Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Home Assistant

NPM · @FOREVERWORKS/MCP-HOME-ASSISTANT

Read your Home Assistant's states, areas and history, and run its actions, approving locks first.

79 Trust /100

Last scanned (8 hours ago)

Scores higher than 62% of npm servers

Category IoT and Hardware

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security99
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 7 of 23 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to foreverworks/mcps). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 2 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability62
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 2028 tokens (~202/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

What we tested

Checks we ran (15)

  • Malware scan
  • Known CVEs
  • Install scripts
  • Dependency health
  • Source repository
  • Provenance
  • License
  • Maintenance
  • Security disclosure
  • Schema quality
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Checks we could not complete (1)

These are gaps on our side, not findings about this package. We only credit what we can confirm, so a category made up entirely of them scores 0.

  • Stability in Stability & Change Management (scores 0 for this)Stability not yet verified: not enough scan history yet (needs a 30-day window).

Does not apply to this package (2)

  • Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
  • Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +11
    • Known CVEs: unverified → pass ▲ security
    • Dependency health: unverified → 0.88 ▲ functional
  • 3 Nov 26 68

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/@foreverworks/mcp-home-assistant@0.1.2

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo foreverworks/mcps
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/foreverworks/mcps/.github/workflows/release.yml@refs/tags/release-2026-11-03.2
Rekor log index 3658012300
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:d6b2e62d0323c054c10ba9cbe15ca922a19ba0e199f7239b6151d34dd2b2d56db0559033380a0793edf54fcacbafd500b4600c06fa9b42abc7c0227a6

Background: How many MCP packages publish verified provenance →

Dependencies 23 packages
Packages resolved 23
Stale 7
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 10 exposed · ~1,824 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
call_action ~336

Run a Home Assistant action (formerly a service call): light.turn_on, climate.set_temperature, media_player.volume_set, script.turn_on. Answers once it has run, with the states that changed. An action in a domain the user approves call by call (lock, alarm_control_panel, cover, valve unless configured otherwise), aimed at an entity of one, or a homeassistant action aimed wider than named entities, is refused here with needs_confirmation: use call_action_confirmed. An action Home Assistant runs only for administrators (every reload, homeassistant.restart and the like) is refused with needs_admin, without being sent, when this token's user is not one. Sent once: if the answer is outcome_unknown, read the entities (get_states) before running it again. Only what the user asks for: these act on a home.

NameTypeReqDescription
dataobject–The action's fields, as list_actions shows them: {"brightness_pct": 40}, {"temperature": 21.5}. Not the target.
domainstringyesThe action's domain: light, switch, climate, lock, script, homeassistant, ...
return_responseboolean–Ask for the data the action answers with (a weather forecast, a calendar's events); only for actions list_actions marks with response.
servicestringyesThe action within the domain: turn_on, set_temperature, unlock, ... (list_actions lists them).
targetobject–What the action acts on. Several kinds may be combined; an action that takes no target (homeassistant.reload_all, a script) leaves it out.

No output schema declared.

No examples provided.

call_action_confirmed ~238

The same as call_action, for any action, and the user approves every call before it runs: the way to lock or unlock a door, arm or disarm an alarm, open or close a cover or a valve. Only when the user asked for that action. Acts outside the computer: the client asks the user to approve each call.

NameTypeReqDescription
dataobject–The action's fields, as list_actions shows them: {"brightness_pct": 40}, {"temperature": 21.5}. Not the target.
domainstringyesThe action's domain: light, switch, climate, lock, script, homeassistant, ...
return_responseboolean–Ask for the data the action answers with (a weather forecast, a calendar's events); only for actions list_actions marks with response.
servicestringyesThe action within the domain: turn_on, set_temperature, unlock, ... (list_actions lists them).
targetobject–What the action acts on. Several kinds may be combined; an action that takes no target (homeassistant.reload_all, a script) leaves it out.

No output schema declared.

No examples provided.

get_states ~100

The current state of one or more entities, with their attributes (a light's brightness, a thermostat's target, a sensor's unit) and when the state last changed. An id Home Assistant does not know is listed under not_found; when none is known, the call fails with suggestions.

NameTypeReqDescription
attributesboolean–Include each entity's attributes.
entity_idsarrayyesThe entity ids, like light.kitchen (list_entities finds them).

No output schema declared.

No examples provided.

health ~100

Whether this server works with its Home Assistant: the version, whether it is RUNNING, its time zone (history and logbook times carry an offset), whether the WebSocket API signs in too, whose token it holds and whether that user is an administrator (if not, the tools that need one are listed), and how many entities each domain has. ok: false comes with the problem. Call it first, and whenever a call fails with unreachable or auth.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

history ~271

How entities' states changed over a window, from the recorder: for each entity its changes oldest first (the first is the state when the window opened), the newest limit of them. Default the last 24 hours; at most 31 days, and only as far back as the recorder keeps (10 days unless configured otherwise).

