--- title: "MCP Server (HTTP Transport)" description: "MCP Server (HTTP Transport) is a Marketplace integration for Home Assistant. It has 1.3k installs sharing analytics, works locally and was last updated October 25, 2026." canonical: "https://vulpo.app/integrations/marketplace/ganhammar-hass-mcp-server" url: "https://vulpo.app/integrations/marketplace/ganhammar-hass-mcp-server.md" last-updated: "2026-10-25" version: "1.4" --- # MCP Server (HTTP Transport) > MCP Server (HTTP Transport) is a Marketplace integration for Home Assistant. It has 1.3k installs sharing analytics, works locally and was last updated October 25, 2026. MCP Server (HTTP Transport) is a custom integration that runs an MCP server over HTTP so AI assistants such as Claude can work with Home Assistant. It supports OAuth 2.0 sign-in through a separate OIDC server integration, and Long-Lived Access Tokens can be enabled as an option for local or custom clients. The exposed tools cover entities, services, areas, devices, history and statistics, plus creating and editing automations, scenes, scripts, helpers and dashboards. It also offers automation and script traces, an error log, config validation and restart. Opt-in settings allow access to YAML config files with a backup before each change, camera images, image files and AppDaemon app files, each with a privacy note. A server name setting helps tell instances apart when one client connects to several Home Assistant installations, and setup is done in the UI. Automatic summary of the README and code of ganhammar/hass-mcp-server. Something wrong, or are you the maintainer and want your own text here? [Get in touch](https://vulpo.app/contact) [Open in My Home Assistant](https://my.home-assistant.io/redirect/hacs_repository/?owner=ganhammar&repository=hass-mcp-server&category=integration) On Home Assistant 2026.11 or newer? [Open it in the Marketplace](https://my.home-assistant.io/redirect/marketplace_repository/?owner=ganhammar&repository=hass-mcp-server&category=integration) ## Supports - **Works locally**: Talks to your devices on your own network. No vendor cloud in between. - **From the Marketplace**: Installed through the Marketplace, formerly HACS. - **Actively maintained**: Its author released or pushed a change in the last six months. ## Setting it up Install it from the Marketplace and restart Home Assistant, then add it under Settings, Devices and services. ### MCP Server (HTTP Transport) - **Enable native Home Assistant authentication**: Allow Long-Lived Access Tokens for authentication. When disabled, the OIDC Provider integration is required. - **Require administrator account**: Only Home Assistant users with administrator rights may use the MCP endpoint. This mirrors what Home Assistant itself requires for most of what the tools do: changing automations, scripts and scenes, calling admin-only services such as restart, rendering templates, and reading the error log. Disable this only if you understand that any non-admin user with a token then gets the same access. - **Enable config file access**: Allow AI assistants to list, read, write, and delete first-level YAML files in the config directory. secrets.yaml is always blocked. For entities with dedicated MCP tools, the raw YAML file is also blocked from direct edits: automations.yaml, scenes.yaml, and scripts.yaml must be modified through create\_automation / update\_automation (and the equivalents for scenes and scripts), which go through Home Assistant's storage layer and keep UI-managed entries consistent. The files are still included in backups so a restore never drops them. Every save and delete automatically creates a full backup first (stored in mcp\_backups/ in your config directory). Every save also runs a config validation automatically. Use batch\_edit\_config\_files when touching multiple files at once β€” it creates only one backup and runs one config check for the whole batch. Backups can be restored manually via the filesystem if Home Assistant fails to start. Before enabling: move all sensitive values (API keys, tokens, passwords) into secrets.yaml β€” any inline values in other YAML files will be readable by the AI. - **Enable camera image access**: Allow AI assistants to capture the current image from any camera entity (via the get\_camera\_image tool) and analyse what the camera sees. No snapshot file is written. Privacy note: when enabled, any camera in Home Assistant becomes viewable by the AI. - **Enable image file access**: Allow AI assistants to read image files (JPEG, PNG, GIF, WebP) from disk (via the get\_image\_file tool), for example camera snapshots saved by the camera.snapshot service. Access is limited to directories Home Assistant is allowed to use (the config directory and configured media dirs). Privacy note: any image