{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T19:27:55.199Z","url":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant","markdownUrl":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant.md","server":{"slug":"com-foreverworks-home-assistant","name":"Home Assistant","registryName":"com.foreverworks/home-assistant","description":"Read your Home Assistant's states, areas and history, and run its actions, approving locks first.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"foreverworks-mcp-home-assistant","type":"npm","identifier":"@foreverworks/mcp-home-assistant","withdrawn":false,"url":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant","version":"0.1.2","transport":"stdio","scoredAt":"2026-11-05T08:11:03.976Z"},"score":{"total":79,"tier":"medium","status":"scored","weekDelta":null,"history":[{"date":"2026-11-05","total":79},{"date":"2026-11-04","total":79},{"date":"2026-11-03","total":68}]},"categories":[{"name":"Supply Chain Security","score":99,"verdict":"partial","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","No install/post-install scripts declared.","7 of 23 dependencies flagged as unhealthy."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.none","args":{}},{"code":"dephealth.assessed","args":{"deps":"23","unhealthy":"7"}}]},{"name":"Provenance & Transparency","score":100,"verdict":"pass","reasons":["Source repository is publicly reachable at the declared URL.","Cryptographically verified build provenance (signed, bound to foreverworks/mcps).","Clear OSI-approved license (MIT).","Actively maintained (last published 2 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.verified","args":{"repo":"foreverworks/mcps"}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"2"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":62,"verdict":"fail","reasons":["AI-judged instruction clarity (good).","Context-footprint check failed: tool/resource definitions use about 2028 tokens (~202/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"good"}},{"code":"schema.footprint_heavy","args":{"avg":"202","items":"10","tools":"10","tokens":"2028","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":0,"verdict":"unverified","reasons":["Stability not yet verified: not enough scan history yet (needs a 30-day window)."],"codes":[{"code":"stability.insufficient_history","args":{}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"10"}},{"code":"toolsafety.manipulation_clean","args":{"units":"11","judged":"11"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a current MCP spec version (2026-07-28)."],"codes":[{"code":"protocol.current","args":{"version":"2026-07-28"}}]}],"inconclusive":["Stability not yet verified: not enough scan history yet (needs a 30-day window)."],"malware":[],"components":[{"slug":"foreverworks-mcp-home-assistant","type":"npm","identifier":"@foreverworks/mcp-home-assistant","withdrawn":false,"score":79,"current":true,"url":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant","markdownUrl":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"@foreverworks/mcp-home-assistant"},{"label":"Version","value":"0.1.2"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"call_action","title":"Run an action","description":"Run a Home Assistant action (formerly a service call): light.turn_on, climate.set_temperature, media_player.volume_set, script.turn_on. Answers once it has run, with the states that changed. An action in a domain the user approves call by call (lock, alarm_control_panel, cover, valve unless configured otherwise), aimed at an entity of one, or a homeassistant action aimed wider than named entities, is refused here with needs_confirmation: use call_action_confirmed. An action Home Assistant runs only for administrators (every reload, homeassistant.restart and the like) is refused with needs_admin, without being sent, when this token's user is not one. Sent once: if the answer is outcome_unknown, read the entities (get_states) before running it again. Only what the user asks for: these act on a home.","inputs":[{"name":"data","type":"object","required":false,"description":"The action's fields, as list_actions shows them: {\"brightness_pct\": 40}, {\"temperature\": 21.5}. Not the target."},{"name":"domain","type":"string","required":true,"description":"The action's domain: light, switch, climate, lock, script, homeassistant, ..."},{"name":"return_response","type":"boolean","required":false,"description":"Ask for the data the action answers with (a weather forecast, a calendar's events); only for actions list_actions marks with response."},{"name":"service","type":"string","required":true,"description":"The action within the domain: turn_on, set_temperature, unlock, ... (list_actions lists them)."},{"name":"target","type":"object","required":false,"description":"What the action acts on. Several kinds may be combined; an action that takes no target (homeassistant.reload_all, a script) leaves it out."