Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.dgahagan/homebox-mcp

PYPI · HOMEBOX-MCP

Homebox home inventory: search, intake, warranties, attachments, locations, tags, QR labels

Available components

+16 this week 91 Trust /100

Last scanned (17 hours ago)

Scores higher than 94% of PyPI servers

Category Documents and Files

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
  • 1 of 33 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to dgahagan/homebox-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 9 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability68
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 4111 tokens (~105/item across 39 items; 39 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage71
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 0% of tool parameters carry a description.Fail
  • Structured output schemas are declared (13% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 39 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
What we tested

Checks we ran (16)

  • Malware scan
  • Known CVEs
  • Install scripts
  • Dependency health
  • Source repository
  • Provenance
  • License
  • Maintenance
  • Security disclosure
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this package (2)

  • Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
  • Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 31 Oct 26 0
    • Stability: 0.97 → pass security
  • 30 Oct 26 +16
    • Malware scan: unverified → pass ▲ security
    • Security disclosure: unverified → fail ▼ functional
  • 29 Oct 26 −1
    • Security disclosure: fail → unverified ▼ functional
    • Stability: pass → 0.93 functional
  • 26 Oct 26 0
    • Package version: 1.2.0 → 1.3.0 functional
  • 23 Oct 26 0
    • Stability: 0.97 → pass security
  • 22 Oct 26 0
    • Stability: pass → 0.97 functional
  • 21 Oct 26 0
    • Package version: 1.1.0 → 1.2.0 functional
  • 16 Oct 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed pypi/homebox-mcp@1.3.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem pypi
Reason Verified
Discovered via Registry attestation endpoint
Source repo dgahagan/homebox-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/dgahagan/homebox-mcp/.github/workflows/publish.yml@refs/tags/v1.3.0
Rekor log index 3475930064
Predicate type PyPI publish attestation https://docs.pypi.org/attestations/publish/v1
Subject digest sha256:d7037ccdd875f026602ce5eb09bb6e87bcac2979f01f7bd98bd0d6c1d83c2a5b

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend Known build tool hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 33 packages
Packages resolved 33
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 39 exposed · ~4,111 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
attach_document ~164

Attach a document to an item OR a location. `source` is a local file path or an http(s) URL (downloaded then uploaded). `doc_type` is e.g. manual, attachment, warranty, receipt, photo. `identifier` is assetId/alias/name for an item, or a location name/path (tried as a fallback if no item matches). Set `primary=True` to make a photo the entity's primary image — e.g. a "this is the spot" wayfinding photo on a shelf/tote location (doc_type="photo").

NameTypeReqDescription
doc_typestring––
identifierstringyes–
primaryboolean––
sourcestringyes–
titlestringyes–

No output schema declared.

No examples provided.

barcode_lookup ~46

Look up a UPC/EAN barcode → name/manufacturer/model (optional path for boxed goods). Thin wrapper over GET /products/search-from-barcode.

NameTypeReqDescription
codestringyes–

No output schema declared.

No examples provided.

create_item ~178

Create an inventory item and enrich it in one call. `location` is a location name or /-separated path (must exist; use list_locations). `tags` are tag names (must already exist; use list_tags). `fields` maps custom-field name -> value; each value's JSON type picks the field type (string -> text, number -> number [integer-coerced], true/false -> boolean). Returns the new assetId and id.

NameTypeReqDescription
fields–––
location–––
manufacturer–––
model–––
namestringyes–
notes–––
purchase_date–––
purchase_from–––
purchase_price–––
quantityinteger––
serial–––
tags–––
warranty_expires–––

No output schema declared.

No examples provided.

create_location ~106

Create a LOCATION entity (e.g. a new tote/bin/shelf) to bootstrap a new storage spot. `parent` is an existing location name or /-separated path (optional); `description` is optional free text, e.g. a contents summary (≤1000 chars). Returns the new location id. For deep paths, prefer import_csv's HB.location auto-create.

NameTypeReqDescription
description–––
namestringyes–
parent–––

No output schema declared.

