Letting an agent run Home Assistant, one approval at a time

Who this coverage is for

People who point a coding agent (Claude Code, Cursor, VS Code, Codex CLI) at their own Home Assistant through the home-assistant-mcp server. It runs directly with a long-lived token, or brokered through Vome with a scoped key. Either way the agent can do a lot: read state and history, write automations, edit configuration.yaml, install HACS repositories and flash ESPHome firmware.

That reach is the point, and also the risk. A Home Assistant token can do whatever its user can, and the server's write flags are fixed when it starts. Guard adds a check at the moment of each call.

What Guard checks before a tool runs

The coverage entry lists 57 tool entries across 11 risk classes. The source marks 56 tools as review and the other entry as inherit. When an agent calls a tool marked for review, Guard stops and asks you first.

Read tools such as ha_get_state, ha_get_history and ha_get_system_log are not in that list, so diagnosis runs without prompts. The extension is external and opt-in: nothing changes until you turn it on.

Where the limits are

• Guard sees calls made through this server. Changes made in Home Assistant's own UI, or by its automations, never pass through it.

• In brokered mode the Vome key's scopes are the hard limit. Approving a call in Guard never widens them, so issue a key without write scopes when the agent only needs to read.

• Domain fences (HA_DENY_DOMAINS, HA_ALLOW_DOMAINS) are set when the server starts and apply to ha_call_service.

• Coverage is limited to the reviewed operations and the surrounding Guard policy. It is not a security certification.

How to evaluate it

1. Read the coverage entry end to end, and the server's safety section.

1. Point the server at a test Home Assistant, not your house. npx -y @vortitron/home-assistant-mcp doctor checks that it can connect.

1. Turn the extension on and ask the agent to list your automations. That is a read, so nothing should prompt.

1. Allow writes and ask it to toggle one light. Guard should stop ha_call_service and ask before it runs.

How it got here

The contribution was merged on 7 October 2026 in hol-guard#3420. It was written by Andy Lyeklint Hancock, who builds Vome, working with Claude Code: the same kind of agent this coverage is meant to keep in check.