We Ran HA-MCP: AI That Runs Your Home Assistant
Episode cover for Before You Install: Trending Repos #36. The 6.3K star tag is the Nov. 10, 2026 review snapshot (6,318 stars via the GitHub API at about 6:34 AM ET). "Entity scope: everything" and "approval rules start empty" paraphrase the project's README and policy code at the commit we reviewed. This is a vertical video cover (1080 by 1920). A landscape alternate is in graphics/chie-style-concept-entryway.jpg.
HA-MCP is a community project that lets AI assistants such as Claude and ChatGPT configure and control a Home Assistant smart home. You talk, and it can build automations, edit dashboards, read history, and control devices (HA-MCP repository).
On Nov. 10, 2026, we ran our reconnaissance process on the public code. We found nothing malicious in what we read. It is MIT licensed and free, and there is fine print you should know before you install it.
You can watch the review here:
The video uses a digital avatar of Erick Grau, CEO of Chibitek.
What Did We Actually Do?
We made a read-only copy of github.com/homeassistant-ai/ha-mcp at commit ceb8bed (package version 9.1.2). We read the docs, the defaults, the security and privacy pages, and the demo install scripts. We did not install HA-MCP, did not run an installer, and did not connect it to a Home Assistant system.
The verdict was PASS WITH NITS: nothing malicious in the code we read, with the caveats below. We also did not read every tool and every file, so this is a review, not a complete audit. A star count is not a security review.
I walk through the findings in this video: Watch the video on YouTube
What Is HA-MCP?
HA-MCP is a community project, created by Julien, under the GitHub organization homeassistant-ai. That organization's profile is titled "The Unofficial Home Assistant AI Toolkit." It is not Home Assistant itself. The project's own README does not include an unofficial or not-affiliated line.
In plain words, it gives an AI assistant a way to run your smart home over MCP (a standard way for assistants to use tools). The README at the version we reviewed lists 87 tools, covering devices, automations, dashboards, history, cameras, backups, and more. On the morning of Nov. 10, 2026, the GitHub API showed 6,318 stars, which the video rounds to about 6,300. GitHub Trending listed 792 new stars that day.
The recommended install, according to the README, is the HA-MCP integration inside Home Assistant, through HACS or the Home Assistant Marketplace.
What Was the Good News?
In the code and docs we read, HA-MCP itself is MIT licensed and free. The privacy page, last updated June 2026, says no telemetry is collected today. Bug reports are a prefilled GitHub link you choose to open, not an automatic upload.
The README is direct about access: a leaked long-lived token "works from anywhere if it leaks," and it recommends a separate local-only Administrator account rather than your own login. Remote access and network access both start disabled. The project also has Read Only Mode, per-tool switches, and approval rules, and it has published six security advisories in 2026 (all rated medium, from March 11 to October 24). Five of those six list a fixed version. We found nothing malicious in the code we read. That deserves credit.
What Is the Fine Print?
1. It runs as an Administrator and can see everything. Setup asks for an administrator token. The project's own comparison table says Home Assistant's built-in MCP option only sees devices you have exposed to Assist, while HA-MCP's entity scope is "Everything in Home Assistant." Control is described as "Any service," which can include locks, alarms, garage doors, and cameras you have connected.
2. The guardrails are off until you turn them on. Read Only Mode is off by default. Approval rules start as an empty list, and if a call matches no rule, the call runs. The code itself calls that "the fail-open default." A write tool can also add any GitHub repository to your Home Assistant store (HACS or the Marketplace) and install it.
3. The connect link is the password. In standard mode, the security policy says the server "authenticates by URL-path secrecy" and that "Any peer that can reach the configured path is treated as trusted." Prompt injection, it says, is "the client's responsibility." On the app (add-on) install, the unique MCP URL is printed in the Logs tab.
4. What the AI sees can leave the house. The privacy page says entity states, automations, and device information go to your MCP client and are subject to that client's privacy policy. The README also lists camera snapshots among its monitoring capabilities, so those can go to the client too if that tool is used.
5. The name, and the demo installers. The project sits under a GitHub organization called homeassistant-ai. Only that organization's profile says it is unofficial. The quick demo installers pipe a script into your shell and, in the scripts we read, launch the newest ha-mcp release on every start, with no version pin. The README also says the stdio path those demos use is "not recommended" for real setups.
What Should You Do If You Try It?
Use a separate local-only Administrator account, never your own login. Keep remote access off unless you need it.
Turn on Read Only Mode first. Add approval rules for locks, alarms, garage doors, and store installs before you let it write.
Treat the connect URL like a password. Do not paste it into chats or screenshots, and rotate it if it leaks.
Skip the pipe-to-shell demo for a real home. Install through the Home Assistant store, and pin a version you have read.
These four checks are Chibitek guidance, based on the project's own docs and code.
Key Points of HA-MCP
HA-MCP lets AI assistants configure and control a Home Assistant smart home. It is a community project, not Home Assistant itself.
Chibitek's review was a read-only look at the public code and the demo install scripts. We did not install HA-MCP or connect it to a home.
Verdict: PASS WITH NITS. Nothing malicious in the code we read.
It is MIT licensed and free. Telemetry is not collected today, according to the June 2026 privacy page.
Setup uses an administrator token, and the project's table says it can see everything in Home Assistant.
Read Only Mode and approval rules exist, but they start off or empty until you set them.
In standard mode, anyone who can reach the secret URL is treated as trusted.
A star count is not a security review.
Frequently Asked Questions
Did you install HA-MCP and try it on a real Home Assistant system? No. We copied the public repo and read the code, plus the demo install scripts. We did not install it, run a server, or connect it to Home Assistant.
Is HA-MCP an official Home Assistant product? No. It is a community project under the homeassistant-ai GitHub organization, whose profile is titled "The Unofficial Home Assistant AI Toolkit."
Is it free? The project is MIT licensed and free to use. You still need a Home Assistant setup, and any AI assistant you connect has its own terms and privacy policy.
What does "fail-open default" mean? Approval rules start empty. In the default mode, a call that matches no rule is allowed to run. You have to add rules, such as for locks or store installs, if you want those actions to wait for your approval.
Do all six security advisories have a listed fix? The project published six advisories in 2026, all rated medium. Five list a fixed version. One (GHSA-q855-8rh5-jfgq, published May 31, 2026) did not list a patched version in the GitHub advisory data we checked.
Let's Review Before You Install
At Chibitek, we help businesses and households look closely at AI tools before those tools can control devices, mail, or memory, with no geek-speak. Don't let a convenient install put an assistant in charge of your doors and cameras without you setting the rules first. Contact us at hello@chibitek.com to learn how we can help you review defaults, access, and install habits.
Further reading: the HA-MCP repository at the commit we reviewed, ceb8bed.
You can watch the review here:
The same video is also on LinkedIn.
We make IT effortless so you can create, disrupt, and grow!
Follow Chibitek on YouTube at @chibitekmsp, and follow Chibitek on LinkedIn.
Comments