No examples provided.

delete_attachment ~63

PERMANENTLY delete one attachment from an item or location (see list_attachments for ids). `confirm` must equal the attachment's exact title.

NameTypeReqDescription
attachment_idstringyes–
confirmstringyes–
identifierstringyes–

No output schema declared.

No examples provided.

delete_item ~58

PERMANENTLY delete an item (assetId / alias field / exact name), including its attachments. `confirm` must equal the item's exact name. There is no undo.

NameTypeReqDescription
confirmstringyes–
identifierstringyes–

No output schema declared.

No examples provided.

delete_location ~110

PERMANENTLY delete a location (name or /-separated path). `confirm` must equal the location's exact name. A location that still contains items or sub-locations is refused unless `confirm_nonempty=True` — sub-locations are deleted with it, and its items are ORPHANED to the top level (not deleted). There is no undo.

NameTypeReqDescription
confirmstringyes–
confirm_nonemptyboolean––
locationstringyes–

No output schema declared.

No examples provided.

delete_maintenance ~52

PERMANENTLY delete one maintenance entry (see list_maintenance for ids). `confirm` must equal the entry's exact name.

NameTypeReqDescription
confirmstringyes–
entry_idstringyes–

No output schema declared.

No examples provided.

delete_tag ~54

PERMANENTLY delete a tag itself (it is removed from every tagged item; the items survive). `confirm` must equal the tag's exact name.

NameTypeReqDescription
confirmstringyes–
namestringyes–

No output schema declared.

No examples provided.

duplicate_item ~138

Duplicate an existing item (assetId / alias field / exact name), e.g. "I bought a second one". `prefix` is prepended to the new item's name. Copies custom fields by default; attachments and maintenance log only on request. NOTE: copied custom fields include the alias field verbatim — if you use one, give the copy its own value via set_fields right after. Returns the new item's id and assetId.

NameTypeReqDescription
copy_attachmentsboolean––
copy_custom_fieldsboolean––
copy_maintenanceboolean––
identifierstringyes–
prefixstring––

No output schema declared.

No examples provided.

export_csv ~69

Export the whole inventory as a Homebox CSV (the complement of import_csv; also a quick backup). Saves to `save_to` (file path or directory; default: homebox-export.csv in the current directory) and returns the path and row count.

NameTypeReqDescription
save_to–––

No output schema declared.

No examples provided.

field_index ~110

Return {field_value: assetId} for every entity that has the named custom field — a one-pass index for DEDUPE before a bulk import (q does not index custom fields, so this scans every entity). `field_name` defaults to $HOMEBOX_ALIAS_FIELD. assetId may be empty for un-asset'd rows. Deliberately uncapped: a truncated dedupe index causes duplicates, so expect a large result on a large inventory.

NameTypeReqDescription
field_name–––

No output schema declared.

No examples provided.

finalize_photos ~60

Finalize after a bulk photo attach: ensure every entity with photos has a primary image, then generate any missing thumbnails. (Wraps the set-primary-photos and create-missing-thumbnails actions, which are always run as a pair.)

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

generate_label ~133

Save a printable Homebox label PNG (QR + readable name) for a location or item, e.g. to stick on a tote/bin. `kind` is "location", "item", or "asset". For location/item, `identifier` is a name or slug (resolved to an id); for asset it's the assetId (e.g. 000-028). Saves to `out_dir` (default: $HOMEBOX_LABEL_DIR, else the current directory). Returns the saved file path.

NameTypeReqDescription
identifierstringyes–
kindstring––
out_dir–––

No output schema declared.

No examples provided.

get_attachment ~88

Download one attachment (see list_attachments for ids) to a local path, so its content — e.g. an attached manual or receipt — can be read. `save_to` is a directory (keeps a name based on the title) or a full file path.

NameTypeReqDescription
attachment_idstringyes–
identifierstringyes–
save_tostringyes–

No output schema declared.

No examples provided.

get_item ~71

Get full detail for one item by assetId (e.g. 000-028), alias custom field, or name (fuzzy fallback: first keyword match). Includes location path, serial, model, purchase, warranty, custom fields, tags, and attachments.

