MCP Observatory
1m ago Tracked 26,718 Last 1m ago 24h 1,587
github Python analyzed 1786ad9

homeassistant-ai/ha-mcp

github

The Unofficial and Awesome Home Assistant MCP Server

maintainer
homeassistant-ai
license
MIT
first seen
2026-06-22
last seen
2026-08-02
releases · 30d
191
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged dynamic code execution ×3 in homeassistant-ai/ha-mcp
  2. HIGH code analysis flagged dynamic code execution in homeassistant-ai/ha-mcp
  3. HIGH code analysis flagged dynamic code execution in homeassistant-ai/ha-mcp
  4. HIGH code analysis flagged dynamic code execution in homeassistant-ai/ha-mcp
  5. HIGH code analysis flagged dynamic code execution in homeassistant-ai/ha-mcp
  6. HIGH code analysis flagged dynamic code execution in homeassistant-ai/ha-mcp
  7. HIGH code analysis flagged dynamic code execution in homeassistant-ai/ha-mcp
  8. HIGH code analysis flagged dynamic code execution in homeassistant-ai/ha-mcp
  9. HIGH code analysis flagged dynamic code execution in homeassistant-ai/ha-mcp
capabilities 6 tools
transport stdio · streamable-http · http counts 6 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • ha_eval_template
  • ha_get_addon
  • ha_get_logs
  • ha_manage_addon
  • ha_manage_backup
  • ha_manage_custom_tool
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 1786ad9 · analyzer v28 · 4d ago

skills & prompt files 16

danger signals3

code evidence vv7.14.2.dev2162 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 766

filesystem 41

  • fs homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/__init__.py :18 import shutil
  • fs homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/const.py :336 # this URL 404s and the gate deliberately fails open (the registry's
  • fs homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/mcp_webhook.py :524 # stays unset; the none-mode caller then fails open (the retry's duplicate
  • fs homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/websocket_api.py :268 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy-dev/mcp_proxy_dev/__init__.py :28 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy-dev/mcp_proxy_dev/oauth.py :38 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy-dev/mcp_proxy_dev/repairs.py :34 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy-dev/start.py :17 import shutil
  • fs homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy/mcp_proxy/__init__.py :28 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy/mcp_proxy/oauth.py :38 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy/mcp_proxy/repairs.py :34 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy/start.py :17 import shutil
  • fs homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon/start.py :12 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/packaging/mcpb/generate_manifest.py :9 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/auth/provider.py :20 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/backup_manager.py :50 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/config.py :10 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/policy/handlers.py :7 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/policy/persistence.py :7 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/server.py :13 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/settings_ui/__init__.py :17 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/settings_ui/_i18n.py :13 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/settings_ui/_persistence.py :27 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/settings_ui/_theme.py :21 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/stdio_settings_sidecar.py :51 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/registry.py :23 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/smart_search/_entities.py :456 # Fails open (empty set on any error / non-dict payload).
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/smart_search/_overview.py :110 # Fails open (empty set on any error); do NOT wrap in try/except.
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_addons.py :2833 "that stays open (e.g. ESPHome '/ws'). Default: true.",
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_bug_report.py :16 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_code.py :30 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_dev.py :295 # This entry's flow can't open (e.g. an entry type without an
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_search.py :990 The component emits these when a hide dimension fails open (unknown category /
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/utils/config_write_lock.py :26 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/utils/data_paths.py :14 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/utils/kill_signal_diagnostics.py :49 - ``/proc`` reads use ``open(2)``, which POSIX classifies as not strictly
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/utils/skill_loader.py :38 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/utils/usage_logger.py :14 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/visibility/enforcement.py :464 # The resolver's device parser fails open (skips unusable payloads and
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/visibility/persistence.py :8 from pathlib import Path
  • fs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/visibility/resolver.py :422 # registry data); only the registry-derived dimensions degrade to open (or, in

shell / exec 2

  • shell homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/embedded_server.py :35 import subprocess
  • shell homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/stdio_settings_sidecar.py :47 import subprocess

