Home Assistant MCP HTTP: why it is not safe to use
We did not find hidden malware-like behavior, but this skill exposes broad Home Assistant control over HTTP, so use it only with tightly scoped access.
What we found
Our review of `ganhammar/hass-mcp-server` did not find hidden instructions, hardcoded secrets, obfuscated code, undisclosed third-party data destinations, privilege escalation behavior, or runtime remote code download in the inspected files. Authentication appears to rely on Home Assistant OAuth or a user-created Long-Lived Access Token.
The reason for a warning is scope and exposure, not a specific malicious finding. The skill is designed to expose a user’s Home Assistant instance over HTTP to the connected client. The documented interface includes broad read, write, and delete actions against the Home Assistant account it is connected to. The README also shows potentially destructive operations, although the examples include explicit safeguards such as confirmation requirements for restart and `confirm=true` for `clear_statistics`.
What to do instead
Use this skill only if you intend to give an AI client broad control over a Home Assistant instance. Prefer a dedicated Home Assistant account or token with the narrowest permissions you can use, avoid connecting it to sensitive or production-critical devices, and keep the HTTP endpoint limited to trusted clients and networks. Review the exposed actions before enabling write or delete workflows.
Source: https://github.com/ganhammar/hass-mcp-server
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.