NameTypeReqDescription
identifierstringyes–

No output schema declared.

No examples provided.

import_csv ~185

Bulk-create items and locations from a Homebox CSV (multipart import). This is the bulk creator for the photo-intake pipeline — one request imports everything, avoiding ~4 API calls per item. Recognized columns: HB.name, HB.location (path e.g. "Garage/Loft" — AUTO-CREATES the hierarchy), HB.tags (must already exist; see list_tags), HB.quantity, HB.serial_number, HB.model_number, HB.manufacturer, HB.notes, HB.purchase_price, HB.purchase_from, HB.purchase_time, HB.warranty_expires, HB.field.<name> (custom fields). A location-only row (HB.location set, contents described elsewhere) creates just the location. After import, call finalize_photos if you attached photos. Returns the count of data rows submitted.

NameTypeReqDescription
csv_textstringyes–

No output schema declared.

No examples provided.

inventory_stats ~107

Inventory statistics — the cheap way to answer "what's my inventory worth?" without scanning items. `by` is: totals — counts (items/locations/tags/users), total purchase price, items with warranty; locations — total value per location; tags — total value per tag; purchase-price — value over time (optional YYYY-MM-DD start/end).

NameTypeReqDescription
bystring––
end–––
start–––

No output schema declared.

No examples provided.

list_attachments ~61

List an item's (or location's) attachments with their ids — the handle needed by get_attachment / rename_attachment / delete_attachment. `identifier` is assetId / alias field / name, or a location name/path.

NameTypeReqDescription
identifierstringyes–
NameTypeReqDescription
resultarrayyes–

No examples provided.

list_custom_fields ~80

Discover the custom-field schema actually in use: with no arg, all custom-field NAMES across the inventory; with `field`, the distinct VALUES of that field ({"total", "values"}, capped at `limit`). Useful before set_fields/field_index on an unfamiliar instance.

NameTypeReqDescription
field–––
limitinteger––

No output schema declared.

No examples provided.

list_locations ~19

Return the full location tree as an indented outline.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes–

No examples provided.

list_maintenance ~73

List maintenance entries — for one item (assetId / alias field / name) or, with no identifier, across the whole inventory ("what maintenance is due?"). `status` is "scheduled" (upcoming), "completed", or "both".

NameTypeReqDescription
identifier–––
statusstring––
NameTypeReqDescription
resultarrayyes–

No examples provided.

list_tags ~65

List all tag (label) names. Set `detail=True` to instead return full tag objects (name, description, color, icon, parent tag name) for auditing tag setup — pair with set_tag to edit any of these.

NameTypeReqDescription
detailboolean––

No output schema declared.

No examples provided.

location_contents ~151

List what is in a location (e.g. a tote or shelf), by location name. Returns the items directly in that location plus any sub-locations (their names only — not their contents). Set `recursive=True` to instead walk the whole subtree and return every item nested under it, each tagged with its full location path; use this when a location (e.g. Garage, Basement) has sub-locations you also want the contents of, to avoid querying each one by hand. `location` is a name or /-separated path (for duplicate names).

NameTypeReqDescription
locationstringyes–
max_itemsinteger––
recursiveboolean––

No output schema declared.

No examples provided.

log_maintenance ~115

Add a maintenance-log entry to an item (assetId / alias field / exact name) — e.g. "changed the mower oil today" (completed_date) or "sharpen blades in spring" (scheduled_date). Dates are YYYY-MM-DD; `cost` is a number. Returns the new entry's id.

NameTypeReqDescription
completed_date–––
cost–––
description–––
identifierstringyes–
namestringyes–
scheduled_date–––

No output schema declared.

No examples provided.

mark_sold ~124

Record that an item was sold (assetId / alias field / exact name): price, buyer, YYYY-MM-DD date, notes — only the args you pass are set. `clear=True` instead erases all four sold fields (un-sells the item). Other fields are preserved. Pair with set_item(archived=True) if the item should also leave active inventory.

