grade C

11 days ago

mcp_so

Home Assistant Model Context Protocol (MCP)

An advanced MCP server for Home Assistant. 🔋 Batteries included.

→ jango-blockchained/advanced-homeassistant-mcp · listed on mcp_so

Install from

mcp.so

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Known vulnerabilities in dependencies: 4 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

⚠️

Tests do not pass

Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 9 credentials: ANTHROPIC_API_KEY, COOKIE_SECRET, HASS_TOKEN, JWT_SECRET, OPENAI_API_KEY, TEST_HASS_TOKEN, TEST_INVALID_TOKEN, TEST_JWT_SECRET, TEST_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretANTHROPIC_API_KEY

configCONSOLE_LOGGING

configCOOKIE_HTTP_ONLY

configCOOKIE_SAME_SITE

🔐 secretCOOKIE_SECRET

configCOOKIE_SECURE

configCORS_ALLOWED_HEADERS

configCORS_CREDENTIALS

configCORS_EXPOSED_HEADERS

configCORS_MAX_AGE

configCORS_METHODS

configCORS_ORIGIN

configCORS_ORIGINS

configCSP_ENABLED

configCSP_REPORT_ONLY

configCSP_REPORT_URI

configCURSOR_CHANNEL

configCURSOR_COMPATIBLE

configCURSOR_SESSION

configENABLE_SPEECH_FEATURES

configENABLE_SPEECH_TO_TEXT

configENABLE_WAKE_WORD

configEXECUTION_TIMEOUT

configFASTMCP_STATELESS

configHASS_HOST

configHASS_SOCKET_URL

🔐 secretHASS_TOKEN

configHASS_WS_URL

configHOST

configHSTS_INCLUDE_SUBDOMAINS

configHSTS_MAX_AGE

configHSTS_PRELOAD

configJWT_ALGORITHM

configJWT_EXPIRY

configJWT_MAX_AGE

🔐 secretJWT_SECRET

configLOCKOUT_DURATION

configLOG_COMPRESS

configLOG_DIR

configLOG_LEVEL

configLOG_MAX_DAYS

configLOG_MAX_SIZE

configLOG_REQUESTS

configMAX_FAILED_ATTEMPTS

configMAX_REQUEST_FIELDS

configMAX_REQUEST_SIZE

configMOCK_RESPONSES_DIR

configMOCK_SERVICES

🔐 secretOPENAI_API_KEY

configPORT

configPROCESSOR_TYPE

configRATE_LIMIT_MAX_AUTH_REQUESTS

configRATE_LIMIT_MAX_REQUESTS

configRATE_LIMIT_REGULAR

configRATE_LIMIT_WEBSOCKET

configRATE_LIMIT_WINDOW

configREQUIRE_HTTPS

configSILENT_MCP_RUNNING

configSILENT_STARTUP

configSMITHERY_SCAN

configSMITHERY_STATELESS

configSPEECH_ENABLED

configSTREAMING_ENABLED

configTEST_CLEANUP_INTERVAL

configTEST_CLIENT_IP

configTEST_HASS_HOST

configTEST_HASS_SOCKET_URL

🔐 secretTEST_HASS_TOKEN

configTEST_HOST

🔐 secretTEST_INVALID_TOKEN

🔐 secretTEST_JWT_SECRET

configTEST_MAX_CLIENTS

configTEST_MAX_CONNECTION_AGE

configTEST_PING_INTERVAL

configTEST_PORT

configTEST_RATE_LIMIT_MAX_REQUESTS

configTEST_RATE_LIMIT_WEBSOCKET

configTEST_RATE_LIMIT_WINDOW

🔐 secretTEST_TOKEN

configTEST_WEBSOCKET_PORT

configTOKEN_MIN_LENGTH

configUSE_HTTP_TRANSPORT

configUSE_STDIO_TRANSPORT

configWHISPER_HOST

configWHISPER_MODEL_PATH

configWHISPER_MODEL_TYPE

configWHISPER_PORT

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/jango-blockchained-advanced-homeassistant-mcp-ycnabj)](https://m8ven.ai/mcp/jango-blockchained-advanced-homeassistant-mcp-ycnabj)

commit: ad098384d24a3c09e41dd2bb0a0c3ab69c1f26f9

code hash: 6cd9751fb7033f88358839eb0e18596810ec5f54215e22be7367e8c3d37b38b4

verified: 4/10/2026, 5:55:37 PM

view raw JSON →