Home Assistant MCP (hass-mcp) — agentic threat model

Not certain from the listing — The underlying foundation model is determined by the client connecting to this MCP. The primary threat is model reprogramming or prompt injection that tricks the model into executing unauthorized physical actions.

Not certain from the listing — While the agent queries device states and home configurations, there is no mention of a dedicated vector store or RAG pipeline. State data could potentially be exfiltrated or manipulated to feed false context to the model.

The agent framework layer is highly critical here as it exposes Home Assistant services as tools. Insecure tool integration or lack of input validation could allow an LLM to execute high-consequence tools (e.g., unlocking doors or disabling alarms) without proper verification.

Not certain from the listing — The deployment architecture is not specified, but typically involves running as an MCP server locally or in a container. Risks include insecure storage of the Home Assistant long-lived access token and lack of network isolation.

Not certain from the listing — There are no mentioned guardrails, evaluation frameworks, or real-time monitoring tools to detect anomalous or malicious tool-calling behavior before physical actuation occurs.

Not certain from the listing — Access control relies entirely on the Home Assistant token permissions. There is no evidence of granular, MCP-level authorization policies to restrict access to sensitive physical devices based on the user's session context.

Not certain from the listing — If this MCP is exposed to a multi-agent ecosystem, a secondary untrusted agent could exploit the trust relationship to manipulate the Home Assistant agent into performing physical actions.