NameTypeReqDescription
attributesboolean–Include each change's attributes too (much larger).
endstring–Where it ends; default now, with its offset: 2026-03-01T18:00:00+02:00 or 2026-03-01T16:00:00Z. health gives the instance's time zone.
entity_idsarrayyesThe entities, like sensor.living_room_temperature.
hoursinteger–Instead of start: this many hours before end (default 24).
limitinteger–At most this many changes per entity, the newest (1-1000).
startstring–Where the window starts; default the last `hours` before end, with its offset: 2026-03-01T18:00:00+02:00 or 2026-03-01T16:00:00Z. health gives the instance's time zone.

No output schema declared.

No examples provided.

list_actions ~125

The actions (formerly services) Home Assistant offers. Without a domain, every domain with its action names; with one, each action's description, whether it takes a target, whether it answers with data, and its fields (type, options, an example). Domains whose actions the user approves call by call (lock, alarm_control_panel, cover, valve unless configured otherwise) are marked confirm, and actions only an administrator's token may run are marked needs_admin when this token's user is not one.

NameTypeReqDescription
domainstring–Only this domain's actions, with their fields.

No output schema declared.

No examples provided.

list_areas ~111

Every area (or one), with its floor, its devices and the entities in it: an entity's own area, else its device's, as Home Assistant's area pages show them. Disabled devices and entities are left out. Also counts what has no area. Its ids are what call_action takes as area_id and device_id.

NameTypeReqDescription
areastring–Only this area, by its name or id.
entitiesboolean–List each area's entity ids, not only how many there are.

No output schema declared.

No examples provided.

list_entities ~170

Find entities: one row each with entity_id, name, state, unit and area, in entity id order. Filter by domain (light, sensor, climate, ...), by area (its name or id), and by words that must all appear in the id, the name or the area. Use it to find the entity_id other tools take; get_states reads an entity's attributes.

NameTypeReqDescription
areastring–Only entities in this area, by its name or id (list_areas lists them).
domainstring–Only entities of this domain, like light or sensor.
limitinteger–At most this many rows (1-1000).
searchstring–Words that must all appear in the entity id, its name or its area, ignoring case.

No output schema declared.

No examples provided.

logbook ~244

What happened over a window, as Home Assistant's logbook tells it: states that changed, automations and scripts that ran, and what caused each (a user, an action, an automation) where it knows. Oldest first, the newest limit of them. Optionally for one entity.

NameTypeReqDescription
endstring–Where it ends; default now, with its offset: 2026-03-01T18:00:00+02:00 or 2026-03-01T16:00:00Z. health gives the instance's time zone.
entity_idstring–Only this entity's entries.
hoursinteger–Instead of start: this many hours before end (default 24).
limitinteger–At most this many entries, the newest (1-1000).
startstring–Where the window starts; default the last `hours` before end, with its offset: 2026-03-01T18:00:00+02:00 or 2026-03-01T16:00:00Z. health gives the instance's time zone.

No output schema declared.

No examples provided.

render_template ~129

Render a Home Assistant template (Jinja) with its own states and helpers, for what no other tool answers in one call: "{{ states.light | selectattr('state', 'eq', 'on') | map(attribute='entity_id') | list }}", "{{ area_entities('kitchen') }}", "{{ now() }}". Rendering changes nothing. Home Assistant renders templates only for administrators: with another user's token this answers needs_admin without asking Home Assistant (health says which it is).

NameTypeReqDescription
templatestringyesThe template text.
variablesobject–Variables the template can use by name.

No output schema declared.

No examples provided.

Install

How do I install the Home Assistant MCP server?

Home Assistant runs locally as an npm package, launched with npx -y @foreverworks/mcp-home-assistant. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @foreverworks/mcp-home-assistant

# add to Claude Code
claude mcp add com-foreverworks-home-assistant -- npx -y @foreverworks/mcp-home-assistant
Common questions

What is the Home Assistant MCP server?

Home Assistant is an MCP server listed in the public MCP registry as com.foreverworks/home-assistant. Read your Home Assistant's states, areas and history, and run its actions, approving locks first. This page covers its npm package (@foreverworks/mcp-home-assistant).

Is the Home Assistant MCP server safe to use?

Home Assistant scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Home Assistant MCP server expose?

Home Assistant exposes 10 tools: call_action, call_action_confirmed, get_states, health, history, and 5 more. Their descriptions and schemas cost roughly 1,824 tokens of context every time the server is loaded.

Is the Home Assistant MCP server still maintained?

Home Assistant is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Home Assistant MCP server under?

Home Assistant declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

What did VerifyMCP test on the Home Assistant MCP server?

VerifyMCP ran 15 checks on Home Assistant, covering Malware scan, Known CVEs, Install scripts, Dependency health and 11 more. One item could not be completed, a gap on our side rather than a finding about Home Assistant: Stability. One category scores 0 for that reason, because we only credit what we can confirm. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.