ha-mcp (Home Assistant MCP Server): license, data flow and telemetry
Yes for a home or a lab, with Read Only Mode and secret redaction switched on first. The license is plain MIT and the privacy file says there is no telemetry today. Out of the box it hands the AI client dozens of tools that can change or delete Home Assistant configuration, returns stored secrets verbatim, and sends everything a tool returns to whichever AI provider sits behind your client.
Our take for small teams
ha-mcp is a well documented project, and its main risk is what it can do rather than where your data goes. By default it offers the AI client about 77 tools, 45 of them marked destructive, and it returns stored secrets verbatim, so use a dedicated administrator account, turn on Read Only Mode for any client that only needs to look, and switch on secret redaction. The server itself reports nothing to its author: PRIVACY.md says no telemetry today, and the one outbound call we saw was a version check to pypi.org that you can disable, although PRIVACY.md does not list it. Remember that every entity state, log and camera snapshot a tool returns goes to the AI provider behind your client, which is your decision and not ha-mcp's. The license is plain MIT, so there is nothing to untangle for commercial use.
Code license
MIT License
Commercial use
Yes
Your content leaves by default
Partly
Telemetry
None documented
Model weights
No weights shipped
Last checked
November 11, 2026
Picked from GitHub Trending (daily) on November 9, 2026, with 6,708 stars on November 11, 2026. Repository: homeassistant-ai/ha-mcp.
ha-mcp (the repository is homeassistant-ai/ha-mcp, a community project) is a Python MCP server for Home Assistant. You point an MCP client such as Claude, ChatGPT or Codex at it, and the model can search entities, read history and logs, fetch camera snapshots, edit automations, scripts, helpers and dashboards, call services, manage backups and, with optional flags, edit YAML and files. It runs three ways: inside Home Assistant as a custom integration, as a Home Assistant app (add-on), or as a separate process through uvx, pip or Docker.
What decides the risk is the tool list and the account behind it. The server acts with an administrator token, so whatever the model asks for runs with administrator rights, and the project's own threat model says MCP clients are trusted principals.
The numbers
GitHub numbers fetched Nov 11, 2026, 02:20 UTC from the GitHub API.
Stars
6,708
Forks
432
Open issues and pull requests
17
Main language
Python
Repository created
September 14, 2025
Last push
November 11, 2026
Last commit on the default branch
November 11, 2026
Latest stable release
v9.1.2, November 8, 2026
Archived
No
License
Code license
MIT License (GitHub reports MIT)
Commercial use of the code
Yes
Model weights license
No weights shipped
LICENSE file read on
November 11, 2026
LICENSE read on 11 November 2026 at commit fabdea6: the MIT License text, copyright 2024 Julien. pyproject.toml declares license MIT and PyPI shows MIT for 9.1.2. Open the LICENSE file. This is our reading of the file on that date, not legal advice.
The LICENSE file is the standard MIT License. It allows use, copying, modification, merging, publishing, distribution, sublicensing and sale, with the copyright and permission notice kept, and gives no warranty. The GitHub API reports MIT, and the published PyPI package ha-mcp 9.1.2 declares MIT too. [1][2][3]
The repository vendors fastmcp, the Anthropic mcp and mcp_types packages and a websockets copy under src/ha_mcp/_vendor, and each folder carries its own LICENSE file. fastmcp's file is the Apache License 2.0, the mcp file is MIT and the websockets file is BSD-3-Clause, so the whole distribution is permissive but not one license. [5][6][4]
What you have to do
Keep the copyright notice and the MIT permission notice in copies or substantial portions.
The vendored libraries under src/ha_mcp/_vendor keep their own licenses: fastmcp is Apache-2.0, mcp and mcp_types are MIT, and websockets is BSD-3-Clause. Carry their notices if you redistribute the code.
Model weights
ha-mcp ships no model weights and runs no model. The model belongs to whichever MCP client you connect, so that provider's terms govern what the model does with the Home Assistant data it is shown. [8][9]
SECURITY.md treats the MCP client as a trusted principal and says prompt injection is the client's responsibility, so the model behind your client is part of your trust boundary, not something ha-mcp contains. [10][9]
Where your data goes
The server runs on your side and calls your own Home Assistant. In our sandbox run it contacted nothing else except pypi.org for a version check. What leaves your network is what you ask the model about: tool results go to your MCP client and its AI provider.
