local networks and is how Roku/Android/smart TVs find and control the server.
• DVD IFO (Information) File Format — DvdLib parses VIDEO_TS.IFO binary structures to extract title sets, program chains, cells, and audio/video attributes; bugs here break DVD chapter/audio detection.
• Codec Profile/Level Detection (AVC, MPEG2, VC1, DTS, AC3) — BDInfo/TSCodec* classes detect codec profiles and levels from bitstream headers without full decode; this informs transcoding decisions and client capability matching.
• Binary Endianness and Byte-Order Marks (Big-Endian vs. Little-Endian) — DvdLib/BigEndianBinaryReader.cs and BDInfo transport stream parsers work with big-endian media formats; incorrect endianness handling causes metadata corruption.
• REST API and OpenAPI Documentation — README mentions built-in API documentation and client libraries; Emby.Dlna/Api/ exposes REST endpoints that client apps consume; understanding API contract versioning is critical for client compatibility.

• jellyfin/jellyfin — Free/open fork of Emby Server; shares DLNA stack and media library concepts but in .NET Core, not .NET Framework
• MediaBrowser/MediaBrowser.Server — Predecessor to this Emby repo; may contain historical context or related server modules
• plex/plex-media-server — Commercial alternative solving the same self-hosted media server problem; proprietary but reference architecture for feature parity
• MediaBrowser/MediaBrowser — Main client/API library repo; contains REST client bindings and API contract definitions used by all Emby client apps
• MediaBrowser/Emby.Roku — Client-side Roku app repo; example of consuming Emby Server's REST API and DLNA discovery from a remote device

To work on one of these in Claude Code or Cursor, paste: Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.

Add unit tests for BDInfo BDROM parser and codec detection

The BDInfo module (BDInfo/BDROM.cs, BDInfo/TSCodec*.cs) handles complex Blu-ray disc parsing and codec detection. There are no visible test files in the repository structure for this critical media analysis component. Adding comprehensive unit tests would improve reliability for codec detection (AC3, DTS, LPCM, etc.) and BDROM file parsing, reducing regressions when maintaining this codec-specific logic.

• [ ] Create BDInfo.Tests project alongside BDInfo/
• [ ] Add unit tests for each TSCodec*.cs file (TSCodecAC3, TSCodecDTS, TSCodecLPCM, etc.)
• [ ] Add integration tests for BDROM.cs parsing with sample Blu-ray structures
• [ ] Test edge cases in TSStreamBuffer.cs for binary parsing
• [ ] Ensure tests cover LanguageCodes.cs lookups

Add unit tests for DvdLib IFO file parsing

The DvdLib module (DvdLib/Ifo/*.cs) parses DVD IFO files with complex binary structures (VideoAttributes, AudioAttributes, ProgramChain, etc.). The absence of tests for this critical parsing logic creates risk for DVD metadata extraction. Adding tests would validate the BigEndianBinaryReader.cs implementation and ensure proper handling of DVD-specific data structures like DvdTime, Cell, and Title parsing.

• [ ] Create DvdLib.Tests project alongside DvdLib/
• [ ] Add unit tests for BigEndianBinaryReader.cs with sample binary data
• [ ] Add tests for DvdTime.cs parsing and calculations
• [ ] Test ProgramChain.cs and Program.cs structure parsing
• [ ] Add tests for AudioAttributes.cs and VideoAttributes.cs codec/format detection
• [ ] Create integration tests using sample DVD IFO file structures

Add DLNA ContentDirectory filter validation tests and documentation

The Emby.Dlna/Didl/Filter.cs file implements DLNA filter parsing which is critical for media server compatibility, but has no visible test coverage. Additionally, Emby.Dlna/Configuration/DlnaOptions.cs lacks documentation about valid configuration options. Adding tests and configuration docs would reduce client compatibility issues and help new contributors understand DLNA profile restrictions.

