Homey-Wan-Kenobi MCP
MCP server for controlling Homey Pro smart home systems through the Model Context Protocol.
The name nods to Obi-Wan Kenobi, your home's only hope for natural-language control.
60 tools and 3 knowledge prompts for device control, flow authoring, automation, monitoring, troubleshooting, network diagnostics, and self-hosted deployment.
Why Homey-Wan-Kenobi
Athom ships an official Homey MCP Server: a cloud-brokered remote connector you add to a paid Claude or ChatGPT plan and sign into with your Homey account. It covers device status and control, renaming and moving devices, creating, updating and starting Flows and Advanced Flows, and setting Moods.
This server differs in two ways. It is self-hosted, so you run it yourself over stdio or streamable-HTTP with no third-party broker and no paid AI-plan requirement. And it adds operational depth for power users that is not part of the official server's described capabilities.
The table reflects Athom's publicly described capabilities as of June 2026. Athom does not publish a formal tool list, so the right-hand gaps are inferred from their documentation, not stated by Athom.
The depth, in practice
- Network diagnostics that the official server does not describe.
diagnose_zwave_networkanddiagnose_zigbee_networkread controller health, grade each node by last-seen age (battery-sleep aware), group transmit failures, correlate them with unavailable devices, and return severity-ranked remediations.get_zwave_logexposes the raw network log. - Energy and Insights analysis. Live power by zone and device, day/week/month/year energy reports, and timestamped historical sensor and meter data, so the model can answer "what is using power right now" or "how has the bedroom temperature trended this week".
- App memory and usage analysis.
analyze_app_usagecross-references every app against RAM, device counts and flow references to flag safe removal candidates and estimate savings. Read-only and advisory. - Build automations from scratch. A flow-card discovery engine (
list_flow_cards,get_flow_card) returns each card's full argument schema, and full standard and Advanced Flow CRUD (including delete) lets an AI author and tear down the whole cards graph by UUID. - Infrastructure operations from one interface. Backups, reboot, update checks, memory and storage usage, drivers, LED ring, session and location info.
- A future-proof escape hatch.
homey_api_callreaches any Homey Web API endpoint directly, so new firmware features work without waiting for a tool update.
It runs on a hardened, non-root node:22-alpine image whose every build and release is gated on a Trivy scan, and it is published to Docker Hub, GHCR and the public MCP Registry. See the tool reference below for the full list.
When the official server is the better fit
This server is local-first and self-hosted, which is both its strength and its trade-off. The official Homey MCP is the easier choice when you want:
- Zero setup and managed hosting. Add one URL and sign in with your Homey account. There is no container to run, expose, or maintain, and there is a one-click ChatGPT app.
- Secure remote access from anywhere. Athom brokers the connection through its cloud, so it works away from home without exposing anything on your LAN. This server's HTTP mode is intended for a trusted local network; remote use is your own VPN or authenticated reverse proxy.
- Every Homey model. The official endpoint reaches Homey Cloud, Pro, Pro mini and Self-Hosted Server, including cloud-only setups that have no local API. This server targets a Homey reachable over its local API or your Athom token, so it is happiest with a Homey Pro.
- First-party support. It is maintained by Athom, kept in step with firmware, and officially tested with Claude and the ChatGPT app. This project is independent and best-effort.
The two are complementary. Many people use the official connector for quick remote control and this server for the deep local diagnostics, energy analysis, and infrastructure work. Athom does not publish a formal tool list, so the official server may also include capabilities not reflected above.
Quick Start
git clone https://github.com/Ringosystems/Homey-Wan-Kenobi-MCP.git
cd Homey-Wan-Kenobi-MCP
npm install
npm run build
Authenticate with your Homey:
npx homey login
npx homey select
Add to your MCP client config (Kiro, Claude Desktop, Cline, etc.):
{
"mcpServers": {
"homey": {
"command": "node",
"args": ["/path/to/Homey-Wan-Kenobi-MCP/dist/index.js"]
}
}
}
Authentication
The server supports two authentication methods:
Homey CLI (recommended) runs npx homey login and npx homey select. The server reads the stored OAuth token from ~/.athom-cli/settings.json automatically.
Local API Key is created at my.homey.app. Set environment variables:
export HOMEY_ADDRESS=http://192.168.1.x
export HOMEY_TOKEN=your-api-key
The local API key method is the recommended choice when running self-hosted in a container, since it does not depend on a mounted CLI settings file.
Self-Hosted (Docker / HTTP)
The image is published at ringosystems/homey-wan-kenobi (mirrored to ghcr.io/ringosystems/homey-wan-kenobi), and the server is listed in the MCP Registry as io.github.Ringosystems/homey-wan-kenobi-mcp. It is built on node:22-alpine, runs as a non-root user, and ships no baked-in secrets. See SECURITY.md for the audit details.