NameTypeReqDescription
clearboolean––
identifierstringyes–
sold_date–––
sold_notes–––
sold_price–––
sold_to–––

No output schema declared.

No examples provided.

move_item ~158

Move an item into a location or into another item (assetId / alias field / exact name). `location` is the destination's name or /-separated path — a location (see list_locations) or a container item, e.g. a lens into 'Camera Bag' or 'Office/Camera Bag' — or a container item's assetId ('000-012'). A location wins over an item with the same name; reach the item with a longer path or its assetId. A name that matches more than one location, or more than one item, is refused. Uses a partial PATCH, so nothing else on the item changes.

NameTypeReqDescription
identifierstringyes–
locationstringyes–

No output schema declared.

No examples provided.

qrcode ~79

Save a raw QR-code JPEG encoding arbitrary `data` (e.g. a deep link). For tote labels prefer generate_label (adds the readable name). Saves to `out_dir` (default: $HOMEBOX_LABEL_DIR, else the current directory). Returns the saved file path.

NameTypeReqDescription
datastringyes–
out_dir–––

No output schema declared.

No examples provided.

rename_attachment ~85

Update an attachment's title, type (manual/attachment/warranty/receipt/ photo), or primary flag (see list_attachments for ids). Only the args you pass change; the rest is re-sent as-is.

NameTypeReqDescription
attachment_idstringyes–
doc_type–––
identifierstringyes–
primary–––
title–––

No output schema declared.

No examples provided.

search_items ~96

Search inventory items by name/keyword and/or by tag names (AND of both when both given — e.g. everything tagged "power-tool"). Returns items (not locations) with their immediate location, assetId, and the alias custom field (if $HOMEBOX_ALIAS_FIELD is configured). Use get_item for full detail on one result.

NameTypeReqDescription
limitinteger––
query–––
tags–––
NameTypeReqDescription
resultarrayyes–

No examples provided.

set_fields ~108

Create or update custom fields on an existing item (assetId / alias field / exact name). `fields` maps custom-field name -> value; each value's JSON type picks the field type (string -> text, number -> number [integer-coerced — the API 500s on float number values], true/false -> boolean). Upsert semantics: named fields are created or overwritten; other fields are preserved.

NameTypeReqDescription
fieldsobjectyes–
identifierstringyes–

No output schema declared.

No examples provided.

set_identity ~90

Set manufacturer/model/serial on an existing item (assetId / alias field / exact name). Only the args you pass change; other fields are preserved. Use when a nameplate/label photo reveals a serial number or a model-number correction after the item was created.

NameTypeReqDescription
identifierstringyes–
manufacturer–––
model_number–––
serial_number–––

No output schema declared.

No examples provided.

set_item ~196

General item editor (assetId / alias field / exact name): rename, edit description/notes/quantity, purchase info, insured/archived flags, and custom fields in one call. Only the args you pass are changed. Quantity-only changes go via a partial PATCH; anything else uses a full-body PUT that preserves the rest of the item (the 0.26 PUT-clears gotcha). `fields` maps custom-field name -> value, typed by JSON type (see set_fields). To move an item use move_item; for warranty/identity/tags see set_warranty/set_identity/set_tags.

NameTypeReqDescription
archived–––
description–––
fields–––
identifierstringyes–
insured–––
new_name–––
notes–––
purchase_date–––
purchase_from–––
purchase_price–––
quantity–––

No output schema declared.

No examples provided.

set_location ~181

Edit a LOCATION's metadata (find it by current name or /-path): rename, `description` (e.g. a contents manifest), notes, tags, custom fields (values typed by JSON type). Only the args you pass change; other fields are preserved. `parent` moves it under another location; `clear_parent=True` moves it to the root. `entity_type` (e.g. "Item") converts a mis-created entity — rare. `asset_id` overrides the auto-assigned assetId.

NameTypeReqDescription
asset_id–––
clear_parentboolean––
description–––
entity_type–––
fields–––
locationstringyes–
new_name–––
notes–––
parent–––
tags–––
tags_modestring––

No output schema declared.