• [ ] Create Emby.Dlna.Tests project with test coverage for Didl/Filter.cs parsing
• [ ] Add unit tests for filter expression parsing and validation against DLNA specs
• [ ] Test edge cases in DidlBuilder.cs metadata serialization with various filters
• [ ] Add XML documentation comments to DlnaOptions.cs properties explaining each setting
• [ ] Create DLNA_CONFIGURATION.md documenting valid DlnaOptions and their DLNA compliance implications
• [ ] Add integration tests for ContentDirectory ControlHandler.cs with various filter combinations

• Add unit tests for BDInfo/TSCodecAVC.cs and TSCodecMPEG2.cs: these codec parsers lack test coverage; write test cases that validate frame detection and profile/level extraction against known Blu-ray samples.
• Extend DvdLib/Ifo/DvdTime.cs with millisecond precision and test against mixed-frame-rate DVDs: currently appears to assume fixed frame rate; add test cases for 23.976 FPS, 29.97 FPS edge cases.
• Document Emby.Dlna/Common/ServiceAction.cs with OpenAPI/Swagger annotations: this file defines UPnP action mappings but lacks inline documentation; add XML doc comments and generate OpenAPI spec so client developers can auto-generate binding code.

• High · Potential Hardcoded Configuration in applicationhost.config — .vs/config/applicationhost.config. The .vs/config/applicationhost.config file is a Visual Studio configuration file that may contain sensitive settings such as database connection strings, API keys, or other credentials. This file should not be tracked in version control. Fix: Add .vs/ directory to .gitignore if not already present. Ensure sensitive configuration is stored in environment variables or secure configuration management systems, not in version control.
• High · DLNA/UPnP Exposure Risk — Emby.Dlna/ContentDirectory/, Emby.Dlna/Api/. The Emby.Dlna module implements UPnP/DLNA protocol which operates on local network discovery and may expose media library information to unauthenticated devices on the network. The ContentDirectory and MediaReceiverRegistrar services could be exploited if not properly authenticated. Fix: Implement strong authentication and authorization checks for all DLNA service endpoints. Validate all incoming DLNA requests and sanitize XML responses. Consider requiring authentication tokens for DLNA operations.
• High · XML External Entity (XXE) Injection Risk in DLNA/DIDL Processing — Emby.Dlna/Didl/DidlBuilder.cs. The Emby.Dlna/Didl/ module processes XML content for DIDL (Digital Item Description Language) metadata. Without proper XML parser configuration, this could be vulnerable to XXE attacks where malicious XML entities could be used to read local files or perform SSRF attacks. Fix: Configure XML parsers to disable external entity processing (XXE). Use XmlReaderSettings with ProhibitDtd=true and XmlResolver=null. Validate and sanitize all XML input.
• Medium · REST API Documentation Exposure — Emby.Dlna/Api/. The README indicates a REST-based API with built-in documentation. Exposed API documentation can leak information about endpoints, parameters, and authentication mechanisms to potential attackers. Fix: Implement authentication before exposing API documentation. Use API documentation tools that support access control. Consider making API docs only available to authenticated users or within trusted networks.
• Medium · Insecure Deserialization Potential in Media Metadata Processing — BDInfo/BDROM.cs, BDInfo/TSStreamFile.cs, DvdLib/Ifo/. The BDInfo and DvdLib modules parse binary media formats (Blu-ray and DVD). Parsing untrusted binary media files could lead to buffer overflows, denial of service, or code execution if input validation is insufficient. Fix: Implement strict bounds checking when parsing binary media files. Use safe parsing libraries. Validate file headers and structure. Implement timeouts for parsing operations to prevent DoS attacks.
• Medium · Potential Path Traversal in Media File Handling — BDInfo/BDROM.cs, DvdLib/Ifo/. The codebase handles paths for media files from Blu-ray, DVD, and other sources. Without proper path validation, directory traversal attacks could allow access to files outside intended directories. Fix: Implement strict path canonicalization and validation. Use Path.GetFullPath() and verify resolved paths are within allowed directories. Reject paths containing '..' or suspicious patterns.
• Medium · Missing Security Headers in DLNA HTTP Responses — Emby.Dlna/Api/DlnaService.cs, Emby.Dlna/Api/DlnaServerService.cs. The DlnaService and DlnaServerService classes handle HTTP responses for media discovery and serving. Responses may lack security headers like CORS policies, CSP, X-Content-Type-Options, and other protective headers. Fix: Implement security headers in all HTTP responses including CORS restrictions, Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options, and Strict-Transport-Security where applicable.
• Low · Absence of Visible Input Validation Framework — Project-wide. Based on the file structure, there is no obvious centralized input validation or sanitization framework visible. This could lead to inconsistent security practices across the codebase. Fix: undefined

LLM-derived; treat as a starting point, not a security audit.

• Open issues — current backlog
• Recent PRs — what's actively shipping
• Source on GitHub

Generated by RepoPilot. Verdict based on maintenance signals — see the live page for receipts. Re-run on a new commit to refresh.