MCP is essentially a standardized remote-control system for Bluetooth media players. Here’s how everything maps:

MCP defines two roles and two services. The diagram below shows how a Media Control Client and Server communicate over BLE:

This is the part that confuses most beginners. Here’s a clear breakdown:

MCP doesn’t reinvent the wheel. It builds entirely on the Generic Attribute Profile (GATT) — the same mechanism used by Heart Rate Monitor, Battery Service, and every other BLE profile. Here’s where MCP sits in the BLE stack:

The minimum GATT sub-procedures a Media Control Client must support:

📌 The spec says: when writing to MCS characteristics, the client should use Write Without Response — it’s faster since no acknowledgement is needed for commands like Play or Pause.

Both MCS and GMCS expose a set of GATT characteristics. Here are all the important ones you need to know, grouped by function:

📰 Media Player Information

🎵 Track Information

🎮 Playback State & Control

The Media Control Point characteristic is where all commands are sent. The client writes an opcode to it, the server executes the action, and then notifies back with a result code.

All available opcodes, grouped by category:

For richer metadata beyond basic characteristics — track lists, album art, chapters — MCP optionally uses the Object Transfer Service (OTS). Think of OTS as a mini file-transfer system embedded inside BLE.

How it works: Each object (track, group, icon) has an Object ID stored in a corresponding characteristic. The client reads the ID, then uses OTS procedures to fetch the full object content.

Mandatory OTS procedures when OTS is used in MCP:

MCP enforces strict security because you don’t want unknown devices controlling your music. The spec excludes unencrypted connections (SM1 L1) entirely.

MCS/GMCS is part of BlueZ’s LE Audio implementation. Enable experimental features first:

# Create a systemd drop-in override to enable experimental BlueZ features
sudo mkdir -p /etc/systemd/system/bluetooth.service.d/
sudo tee /etc/systemd/system/bluetooth.service.d/override.conf << EOF
[Service]
ExecStart=
ExecStart=/usr/libexec/bluetooth/bluetoothd --experimental
EOF

# Reload systemd and restart BlueZ
sudo systemctl daemon-reload
sudo systemctl restart bluetooth

# Verify BlueZ is running with experimental flag
sudo systemctl status bluetooth | grep ExecStart

# Launch bluetoothctl
bluetoothctl

# Power on adapter and scan
[bluetooth]# power on
[bluetooth]# scan on

# Connect to your BLE device (replace MAC)
[bluetooth]# connect AA:BB:CC:DD:EE:FF

# Switch to GATT menu to explore services
[AA:BB:CC:DD:EE:FF]# menu gatt
[AA:BB:CC:DD:EE:FF]# list-attributes AA:BB:CC:DD:EE:FF

# You should see service entries like:
# Primary Service (Handle 0x0001)
#   /org/bluez/hci0/dev_AA_BB_CC_DD_EE_FF/service0010
#   00001848-0000-1000-8000-00805f9b34fb  (MCS UUID)
#
# Primary Service (Handle 0x0050)
#   /org/bluez/hci0/dev_AA_BB_CC_DD_EE_FF/service0050
#   00001849-0000-1000-8000-00805f9b34fb  (GMCS UUID)

# Select a characteristic and read it
[AA:BB:CC:DD:EE:FF]# select-attribute /org/bluez/.../service0050/char0051
[AA:BB:CC:DD:EE:FF:/service0050/char0051]# read

#!/usr/bin/env python3
"""
Read Media Player Name from GMCS via BlueZ D-Bus API.
Install: sudo apt install python3-dbus
"""
import dbus

# Media Player Name characteristic UUID (from MCS spec)
MEDIA_PLAYER_NAME_UUID = "00002b93-0000-1000-8000-00805f9b34fb"

def find_characteristic(bus, target_uuid):
    """Walk all BlueZ GATT objects, return path matching UUID."""
    manager = dbus.Interface(
        bus.get_object("org.bluez", "/"),
        "org.freedesktop.DBus.ObjectManager"
    )
    for path, interfaces in manager.GetManagedObjects().items():
        if "org.bluez.GattCharacteristic1" not in interfaces:
            continue
        uuid = interfaces["org.bluez.GattCharacteristic1"].get("UUID", "")
        if uuid.lower() == target_uuid.lower():
            return path
    return None

def main():
    bus = dbus.SystemBus()
    path = find_characteristic(bus, MEDIA_PLAYER_NAME_UUID)

    if not path:
        print("Media Player Name characteristic not found.")
        print("Make sure device is connected and GMCS is discovered.")
        return

    print(f"Found at: {path}")

    char_iface = dbus.Interface(
        bus.get_object("org.bluez", path),
        "org.bluez.GattCharacteristic1"
    )

    try:
        value = char_iface.ReadValue({})
        name = bytes(value).decode("utf-8")
        print(f"Media Player Name: {name}")
    except dbus.exceptions.DBusException as e:
        print(f"Read failed: {e}")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Send MCP opcodes via Media Control Point (GMCS).
Usage: python3 mcp_control.py [play|pause|stop|next|prev]

MCP Opcodes (from MCS spec):
  0x01 = Play         0x02 = Pause       0x03 = Stop
  0x04 = Move Relative  0x05 = Fast Forward  0x06 = Fast Rewind
  0x30 = Previous Track  0x31 = Next Track
  0x32 = First Track   0x33 = Last Track
  0x34 = Goto Track (param = track number)
"""
import dbus, sys

MEDIA_CONTROL_POINT_UUID = "00002b9e-0000-1000-8000-00805f9b34fb"