No examples provided.

set_maintenance ~99

Edit a maintenance entry (see list_maintenance for ids) — e.g. mark a scheduled entry completed by setting completed_date. Only the args you pass change; the rest of the entry is re-sent as-is (the update is a full PUT).

NameTypeReqDescription
completed_date–––
cost–––
description–––
entry_idstringyes–
name–––
scheduled_date–––

No output schema declared.

No examples provided.

set_tag ~169

Create or edit a tag's own metadata — NOT what's tagged on an item (see set_tags for that). Matches `name` case-insensitively against list_tags; creates the tag if it doesn't exist yet. Only the args you pass are changed. `parent` nests this tag under another (existing) tag name, for grouping related tags in the Homebox UI (e.g. several condition-* tags under a "condition" parent); pass `clear_parent=True` to un-nest it. Use list_tags(detail=True) to see current tag metadata first.

NameTypeReqDescription
clear_parentboolean––
color–––
description–––
icon–––
namestringyes–
new_name–––
parent–––

No output schema declared.

No examples provided.

set_tags ~133

Add, remove, or replace tags on an existing item (assetId / alias field / exact name). `mode` is "add" (default — merges with the item's existing tags), "remove" (drops just the named tags, keeps the rest), or "replace" (item ends up with exactly these tags, nothing else). Tag names are matched case-insensitively against list_tags and auto-created if they don't exist yet. Everything else on the item is untouched (partial PATCH).

NameTypeReqDescription
identifierstringyes–
modestring––
tagsarrayyes–

No output schema declared.

No examples provided.

set_warranty ~107

Set warranty info on an existing item (assetId / alias field / exact name). `expires` is a YYYY-MM-DD date (warranty end), `lifetime` flags a lifetime warranty, `details` is a short terms summary (e.g. "limited lifetime, test/measurement instruments excluded"). Only the args you pass change; other fields are preserved.

NameTypeReqDescription
details–––
expires–––
identifierstringyes–
lifetime–––

No output schema declared.

No examples provided.

warranties_expiring ~130

List items whose warranty expires in a date window, or items with a lifetime warranty. `before`/`after` are ISO dates (YYYY-MM-DD): returns items with after <= warrantyExpires <= before. `after` defaults to TODAY, so already-expired warranties are excluded unless you pass an earlier `after`. Set `lifetime=True` to instead list items flagged as lifetime warranty (`before`/`after` ignored). Useful for "which warranties expire this year".

NameTypeReqDescription
after–––
before–––
lifetimeboolean––
NameTypeReqDescription
resultarrayyes–

No examples provided.

Install

How do I install the io.github.dgahagan/homebox-mcp server?

io.github.dgahagan/homebox-mcp runs locally as a PyPI package, launched with uvx homebox-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · homebox-mcp

# add to Claude Code
claude mcp add dgahagan-homebox-mcp -- uvx homebox-mcp
Common questions

What is the io.github.dgahagan/homebox-mcp server?

io.github.dgahagan/homebox-mcp is listed in the public MCP registry as io.github.dgahagan/homebox-mcp. Homebox home inventory: search, intake, warranties, attachments, locations, tags, QR labels. This page covers its PyPI package (homebox-mcp).

Is the io.github.dgahagan/homebox-mcp server safe to use?

io.github.dgahagan/homebox-mcp scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.dgahagan/homebox-mcp server expose?

io.github.dgahagan/homebox-mcp exposes 39 tools: search_items, get_item, list_locations, location_contents, list_tags, and 34 more. Their descriptions and schemas cost roughly 4,111 tokens of context every time the server is loaded.

Is the io.github.dgahagan/homebox-mcp server still maintained?

io.github.dgahagan/homebox-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.dgahagan/homebox-mcp server under?

io.github.dgahagan/homebox-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

What did VerifyMCP test on the io.github.dgahagan/homebox-mcp server?

VerifyMCP ran 16 checks on io.github.dgahagan/homebox-mcp, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to a PyPI package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.