Give your AI agent the keys to exactly what it needs.
Phoenix MCP is so much more than other HA MCP servers. You can create multiple tokens, each scoped to just the entities and capabilities you allow. Every action can be manually reviewed prior to approval, and rolled back if necessary. External clients are optional - you can just use the built-in Agent Chat window, or HA's own Assist window. Semantic profiles guard against accidental exposure of your system. Easy to install - you can be up and running in under one minute.
No external client necessary - prompt entirely inside Home Assistant
Agent Chat runs the agent inside Phoenix MCP itself, on a token you choose, using your own Anthropic, DeepSeek, Ollama or other provider API account. This greatly simplifies installation and daily use.
Use Agent Chat
A floating chat window with a token switcher, inline Approve/Reject for gated actions, and per-provider model and thinking controls.
Agent Chat ExternalConnect a client
Point Claude Code, Cursor, Codex, Gemini CLI, or any MCP client at Phoenix MCP's endpoint with a URL and a bearer token.
Connect an AI clientWhy Phoenix MCP instead of a long-lived access token
A long-lived access token (LLAT) plus the native MCP server gives every client the same all-or-nothing view of your home. Phoenix MCP keeps the same tools and adds the control layer that the native system has no place for.
| Capability | LLAT + native MCP | Phoenix MCP token |
|---|---|---|
| MCP tool compatibility | 23 native tools | Same 23 tools, identical names and responses, plus 108 more |
| Entity filtering | Binary: expose or hide, same for all clients | Four permission states, per token |
| Per-client control | No, all clients share one exposed set | Yes, independent permissions per token |
| Read-only access | No | Yes, READ allows reads and blocks writes |
| Audit trail | None | Request logging with outcome and entity, on by default and configurable per outcome |
| Rate limiting | None | Per token, configurable |
| Expiry | None | Optional, auto-archived on expiry |
| Revocation | Revoke the LLAT on the HA profile page | Instant; the token's next request is rejected |
| Sensitive attribute scrubbing | None | Always applied |
| Client reconfiguration | /api/mcp with an LLAT | /api/phoenix-mcp with a phx_ token (same tools; swap the URL and the bearer value) |
If you are connecting Claude Code, Cursor, ChatGPT, Antigravity, or any other AI tool to Home Assistant, Phoenix MCP gives you control the native system cannot.
Three layers between an agent and your home
Every actuation runs the same gauntlet, in order. Phoenix MCP resolves and flattens the target to explicit entities, checks the token's permissions and capabilities, and only then lets MESA, the semantic safety net, have the final say, a backstop that holds even over a token that was granted too much. Reads run the same permission scoping without the actuation-only stages.
The permission tree
Domains, devices, and entities, each set to read-write, read-only, deny, or inherit. A two-pass resolver decides what every request can touch.
PermissionsCapability flags
Twenty-five opt-in switches gate the high-impact operations: restart, physical control, writing automations, reading logs, editing YAML. Off by default.
CapabilitiesSemantic safety profiles
MESA stores a semantic profile for each entity: what it is, how sensitive it is, and how it should be treated by your AI agent, not just allow or deny. Describe your home's nature once, and every agent inherits the safe treatment: a lock or camera stays read-only or confirmation-only because of what it is, no matter which token is asking.
MESA