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":336},{"name":"call_action_confirmed","title":"Run an action, with the user's approval","description":"The same as call_action, for any action, and the user approves every call before it runs: the way to lock or unlock a door, arm or disarm an alarm, open or close a cover or a valve. Only when the user asked for that action. Acts outside the computer: the client asks the user to approve each call.","inputs":[{"name":"data","type":"object","required":false,"description":"The action's fields, as list_actions shows them: {\"brightness_pct\": 40}, {\"temperature\": 21.5}. Not the target."},{"name":"domain","type":"string","required":true,"description":"The action's domain: light, switch, climate, lock, script, homeassistant, ..."},{"name":"return_response","type":"boolean","required":false,"description":"Ask for the data the action answers with (a weather forecast, a calendar's events); only for actions list_actions marks with response."},{"name":"service","type":"string","required":true,"description":"The action within the domain: turn_on, set_temperature, unlock, ... (list_actions lists them)."},{"name":"target","type":"object","required":false,"description":"What the action acts on. Several kinds may be combined; an action that takes no target (homeassistant.reload_all, a script) leaves it out."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":238},{"name":"get_states","title":"Get states","description":"The current state of one or more entities, with their attributes (a light's brightness, a thermostat's target, a sensor's unit) and when the state last changed. An id Home Assistant does not know is listed under not_found; when none is known, the call fails with suggestions.","inputs":[{"name":"attributes","type":"boolean","required":false,"description":"Include each entity's attributes."},{"name":"entity_ids","type":"array","required":true,"description":"The entity ids, like light.kitchen (list_entities finds them)."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":100},{"name":"health","title":"Health","description":"Whether this server works with its Home Assistant: the version, whether it is RUNNING, its time zone (history and logbook times carry an offset), whether the WebSocket API signs in too, whose token it holds and whether that user is an administrator (if not, the tools that need one are listed), and how many entities each domain has. ok: false comes with the problem. Call it first, and whenever a call fails with unreachable or auth.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":100},{"name":"history","title":"State history","description":"How entities' states changed over a window, from the recorder: for each entity its changes oldest first (the first is the state when the window opened), the newest limit of them. Default the last 24 hours; at most 31 days, and only as far back as the recorder keeps (10 days unless configured otherwise).","inputs":[{"name":"attributes","type":"boolean","required":false,"description":"Include each change's attributes too (much larger)."},{"name":"end","type":"string","required":false,"description":"Where it ends; default now, with its offset: 2026-03-01T18:00:00+02:00 or 2026-03-01T16:00:00Z. health gives the instance's time zone."},{"name":"entity_ids","type":"array","required":true,"description":"The entities, like sensor.living_room_temperature."},{"name":"hours","type":"integer","required":false,"description":"Instead of start: this many hours before end (default 24)."},{"name":"limit","type":"integer","required":false,"description":"At most this many changes per entity, the newest (1-1000)."},{"name":"start","type":"string","required":false,"description":"Where the window starts; default the last `hours` before end, with its offset: 2026-03-01T18:00:00+02:00 or 2026-03-01T16:00:00Z. health gives the instance's time zone."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":271},{"name":"list_actions","title":"List actions","description":"The actions (formerly services) Home Assistant offers. Without a domain, every domain with its action names; with one, each action's description, whether it takes a target, whether it answers with data, and its fields (type, options, an example). Domains whose actions the user approves call by call (lock, alarm_control_panel, cover, valve unless configured otherwise) are marked confirm, and actions only an administrator's token may run are marked needs_admin when this token's user is not one.","inputs":[{"name":"domain","type":"string","required":false,"description":"Only this domain's actions, with their fields."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":125},{"name":"list_areas","title":"List areas","description":"Every area (or one), with its floor, its devices and the entities in it: an entity's own area, else its device's, as Home Assistant's area pages show them. Disabled devices and entities are left out. Also counts what has no area. Its ids are what call_action takes as area_id and device_id.","inputs":[{"name":"area","type":"string","required":false,"description":"Only this area, by its name or id."},{"name":"entities","type":"boolean","required":false,"description":"List each area's entity ids, not only how many there are."