Back to MCP Trust Indexm8ven
37
/ 100
1 month ago
mcp_so

Home Assistant Model Context Protocol (MCP)

An advanced MCP server for Home Assistant. 🔋 Batteries included.

→ jango-blockchained/advanced-homeassistant-mcp· listed on mcp_so
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

mcp.so

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 6 credentials: ANTHROPIC_API_KEY, COOKIE_SECRET, HASS_TOKEN, JWT_SECRET, OPENAI_API_KEY, TEST_HASS_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highesbuild@0.25.12GHSA-gv7w-rqvm-qjhr

esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

lowyaml@2.8.2GHSA-48c2-rrv3-qjmp

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretANTHROPIC_API_KEY
configCONSOLE_LOGGING
configCOOKIE_HTTP_ONLY
configCOOKIE_SAME_SITE
🔐 secretCOOKIE_SECRET
configCOOKIE_SECURE
configCORS_ALLOWED_HEADERS
configCORS_CREDENTIALS
configCORS_EXPOSED_HEADERS
configCORS_MAX_AGE
configCORS_METHODS
configCORS_ORIGINS
configCSP_ENABLED
configCSP_REPORT_ONLY
configCSP_REPORT_URI
configCURSOR_CHANNEL
configCURSOR_COMPATIBLE
configCURSOR_SESSION
configENABLE_SPEECH_FEATURES
configENABLE_SPEECH_TO_TEXT
configENABLE_WAKE_WORD
configEXECUTION_TIMEOUT
configFASTMCP_STATELESS
configHASS_HOST— "": "http://your-ha-instance:8123",
configHASS_SOCKET_URL
🔐 secretHASS_TOKEN— "": "your_long_lived_access_token"
configHASS_WS_URL
configHOST
configHSTS_INCLUDE_SUBDOMAINS
configHSTS_MAX_AGE
configHSTS_PRELOAD
configJWT_ALGORITHM
configJWT_EXPIRY
configJWT_MAX_AGE
🔐 secretJWT_SECRET— ... # for HTTP/WS auth (min 32 chars)
configLOCKOUT_DURATION
configLOG_COMPRESS
configLOG_DIR
configLOG_LEVEL— info # debug info warn error
configLOG_MAX_DAYS
configLOG_MAX_SIZE
configLOG_REQUESTS
configMAX_FAILED_ATTEMPTS
configMAX_REQUEST_FIELDS
configMAX_REQUEST_SIZE
configMOCK_RESPONSES_DIR
configMOCK_SERVICES
🔐 secretOPENAI_API_KEY
configPORT— 7123 # HTTP server port (default: 4000)
configPROCESSOR_TYPE
configRATE_LIMIT_MAX_REQUESTS
configRATE_LIMIT_REGULAR
configRATE_LIMIT_WEBSOCKET
configRATE_LIMIT_WINDOW
configREQUIRE_HTTPS
configSILENT_MCP_RUNNING
configSMITHERY_SCAN
configSMITHERY_STATELESS
configTEST_HASS_HOST
configTEST_HASS_SOCKET_URL
🔐 secretTEST_HASS_TOKEN
configTEST_PORT
configTOKEN_MIN_LENGTH
configUSE_HTTP_TRANSPORT
configUSE_STDIO_TRANSPORT
configWHISPER_HOST
configWHISPER_PORT
configWYOMING_HOST
configWYOMING_PORT
configWHISPER_MODEL_PATH
configWHISPER_MODEL_TYPE
configASR_MODEL
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/jango-blockchained-advanced-homeassistant-mcp-ycnabj)](https://m8ven.ai/mcp/jango-blockchained-advanced-homeassistant-mcp-ycnabj)
commit: b1aa766ab6c78318af8214449d1864ae9032c80d
code hash: 9832fd8abba481370889684a78c5f0fd809f3a59c89dbe654edfa77c207fdf9e
verified: 6/16/2026, 12:20:13 PM
view raw JSON →