Runs on your own machine or server
Yes
Your content leaves it by default
Partly
ha-mcp runs on your machine or inside Home Assistant and talks to your Home Assistant by REST and WebSocket with an access token. In our sandbox run against a fake Home Assistant, with the update check disabled, every connection the server made was to loopback. [8][9]
Everything a tool returns goes to your MCP client and so to the AI provider behind it. The README tool table includes history, logs, automation traces, entity registry data and camera snapshots, and PRIVACY.md says ha-mcp does not store or transmit that data itself, because the client does. [8][9]
The server acts as an administrator. The README tells you to either create a long-lived token on your own account, which works from anywhere if it leaks and makes every change appear under your name, or, safer, a separate administrator account with Local access only. The app (add-on) uses a Supervisor token instead. [8][10]
In the standard HTTP mode the secret URL is the credential: SECURITY.md says any peer that can reach the configured path is treated as trusted. The HTTP entrypoints bind 0.0.0.0 by default and the default path is /mcp, and the code warns when a default path is reachable from a non-loopback address. The in-process integration, by contrast, defaults to this machine only (127.0.0.1) for new installs. [10][15][11]
Default settings are permissive for a tool with administrator rights. Read Only Mode, secret redaction, tool security policies, file tools and YAML editing are all off by default, and automatic backups of edited entities are on. The README advertises 87 tools, while the real ha-mcp 9.1.2 we ran listed 77 tools by default, 32 flagged read-only and 45 flagged destructive, including ha_call_service, ha_bulk_control, ha_manage_backup and the ha_config_set and ha_config_remove tools. [12][8]
Read Only Mode hides write tools and blocks write calls, either as a server setting or per connection by appending /readonly to the URL. In our run READ_ONLY_MODE=1 cut the list from 77 to 40 tools and removed ha_call_service, while mixed tools such as ha_manage_backup and ha_manage_app stayed listed; the code blocks their write actions at call time, which we did not exercise. [8][13]
With redact_secrets off (the default) the secret redaction paths are a passthrough, so add-on options, integration options and similar surfaces return stored secrets verbatim to the model. Turning it on redacts password-format fields and listed option names. [12][14]
python_transform, the sandbox used for automation and script transforms, is described in the code and in SECURITY.md as not a security boundary. [10][17]
ha_report_issue builds a bug report draft and instructions for filing it on GitHub, and the file contains no HTTP client, so the tool itself sends nothing. README and PRIVACY.md say bug reports are sent only with your explicit approval. [18][9]
Telemetry
None documented No telemetry today, according to README and PRIVACY.md, which describe usage statistics as a planned feature that will follow your Home Assistant analytics setting. The server does make a version check to pypi.org that PRIVACY.md does not list, and you can turn it off.
README and PRIVACY.md state that ha-mcp collects no telemetry today. Anonymous usage statistics are a planned feature (as of June 2026) that will follow the Home Assistant analytics setting and be announced at least one month beforehand. We found no analytics, Sentry or similar client in the project's own code outside the vendored libraries. [9][8]
On start the server checks for a newer release: it requests https://pypi.org/pypi/ha-mcp/json for pip, uvx, Docker and stdio installs, or asks the Supervisor for the app. The HA_MCP_DISABLE_UPDATE_CHECK environment variable turns it off. In our run, strace showed connects to the four addresses pypi.org resolves to on port 443 by default, and none with the variable set. PRIVACY.md does not list this request among the services ha-mcp communicates with. [16][15]
The vendored fastmcp includes OpenTelemetry tracing hooks. pyproject.toml depends on opentelemetry-api only, not an SDK or an exporter, so these hooks send nothing unless you install and configure an exporter yourself. [4][7]
Before you use it at work
Create a separate administrator account for HA-MCP with Local access only, rather than a long-lived token from your own login, and rotate the token if a client config is shared.
Turn on Read Only Mode (README: setting, or add /readonly to the connection URL) for any client that only needs to look. Refresh the client's tool list afterwards, because clients cache it.
Switch on secret redaction. It is off by default, and without it add-on and integration options come back verbatim to whichever AI provider you use.
Treat the connection URL as a password: use a long random MCP_SECRET_PATH, set MCP_HOST=127.0.0.1 if the client is on the same machine, and use the OAuth or OIDC entrypoint behind TLS instead of exposing the secret URL to the internet.
Leave the file tools, YAML editing and tool-search proxies off unless you need them, and consider the tool security policies for approval on destructive calls.
Set HA_MCP_DISABLE_UPDATE_CHECK=1 if the host must not call pypi.org. Check the Home Assistant data you are comfortable sending to a hosted model first: logs, history and camera snapshots all pass through the client.
Checked Read on 11 November 2026 at commit fabdea6 (default branch master): the LICENSE file, pyproject.toml, README, PRIVACY.md, SECURITY.md, the in-process server doc, and the config, read-only, redaction, update-check and bug-report code. We also installed ha-mcp 9.1.2 from PyPI in a sandbox and ran it over stdio against a fake Home Assistant on localhost, with strace recording network connects, once with defaults and once with READ_ONLY_MODE=1 and HA_MCP_DISABLE_UPDATE_CHECK=1. That run gave the tool counts and the outbound connections quoted here. Not checked: a real Home Assistant, the in-process integration, the add-on, OAuth and OIDC modes, the file and YAML tools, and calling any write tool in read-only mode.
Sources
Every statement above carries the numbers of the rows that back it. Why this project: On GitHub Trending on 9 November 2026 in the daily list (31 stars gained that day), and had 6,708 stars on November 11, 2026. It is a tool that gives an AI client administrator access to a smart home, so a small team or a home lab user needs to know the defaults before connecting it. We found no search demand for it in our own Search Console data, so this page rests on the trending signal and the risk, not on queries.