network 38

  • net homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/coordinator.py :19 from aiohttp import ClientError
  • net homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/embedded_setup.py :20 from urllib.parse import urlparse
  • net homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/llm_api.py :167 import httpx
  • net homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/mcp_webhook.py :45 import aiohttp
  • net homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/oauth_autoapprove.py :52 from aiohttp import web
  • net homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/oauth_legacy.py :44 from urllib.parse import unquote_plus, urlparse
  • net homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/ui_panel.py :54 import aiohttp
  • net homeassistant-ai-ha-mcp-1786ad9/custom_components/ha_mcp_tools/update.py :15 from aiohttp import ClientError
  • net homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy-dev/mcp_proxy_dev/__init__.py :30 from urllib.parse import urlparse
  • net homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy-dev/mcp_proxy_dev/auth_native.py :39 from aiohttp import web
  • net homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy-dev/mcp_proxy_dev/oauth.py :40 from urllib.parse import urlparse
  • net homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy-dev/mcp_proxy_dev/oauth_autoapprove.py :55 from aiohttp import web
  • net homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy-dev/start.py :19 import socket
  • net homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy/mcp_proxy/__init__.py :30 from urllib.parse import urlparse
  • net homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy/mcp_proxy/auth_native.py :39 from aiohttp import web
  • net homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy/mcp_proxy/oauth.py :40 from urllib.parse import urlparse
  • net homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy/mcp_proxy/oauth_autoapprove.py :55 from aiohttp import web
  • net homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy/start.py :19 import socket
  • net homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon/start.py :9 import urllib.error
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/auth/consent_form.py :9 from urllib.parse import urlparse
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/auth/provider.py :22 from urllib.parse import parse_qs, urlencode, urlparse, urlunparse
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/client/rest_client.py :14 import httpx
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/client/supervisor_client.py :25 import httpx
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/client/websocket_client.py :20 from urllib.parse import urlparse
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/dashboard_screenshot/capture.py :19 from urllib.parse import quote
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/dashboard_screenshot/provision.py :29 import httpx
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/policy/value_sources.py :20 from urllib.parse import urlencode
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/settings_ui/_handlers_server.py :25 import httpx
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/settings_ui/_supervisor.py :25 import httpx
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/stdio_settings_sidecar.py :46 import socket
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/smart_search/_fetch.py :10 import httpx
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_addons.py :16 from urllib.parse import unquote, urlsplit
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_bug_report.py :18 from urllib.parse import quote_plus
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_code.py :28 import urllib.parse
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_resources.py :22 from urllib.parse import urlsplit
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_service.py :10 import httpx
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_updates.py :13 import httpx
  • net homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/update_check.py :38 import httpx

secrets 11

  • secrets homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy-dev/start.py :192 token = os.environ.get("SUPERVISOR_TOKEN")
  • secrets homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon-webhook-proxy/start.py :192 token = os.environ.get("SUPERVISOR_TOKEN")
  • secrets homeassistant-ai-ha-mcp-1786ad9/homeassistant-addon/start.py :749 supervisor_token = os.environ.get("SUPERVISOR_TOKEN")
  • secrets homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/__main__.py :1054 return bool(os.getenv("SUPERVISOR_TOKEN"))
  • secrets homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/_version.py :90 return bool(os.environ.get("SUPERVISOR_TOKEN")) and not is_embedded()
  • secrets homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/backup_manager.py :190 if os.environ.get("SUPERVISOR_TOKEN") and Path("/data").is_dir():
  • secrets homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/client/rest_client.py :755 token = os.environ.get("SUPERVISOR_TOKEN", "")
  • secrets homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/client/supervisor_client.py :75 token = os.environ.get("SUPERVISOR_TOKEN", "")
  • secrets homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/dashboard_screenshot/provision.py :182 if os.environ.get("SUPERVISOR_TOKEN"):
  • secrets homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/settings_ui/_handlers_server.py :293 if server is None or not os.environ.get("SUPERVISOR_TOKEN"):
  • secrets homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/update_check.py :121 token = os.environ.get("SUPERVISOR_TOKEN")

tool registrations 6

  • ha_manage_backup homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/backup.py :1657
  • ha_get_addon homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_addons.py :2652
  • ha_manage_addon homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_addons.py :2741
  • ha_manage_custom_tool homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_code.py :1289
  • ha_get_logs homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_utility.py :1166
  • ha_eval_template homeassistant-ai-ha-mcp-1786ad9/src/ha_mcp/tools/tools_utility.py :1246

declared dependencies 1

  • fastmcp@==3.4.4

transport_posture 2

  • binds all interfaces (0.0.0.0) homeassistant-ai-ha-mcp-1786ad9/tests/src/unit/test_oauth.py :1774 host="0.0.0.0",
  • binds all interfaces (0.0.0.0) homeassistant-ai-ha-mcp-1786ad9/tests/src/unit/test_oidc_entrypoint.py :313 host="0.0.0.0",