stored in those directories becomes readable by the AI. - **Enable template rendering**: Allow AI assistants to evaluate arbitrary Jinja2 templates (via the render\_template tool). A template can read every state, attribute, device and area on the instance in one call, and can call template functions such as states, state\_attr, device\_attr and integration\_entities. This is why Home Assistant restricts its own template developer tool to administrators. Privacy note: when enabled, the AI can read anything a template can reach. - **Enable AppDaemon app file access**: Allow AI assistants to manage AppDaemon application files under the separately configured, bounded AppDaemon apps root. Enabling write access allows an AI/MCP client to modify executable AppDaemon Python code, granting code-execution-equivalent capability inside the AppDaemon environment and access available to AppDaemon. Paths outside the approved /share/, /media/, or legacy /addon\_configs/a0d7b954\_appdaemon/apps roots, .. traversal, and symlink escapes are rejected. Only .py, .yaml, .yml, and .json files can be created, written, or deleted. Every save/delete snapshots the app tree first in .mcp\_appdaemon\_backups/; restore takes a pre-restore snapshot. There is no direct MCP shell or AppDaemon process-control tool, but writing AppDaemon Python files remains code-execution-equivalent within the AppDaemon environment and its available Home Assistant API permissions. App files may contain credentials: keep sensitive values out of readable files before enabling. - **AppDaemon apps root**: Absolute AppDaemon apps root. Defaults to /addon\_configs/a0d7b954\_appdaemon/apps, which only exists where that add-on folder is mounted into Home Assistant Core (not on Home Assistant OS); otherwise use a folder under /share/ or /media/ and point AppDaemon's app\_dir at the same folder. - **MCP server name**: Name this server reports to MCP clients (serverInfo.name). Give each Home Assistant instance a different name when one client connects to more than one: some clients derive the namespace they show for a server's tools from this name, and then keep only one of the servers. Such clients may shorten the name first (VS Code keeps the first 13 characters), so keep names distinct early. ### After setup - **Enable native Home Assistant authentication**: Allow Long-Lived Access Tokens for authentication. When disabled, the OIDC Provider integration is required. - **Require administrator account**: Only Home Assistant users with administrator rights may use the MCP endpoint. This mirrors what Home Assistant itself requires for most of what the tools do: changing automations, scripts and scenes, calling admin-only services such as restart, rendering templates, and reading the error log. Disable this only if you understand that any non-admin user with a token then gets the same access. - **Enable config file access**: Allow AI assistants to list, read, write, and delete first-level YAML files in the config directory. secrets.yaml is always blocked. For entities with dedicated MCP tools, the raw YAML file is also blocked from direct edits: automations.yaml, scenes.yaml, and scripts.yaml must be modified through create\_automation / update\_automation (and the equivalents for scenes and scripts), which go through Home Assistant's storage layer and keep UI-managed entries consistent. The files are still included in backups so a restore never drops them. Every save and delete automatically creates a full backup first (stored in mcp\_backups/ in your config directory). Every save also runs a config validation automatically. Use batch\_edit\_config\_files when touching multiple files at once β€” it creates only one backup and runs one config check for the whole batch. Backups can be restored manually via the filesystem if Home Assistant fails to start. Before enabling: move all sensitive values (API keys, tokens, passwords) into secrets.yaml β€” any inline values in other YAML files will be readable by the AI. - **Enable camera image access**: Allow AI assistants to capture the current image from any camera entity (via the get\_camera\_image tool) and analyse what the camera sees. No snapshot file is written. Privacy note: when enabled, any camera in Home Assistant becomes viewable by the AI. - **Enable image file access**: Allow AI assistants to read image files (JPEG, PNG, GIF, WebP) from disk (via the get\_image\_file tool), for example camera snapshots saved by the camera.snapshot service. Access is limited to directories Home Assistant is allowed to use (the config directory and configured media dirs). Privacy note: any image stored in those directories becomes readable by the AI. - **Enable template rendering**: Allow AI assistants to evaluate arbitrary Jinja2 templates (via the render\_template