OPCODES = {
    "play":  [0x01],
    "pause": [0x02],
    "stop":  [0x03],
    "next":  [0x31],
    "prev":  [0x30],
    "first": [0x32],
    "last":  [0x33],
}

def find_characteristic(bus, uuid):
    manager = dbus.Interface(
        bus.get_object("org.bluez", "/"),
        "org.freedesktop.DBus.ObjectManager"
    )
    for path, interfaces in manager.GetManagedObjects().items():
        if "org.bluez.GattCharacteristic1" not in interfaces:
            continue
        char_uuid = interfaces["org.bluez.GattCharacteristic1"].get("UUID", "")
        if char_uuid.lower() == uuid.lower():
            return path
    return None

def send_opcode(opcode_bytes):
    bus = dbus.SystemBus()
    path = find_characteristic(bus, MEDIA_CONTROL_POINT_UUID)

    if not path:
        print("[ERROR] Media Control Point not found.")
        print("  1. Is the BLE device connected?")
        print("  2. Run: bluetoothctl connect AA:BB:CC:DD:EE:FF")
        return

    char_iface = dbus.Interface(
        bus.get_object("org.bluez", path),
        "org.bluez.GattCharacteristic1"
    )

    # Per MCS spec: prefer Write Without Response for MCP opcodes
    char_iface.WriteValue(
        dbus.Array(opcode_bytes, signature='y'),
        {"type": dbus.String("command")}
    )
    print(f"[OK] Sent opcode: {opcode_bytes} ({sys.argv[1]})")

if __name__ == "__main__":
    cmd = sys.argv[1].lower() if len(sys.argv) > 1 else ""
    if cmd in OPCODES:
        send_opcode(OPCODES[cmd])
    else:
        print(f"Usage: python3 mcp_control.py [{' | '.join(OPCODES.keys())}]")

#!/usr/bin/env python3
"""
Subscribe to Media State and Track Changed notifications from GMCS.
Uses BlueZ D-Bus PropertiesChanged signal.
Requires: python3-dbus, python3-gi
"""
import dbus
import dbus.mainloop.glib
from gi.repository import GLib

MEDIA_STATE_UUID   = "00002bac-0000-1000-8000-00805f9b34fb"
TRACK_CHANGED_UUID = "00002b96-0000-1000-8000-00805f9b34fb"
TRACK_TITLE_UUID   = "00002b97-0000-1000-8000-00805f9b34fb"

MEDIA_STATES = {0: "Inactive", 1: "Playing", 2: "Paused", 3: "Seeking"}

def properties_changed(interface, changed, invalidated, path):
    """Called whenever a GATT characteristic value updates via notification."""
    if "Value" not in changed:
        return

    value = bytes(changed["Value"])
    char_name = path.split("/")[-1]  # e.g. char002c

    # Media State notification
    if len(value) == 1:
        state_id = value[0]
        state_name = MEDIA_STATES.get(state_id, f"Unknown({state_id})")
        print(f"[{char_name}] Media State: {state_name}")

    # Track Title notification (UTF-8 string)
    elif len(value) > 1:
        try:
            title = value.decode("utf-8")
            print(f"[{char_name}] Track Title: {title}")
        except UnicodeDecodeError:
            print(f"[{char_name}] Raw value: {value.hex()}")

def enable_notifications(bus, target_uuid, label):
    manager = dbus.Interface(
        bus.get_object("org.bluez", "/"),
        "org.freedesktop.DBus.ObjectManager"
    )
    for path, interfaces in manager.GetManagedObjects().items():
        if "org.bluez.GattCharacteristic1" not in interfaces:
            continue
        uuid = interfaces["org.bluez.GattCharacteristic1"].get("UUID", "")
        if uuid.lower() == target_uuid.lower():
            char_iface = dbus.Interface(
                bus.get_object("org.bluez", path),
                "org.bluez.GattCharacteristic1"
            )
            char_iface.StartNotify()
            print(f"[OK] Subscribed to {label} at {path}")
            return
    print(f"[WARN] {label} characteristic not found.")

def main():
    dbus.mainloop.glib.DBusGMainLoop(set_as_default=True)
    bus = dbus.SystemBus()

    # Listen for PropertiesChanged on all GattCharacteristic1 objects
    bus.add_signal_receiver(
        properties_changed,
        dbus_interface="org.freedesktop.DBus.Properties",
        signal_name="PropertiesChanged",
        arg0="org.bluez.GattCharacteristic1",
        path_keyword="path"
    )

    enable_notifications(bus, MEDIA_STATE_UUID,   "Media State")
    enable_notifications(bus, TRACK_TITLE_UUID,   "Track Title")
    enable_notifications(bus, TRACK_CHANGED_UUID, "Track Changed")

    print("\nListening for notifications... (Ctrl+C to stop)")
    GLib.MainLoop().run()

if __name__ == "__main__":
    main()

🧠 Key takeaways:

• 🎵 MCP is the standardized BLE way to control any media player
• 🌐 GMCS = universal remote for the currently active app; MCS = dedicated remote for a specific app
• 🎮 All commands are written as opcodes to the Media Control Point characteristic
• 🔔 All state changes (playing, paused, track changed) come back as GATT notifications
• 📦 Rich metadata (playlists, album art, chapters) is fetched via OTS
• 🔒 Encryption and bonding are mandatory — unencrypted access is forbidden
• 💻 In BlueZ, MCS/GMCS characteristics are accessible via standard GATT D-Bus API