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":111},{"name":"list_entities","title":"List entities","description":"Find entities: one row each with entity_id, name, state, unit and area, in entity id order. Filter by domain (light, sensor, climate, ...), by area (its name or id), and by words that must all appear in the id, the name or the area. Use it to find the entity_id other tools take; get_states reads an entity's attributes.","inputs":[{"name":"area","type":"string","required":false,"description":"Only entities in this area, by its name or id (list_areas lists them)."},{"name":"domain","type":"string","required":false,"description":"Only entities of this domain, like light or sensor."},{"name":"limit","type":"integer","required":false,"description":"At most this many rows (1-1000)."},{"name":"search","type":"string","required":false,"description":"Words that must all appear in the entity id, its name or its area, ignoring case."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":170},{"name":"logbook","title":"Logbook","description":"What happened over a window, as Home Assistant's logbook tells it: states that changed, automations and scripts that ran, and what caused each (a user, an action, an automation) where it knows. Oldest first, the newest limit of them. Optionally for one entity.","inputs":[{"name":"end","type":"string","required":false,"description":"Where it ends; default now, with its offset: 2026-03-01T18:00:00+02:00 or 2026-03-01T16:00:00Z. health gives the instance's time zone."},{"name":"entity_id","type":"string","required":false,"description":"Only this entity's entries."},{"name":"hours","type":"integer","required":false,"description":"Instead of start: this many hours before end (default 24)."},{"name":"limit","type":"integer","required":false,"description":"At most this many entries, the newest (1-1000)."},{"name":"start","type":"string","required":false,"description":"Where the window starts; default the last `hours` before end, with its offset: 2026-03-01T18:00:00+02:00 or 2026-03-01T16:00:00Z. health gives the instance's time zone."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":244},{"name":"render_template","title":"Render a template","description":"Render a Home Assistant template (Jinja) with its own states and helpers, for what no other tool answers in one call: \"{{ states.light | selectattr('state', 'eq', 'on') | map(attribute='entity_id') | list }}\", \"{{ area_entities('kitchen') }}\", \"{{ now() }}\". Rendering changes nothing. Home Assistant renders templates only for administrators: with another user's token this answers needs_admin without asking Home Assistant (health says which it is).","inputs":[{"name":"template","type":"string","required":true,"description":"The template text."},{"name":"variables","type":"object","required":false,"description":"Variables the template can use by name."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":129}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T08:11:03.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":23,"partial":false,"deprecated":null,"stale":7,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-11-03","recent":[{"id":"chg_01a1a599-e043-7007-b1a4-f23dc3a30c4e","kind":"check.reverified","summary":"Known CVEs (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant#chg-chg_01a1a599-e043-7007-b1a4-f23dc3a30c4e"},{"id":"chg_01a1a599-e046-75fc-a232-dbd1a71f3803","kind":"check.reverified","summary":"Dependency health (unverified → 0.88)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant#chg-chg_01a1a599-e046-75fc-a232-dbd1a71f3803"},{"id":"chg_01a1a599-e046-7d56-9a80-562b5da70acb","kind":"score.total_changed","summary":"Trust score (68 → 79)","materiality":"functional","direction":"improvement","scoreDelta":11,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant#chg-chg_01a1a599-e046-7d56-9a80-562b5da70acb"},{"id":"chg_01a19fc8-78df-77c9-b530-84c45fefdd4e","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant#chg-chg_01a19fc8-78df-77c9-b530-84c45fefdd4e"},{"id":"chg_01a19f84-fc62-760e-be3d-2679345292a1","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-03","url":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant#chg-chg_01a19f84-fc62-760e-be3d-2679345292a1"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant/changelog.json"},"links":{"html":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant","markdown":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant.md","changelogJson":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant/changelog.json","changelogRss":"https://verifymcp.io/servers/com-foreverworks-home-assistant/foreverworks-mcp-home-assistant.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/@foreverworks/mcp-home-assistant"},{"label":"Socket report","href":"https://socket.dev/npm/package/@foreverworks/mcp-home-assistant"},{"label":"Repository","href":"https://github.com/foreverworks/mcps"},{"label":"Website","href":"https://foreverworks.github.io/mcps/servers/home-assistant/"}]}}