It defaults to the stdio transport so an MCP client can launch it directly, and exposes a long-lived streamable-HTTP service (via supergateway at /mcp, health at /healthz) when you set MCP_TRANSPORT=streamable-http.
Fastest: one command (prebuilt image)
No clone or build. Pull two things and start it:
curl -fsSLO https://raw.githubusercontent.com/Ringosystems/Homey-Wan-Kenobi-MCP/main/docker-compose.deploy.yml
printf 'HOMEY_ADDRESS=http://192.168.1.x\nHOMEY_TOKEN=your-local-api-key\n' > .env
docker compose -f docker-compose.deploy.yml up -d
The service is then at http://<host>:8000/mcp (health at /healthz). On Unraid, add the template by URL instead: Docker, Add Container, paste https://raw.githubusercontent.com/Ringosystems/Homey-Wan-Kenobi-MCP/main/deploy/unraid/homey-wan-kenobi.xml into the Template field. The image is multi-arch, so it runs on x86 and ARM (Apple Silicon, Raspberry Pi) hosts.
The
/mcpendpoint has no built-in authentication. Keep it on a trusted LAN or behind a reverse proxy that adds TLS and auth.
Run as an MCP client (stdio)
docker run -i --rm \
-e HOMEY_ADDRESS=http://192.168.1.x \
-e HOMEY_TOKEN=your-local-api-key \
ringosystems/homey-wan-kenobi:latest
Run as an HTTP service
docker run -d -p 8000:8000 \
-e MCP_TRANSPORT=streamable-http \
-e HOMEY_ADDRESS=http://192.168.1.x \
-e HOMEY_TOKEN=your-local-api-key \
--restart unless-stopped \
ringosystems/homey-wan-kenobi:latest
Docker Compose
Supply your Homey credentials via a .env file next to docker-compose.yml:
cat > .env <<'EOF'
HOMEY_ADDRESS=http://192.168.1.x
HOMEY_TOKEN=your-local-api-key
EOF
# Pull the published image, or add --build to build locally instead
docker compose up -d
The provided docker-compose.yml references the published image (with build: . as a local-build fallback) and applies container hardening (read-only root filesystem, dropped Linux capabilities, no-new-privileges, and memory/PID limits):
services:
homey-wan-kenobi:
image: ringosystems/homey-wan-kenobi:latest
build: .
container_name: homey-wan-kenobi
ports:
- "8000:8000"
environment:
MCP_TRANSPORT: streamable-http
HOMEY_ADDRESS: "${HOMEY_ADDRESS:-http://192.168.1.x}"
HOMEY_TOKEN: "${HOMEY_TOKEN:-}"
restart: unless-stopped
read_only: true
tmpfs:
- /tmp
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
mem_limit: 256m
pids_limit: 128
healthcheck:
test: ["CMD", "node", "-e", "fetch('http://localhost:8000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
interval: 30s
timeout: 5s
retries: 3
start_period: 20s
Build locally
docker build -t ringosystems/homey-wan-kenobi .
docker run -d -p 8000:8000 \
-e MCP_TRANSPORT=streamable-http \
-e HOMEY_ADDRESS=http://192.168.1.x \
-e HOMEY_TOKEN=your-local-api-key \
--restart unless-stopped \
ringosystems/homey-wan-kenobi
Connecting a client
Point an MCP client at the streamable-HTTP endpoint:
{
"mcpServers": {
"homey": {
"type": "streamable-http",
"url": "http://your-host:8000/mcp"
}
}
}
Check health with curl http://your-host:8000/healthz.
Tools
Devices
Device & Zone Management
Zones
Flows
Flow Authoring
Flow Card Discovery
Logic & Apps
Insights & Energy
Weather, Presence & Location
Alarms & Moods
Notifications
Network Diagnostics
App Usage Analysis
System & Infrastructure
Advanced
Prompts
Built-in knowledge prompts accessible via the MCP prompts API:
Development
npm run dev # Run with tsx (no build step)
npm run build # Compile TypeScript
npm run lint # ESLint
npm run typecheck # TypeScript strict check
npm start # Run compiled version
Tech Stack
- TypeScript + Node.js (>=20)
- homey-api v3, the official Homey Web API client
- @modelcontextprotocol/sdk v1.29, MCP server (
registerToolwithToolAnnotations) - zod for parameter validation
- supergateway for the self-hosted streamable-HTTP transport
Security
The dependency tree, base image, and container configuration are audited with Trivy and npm audit. The published image runs as a non-root user on node:22-alpine with no baked-in secrets, and the production dependencies ship with 0 high or critical advisories. See SECURITY.md for the full audit, accepted residual risks, and how to reproduce the scans.
License
Release process, one-time setup, and Unraid Community Applications submission are documented in PUBLISHING.md; notable changes in CHANGELOG.md.