Home Assistant

Home Assistant

This connector reads one Home Assistant instance through its REST API: the current state of every entity (sensors, lights, climate, doors, presence), the recorded history, the logbook and calendars, plus the instance configuration. It is read-only: every tool is a GET request. It cannot call actions (services), turn anything on or off, unlock doors, run scripts or change states. Note that Home Assistant's own action endpoint is not admin-only, so the read-only guarantee comes from this connector exposing only GET requests, not from the token.

Setup (about 3 minutes)

1. Set HOME_ASSISTANT_URL to the address you open Home Assistant at, without a trailing slash and without /api, for example https://home.example.com or http://192.168.1.10:8123 (the default port is 8123).
2. Recommended: create a dedicated, non-admin Home Assistant user for AnythingMCP (Settings, People, Users, Add user, with Administrator switched off). None of the endpoints used here needs admin rights.
3. Log in as that user, open your profile (click your name at the bottom left), open the Security tab, and under Long-lived access tokens click Create token. Copy it (it is shown once; Home Assistant makes these tokens valid for 10 years) and paste it into HOME_ASSISTANT_TOKEN. It is sent as Authorization: Bearer <token>.
4. Check the setup with home_assistant_get_config.

Where Home Assistant runs

• Self-hosted AnythingMCP: Home Assistant usually lives on a private network (http://192.168.x.x:8123, homeassistant.local). The outbound SSRF guard blocks private and local addresses by default, so an administrator must allow the host through the SSRF_ALLOWED_HOSTS environment variable or the allowlist in the admin settings.
• AnythingMCP Cloud: Cloud can only reach a Home Assistant instance exposed on the public internet over HTTPS (for example behind a reverse proxy or Home Assistant Cloud remote access). A private IP or a local hostname is refused, and the allowlist cannot be changed on Cloud.

Privacy: home data reveals who is at home and daily routines. Assign this connector only to MCP servers whose users may see this household's data.

How to work

1. home_assistant_list_states for a compact list of every entity (entity_id, state, name, unit, last change); home_assistant_get_state for one entity with all its attributes.
2. History of values (e.g. overnight temperature): home_assistant_get_history with start_time and one or more filter_entity_id.
3. What happened and when (e.g. when the garage door last opened): home_assistant_get_logbook.
4. Calendars: home_assistant_list_calendars for the calendar entity ids, then home_assistant_get_calendar_events with start and end.

Times: send every timestamp as ISO 8601 in UTC with a Z suffix, e.g. 2026-10-01T00:00:00Z. An offset such as +02:00 puts a + into the path or query string, which is easy to get wrong; convert to UTC first. home_assistant_get_config returns the instance's time zone for presenting results.

Identifiers: entity ids look like domain.object_id, e.g. sensor.living_room_temperature, binary_sensor.garage_door, calendar.family.

Common errors

• 401: the token is wrong or was deleted.
• 404 on get_state or calendar events: no entity with that id; check home_assistant_list_states. 404 everywhere: HOME_ASSISTANT_URL is wrong or already ends in /api.
• 400 on calendar events: start or end missing or not a valid timestamp.
• Connection refused or blocked: on self-hosted, allow the host in the SSRF allowlist; on Cloud, the instance must be public over HTTPS.

Out of scope: calling actions/services, writing or deleting states, firing events, rendering templates, camera images, the event stream, the error log and the WebSocket API (areas, devices, entity registry).