github Python analyzed 8a89555 deep scan · partial (130/1,336 files)

homeassistant-ai/ha-mcp

Name: homeassistant-ai/ha-mcp
Author: homeassistant-ai

v8.4.3.dev2659

github

The Unofficial and Awesome Home Assistant MCP Server

maintainer: homeassistant-ai
licence: MIT
first seen: 2026-06-22
last seen: 2026-09-15
releases · 30d: 285
short id

homeassistant-ai/ha-mcp is an MCP server distributed on github, maintained by homeassistant-ai, tracked here since June 2026. It has shipped 1534 releases (currently 8.4.3.dev2659) and exposes 5 tools. Tools include ha_eval_template, ha_get_logs, ha_manage_backup, ha_manage_custom_tool, method. Its composite risk grade is E — an inferred review prompt computed from observed signals, not a verdict. 5 known CVEs on file.

what we found

5 advisories published against this server still applies to the version it ships, the most severe rated medium, most recently 2026-07-19.

Reading the source raised one review prompt — dangerous code — each a pattern worth a human look rather than a finding of fault.

Its 5 tools appear to reach filesystem, shell / exec, network and secrets, inferred from tool names, descriptions and input schemas rather than from observed behaviour.

Since the previous scan on 2026-09-15: 1 tool added and 2 tools removed.

full security breakdown →

tools 5

ha_eval_template
ha_get_logs
ha_manage_backup
ha_manage_custom_tool
method

release cadence · 90d 879 releases

06-18 00:00 08-01 00:00 now

recent releases last 10

version	date	src
v8.4.3.dev2659	2026-09-15	github
8.4.3.dev2659	2026-09-15	pypi
v8.4.3.dev2656	2026-09-15	github
8.4.3.dev2656	2026-09-15	pypi
v8.4.3.dev2654	2026-09-15	github
8.4.3.dev2654	2026-09-15	pypi
v8.4.3.dev2652	2026-09-15	github
8.4.3.dev2652	2026-09-15	pypi
v8.4.3.dev2650	2026-09-15	github
8.4.3.dev2650	2026-09-15	pypi

view all →

homeassistant-ai/ha-mcp

Navigate

Stream

Features

Display