io.github.homeassistant-ai/ha-mcp
Configure and automate Home Assistant with Claude, ChatGPT, and other AI assistants.
Update first. Issues have been reported, but none is flagged on the version the registry lists. That version can trail the package's newest release, so check you run one past the issues below.
Registry name io.github.homeassistant-ai/ha-mcp
· Source code
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| GHSA-q855-8rh5-jfgqha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path | medium | Not flagged | Jul 7, 2026 |
| GHSA-g39v-cvjh-8fpfHome Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/ | medium | Not flagged | May 14, 2026 |
| GHSA-pf93-j98v-25pvha-mcp has XSS via Unescaped HTML in OAuth Consent FormAlso filed as CVE-2026-32112, PYSEC-2026-2508 | medium | Not flagged | Mar 12, 2026 |
| GHSA-fmfg-9g7c-3vq7ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracleAlso filed as CVE-2026-32111, PYSEC-2026-2507 | medium | Not flagged | Mar 12, 2026 |
Versions in the registry
9.1.2 (listed), 9.1.1, 9.1.0, 9.0.0, 8.7.0, 8.6.0, 8.5.0, 8.4.3, 8.4.2, 8.4.1, 8.4.0, 8.3.0, 8.2.0, 8.1.1, 8.1.0, 8.0.0, 7.14.2, 7.14.1, 7.14.0, 7.13.0, 7.12.1, 7.12.0, 7.11.0, 7.10.0, 7.9.0, 7.8.1, 7.8.0, 7.6.0, 7.5.0, 7.4.0 and 82 older