tool). A template can read every state, attribute, device and area on the instance in one call, and can call template functions such as states, state\_attr, device\_attr and integration\_entities. This is why Home Assistant restricts its own template developer tool to administrators. Privacy note: when enabled, the AI can read anything a template can reach. - **Enable AppDaemon app file access**: Allow AI assistants to manage AppDaemon application files under the separately configured, bounded AppDaemon apps root. Enabling write access allows an AI/MCP client to modify executable AppDaemon Python code, granting code-execution-equivalent capability inside the AppDaemon environment and access available to AppDaemon. Paths outside the approved /share/, /media/, or legacy /addon\_configs/a0d7b954\_appdaemon/apps roots, .. traversal, and symlink escapes are rejected. Only .py, .yaml, .yml, and .json files can be created, written, or deleted. Every save/delete snapshots the app tree first in .mcp\_appdaemon\_backups/; restore takes a pre-restore snapshot. This does not provide shell or AppDaemon process control. App files may contain credentials: keep sensitive values out of readable files before enabling. - **AppDaemon apps root**: Absolute AppDaemon apps root. Defaults to /addon\_configs/a0d7b954\_appdaemon/apps, which only exists where that add-on folder is mounted into Home Assistant Core (not on Home Assistant OS); otherwise use a folder under /share/ or /media/ and point AppDaemon's app\_dir at the same folder. - **MCP server name**: Name this server reports to MCP clients (serverInfo.name). Give each Home Assistant instance a different name when one client connects to more than one: some clients derive the namespace they show for a server's tools from this name, and then keep only one of the servers. Such clients may shorten the name first (VS Code keeps the first 13 characters), so keep names distinct early. Texts from the code of [ganhammar/hass-mcp-server](https://github.com/ganhammar/hass-mcp-server). ## Troubleshooting - **Repair notices**: Notices it can show in Settings, Repairs: OIDC provider does not check the token audience ## From the README > A Home Assistant Custom Component that provides an MCP (Model Context Protocol) server using HTTP transport, allowing AI assistants like Claude to interact with your Home Assistant instance. > > Why HTTP transport with OAuth? This project was built primarily to support MCP Streamable HTTP transport, enabling web-based clients like Claude that require OIDC and OAuth 2.0 Dynamic Client Registration (RFC 7591). Since Home Assistant already has an official MCP integration that supports SSE transport, there wasn't a need to duplicate that. For local or custom client setups, Long-Lived Access Token authentication can be enabled as an alternative. > > - 🌐 HTTP transport (not SSE) - works remotely, not just locally > - πŸ” OAuth 2.0 authentication with Dynamic Client Registration (via hass-oidc-server) > - πŸ”‘ Long-Lived Access Token authentication (opt-in) for local and custom client setups > - 🏠 Full Home Assistant API access (entities, services, areas, devices, history, statistics) > - πŸ”§ Easy HACS installation > - πŸ“ CRUD management of automations, scenes, scripts, and helper entities (input\_boolean, counter, timer, schedule, and more) > - πŸ” Automation & script traces β€” inspect why a run fired, didn't fire, or took the wrong branch, step by step (read-only) > - πŸ“‹ Lovelace dashboard management (list, get/save/delete config, create/update/delete dashboards) with outline reads and JSON Patch edits so a single card can be changed without resending the whole… From the README of [ganhammar/hass-mcp-server](https://github.com/ganhammar/hass-mcp-server#readme), [MIT License](https://spdx.org/licenses/MIT.html). Shortened. ## At a glance - Kind: Marketplace integration - Category: [AI and voice](https://vulpo.app/integrations/category/ai-and-voice.md), AI models - Number: 1.3k installs sharing analytics; 83 GitHub stars - Connection: Works locally - Upkeep: Updated in the last 6 months - Needs: Needs the Marketplace (HACS on 2026.10 and older) - Latest version: v2.0.1, last updated October 25, 2026 - Domain: `mcp_server_http_transport` - Source: - Issues: Independent directory, made by the developer of Vulpo. Not affiliated with Home Assistant or the Open Home Foundation. [About these numbers](https://vulpo.app/integrations/about) Last updated 2026-10-25. Source: https://vulpo.app/integrations/marketplace/ganhammar-hass-mcp-server --- - HTML version of this page: https://vulpo.app/integrations/marketplace/ganhammar-hass-mcp-server - Site index for agents: https://vulpo.app/llms.txt - Everything in one document: https://vulpo.app/llms-full.txt - All pages: https://vulpo.app/sitemap.xml