{"name":"io.github.homeassistant-ai/ha-mcp","slug":"homeassistant-ai-ha-mcp","title":null,"description":"Comprehensive Model Context Protocol server for managing Home Assistant through AI assistants.","url":"https://mcp.market/server/homeassistant-ai-ha-mcp","rating":null,"grade":"C","score":55,"certified":false,"status":"active","category":"ai","tags":["ai"],"presence":{"score":74,"stars":4785,"forks":214,"downloads_week":67142,"last_push_at":"2026-09-19T09:50:52.000Z","license":"MIT"},"claimed":false,"transport":"mixed","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/homeassistant-ai/ha-mcp.git","website":null,"version":"8.5.0","remotes":[],"packages":[{"registryType":"pypi","identifier":"ha-mcp","version":"8.5.0","transport":{"type":"stdio"}},{"registryType":"oci","identifier":"ghcr.io/homeassistant-ai/ha-mcp:8.5.0","transport":{"type":"stdio"}}],"tools":[],"scan":{"score":55,"grade":"C","scanned_at":"2026-09-19T09:59:00.020Z","report":{"scannerVersion":"0.1.3","scannedAt":"2026-09-19T09:58:59.972Z","components":{"code":{"score":0,"max":25,"notes":["659 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":9,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"env.dump","severity":"high","component":"code","title":"Whole environment serialized (possible credential exfil)","evidence":"ha_mcp-8.5.0/src/ha_mcp/_vendor/fastmcp/client/transports/stdio.py: …or project_directory: env = os.environ.copy() if project_directory: …"},{"id":"net.raw-ip","severity":"medium","component":"code","title":"Network call to a raw IP address","evidence":"ha_mcp-8.5.0/src/ha_mcp/_vendor/fastmcp/server/auth/redirect_validation.py: …1` would let a web client register `https://127.0.0.2/callback` and slip past the non-loop…"},{"id":"install.curl-pipe","severity":"high","component":"code","title":"curl | sh in a script","evidence":"ha_mcp-8.5.0/src/ha_mcp/_vendor/fastmcp/utilities/mcp_server_config/v1/environments/uv.py: …ase install it with: \" \"curl -LsSf https://astral.sh/uv/install.sh | sh\" ) if not self._mu…"},{"id":"exec.shell-true","severity":"medium","component":"code","title":"subprocess with shell=True","evidence":"ha_mcp-8.5.0/src/ha_mcp/_vendor/mcp/cli/cli.py: …ion\"], check=True, capture_output=True, shell=True) return cmd …"}],"inputs":{"packages":[{"registryType":"pypi","identifier":"ha-mcp","version":"8.5.0","found":true,"weeklyDownloads":67142,"license":"MIT","dependencyCount":37,"publishedAt":"2026-09-16T14:39:41.645624Z","repositoryUrl":"https://github.com/homeassistant-ai/ha-mcp"}],"repo":{"found":true,"owner":"homeassistant-ai","repo":"ha-mcp","archived":false,"pushedAt":"2026-09-19T09:50:52Z","stars":4785,"forks":214,"openIssues":17,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/232192432?v=4","ownerCreatedAt":"2025-09-14T12:03:16Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/232192432?v=4&s=128","source":"github"},"presence":{"stars":4785,"forks":214,"downloadsWeek":67142,"license":"MIT","lastPushAt":"2026-09-19T09:50:52.000Z","score":74}}}},"grade_history":[],"reviews":[]}