Home Assistant

Reads entity states from a Home Assistant instance on your own network and turns lights on and off. Self-host only: it binds to loopback, has no token verifier, and reaches a private address on purpose.

What you get

• hass.states.list — every entity and its current state.
• hass.state.get — one entity in full.
• hass.light.turn_on — with optional brightness.
• hass.light.turn_off.

What you need

• Long-lived access token — from your Home Assistant profile page, at the bottom. It carries the permissions of the user who made it, so create a dedicated non-administrator user for this rather than using your own.
• Home Assistant URL — where your instance answers, scheme and port included.

How it works

This is the template that does not go to the cloud, and every choice follows from that. It binds 127.0.0.1, so the only clients are on the machine running it. It configures no verifier, which means the reachable trust ceiling is unauthenticated, and a binding whose floor sits above the ceiling is filtered out of tools/list entirely rather than returning a permission error. So every binding lowers its own governance.minimum_trust to unauthenticated; the default_minimum_trust under governance.policy.tool_access is the runtime fallback for a tool with no rule of its own and does not move a binding's floor.

Each binding sets allow_private_backends: true. The gateway otherwise refuses a backend URL that resolves into a private range, which is the right default everywhere except here: Home Assistant is on the LAN, and reaching it is the entire point. That is also why there is no cloud target. A managed gateway runs in our cluster, and your Home Assistant is on your network — the pod cannot reach 192.168.x.x at your house, so a published copy of this config would provision cleanly and then fail every call. The publish guard refuses the private-backend opt-in as well, and that refusal is a backstop rather than the reason: the address is simply not reachable from there.

Services are named in the URL, not in the arguments. hass.light.turn_on can only ever call light.turn_on; a generic "call any service" tool would let a caller reach hassio.host_reboot with the same credentials.

Notes

Home Assistant returns the states it changed, not a status object, so a successful call comes back as an array. An empty array usually means the entity id did not match anything.

brightness_pct is ignored by lights that do not support dimming. Home Assistant accepts the call rather than refusing it.