ha-mcp

Least-privilege permissions

• Create a dedicated Home Assistant user account for the MCP connector with access only to devices and automations you actually need it to control (e.g., lights and thermostats, but not door locks or security systems).
• Use short-lived tokens (temporary access credentials that expire after hours or days) instead of permanent ones; regenerate them regularly.
• Never grant admin-level access; restrict the connector to specific rooms, device types, or automations only.
• Document what each permission is for so you can audit whether the connector still needs it over time.

Network isolation

• Run the MCP connector on a separate, isolated device or network segment if possible—don't mix it with systems handling payment data or sensitive personal information.
• Use a firewall or VPN to restrict which systems can communicate with your Home Assistant instance; block direct internet access if the connector doesn't need it.
• Avoid storing Home Assistant credentials in plain text in config files; use encrypted credential storage or environment variables that your system administrator manages securely.

Monitoring

• Enable logging on all Home Assistant commands executed by the MCP connector; review logs weekly for unexpected device changes or access patterns.
• Set up alerts for unusual activity, such as commands executed at odd times or attempts to access devices outside the connector's permitted scope.
• Track which commands are actually used over a month—disable or revoke permissions for anything unused.

Red flags to watch for

• Sudden requests to expand permissions or add access to sensitive devices like locks, cameras, or security systems after deployment.
• Delays in security patches from the community project; monitor GitHub for unresolved vulnerability reports and consider alternatives if updates lag by weeks.
• Unexpected device state changes or automations running without your request, which may indicate prompt injection or unauthorized command execution.
• Vague or missing documentation about what the connector can and cannot do; avoid deploying it if the creator cannot clearly explain its security model.