Security
You decide what each assistant can touch
Assistants get exactly the scopes you approve: devices:read and devices:control. They’re told to check with you before unlocking a door, and every change they make is logged.
An access panel with the devices:read and devices:control scopes, next to a lit front door lock and a log of control_device calls.
Principles
Four rules the server enforces.
- No access by default
- An assistant can do nothing until you approve it. Reading your home and changing it are separate scopes on the consent screen.
- OAuth 2.1 with PKCE
- ChatGPT, Claude, Claude Code, Cursor and Grok sign in through OAuth. Access tokens are short-lived and bound to the smarthomemcp MCP endpoint, so they can’t be replayed elsewhere.
- Tokens shown once
- Access tokens for clients without OAuth, like Poke, are stored hashed, shown a single time and revocable from your account straight away.
- Every change attributed
- Each call is logged with the time, the assistant and the device. The log is yours to read at any time.
Your data
What we keep, and how to remove it.
smarthomemcp stores your account, the ecosystems you connect and a log of actions taken through it. Device state lives in an isolated store for your home. Disconnecting an ecosystem removes its devices, and deleting your account removes everything.