Xiaomi Home Control

Control Xiaomi/Mijia smart home devices via Home Assistant using natural language to manage lights, AC, locks, fans, sensors, and more locally.

Things to check before installing or running this skill: - Verify credentials metadata: the registry entry shows no required env vars, but the skill needs HA_TOKEN and HA_URL in scripts/ha-mcp-server/.env. Treat HA_TOKEN as highly sensitive — do not share it and restrict file permissions (chmod 600). - Network exposure: the code enforces Bearer auth and CORS but does not bind the MCP server explicitly to 127.0.0.1. By default Node will listen on all interfaces. If you only want local access, edit scripts/ha-mcp-server/src/http-server.mjs to bind to 127.0.0.1, or use a firewall rule to block external access to the MCP port (default 3002). - Persistence: setup.sh installs a LaunchAgent to keep the MCP server running. Review the generated plist before loading it, and remove/unload it when you no longer want the service. - Docker privileges: the docker-compose/run uses --privileged and host networking for Home Assistant. This is common for HA but increases host privileges. Only run it on a trusted machine. - Validate the code and sources: if you obtained the skill from this bundle rather than an official repo, consider auditing the small server files (http-server.mjs and call-tool.mjs) yourself or sourcing the project from a maintained upstream repository. Confirm package.json and package-lock integrity before running npm install. If you want a conservative safe setup: do not run setup.sh unmodified. Instead (a) manually create the .env with HA_URL and HA_TOKEN, (b) run the MCP server bound to 127.0.0.1, (c) use firewall rules to block remote access to the MCP port, and (d) only enable the LaunchAgent after inspecting the plist.

Type: OpenClaw Skill Name: openclaw-xiaomi-home Version: 1.2.2 The skill bundle provides a legitimate Model Context Protocol (MCP) server for controlling Xiaomi smart home devices via a local Home Assistant instance. The implementation in `scripts/ha-mcp-server/src/http-server.mjs` includes appropriate security measures for a local service, such as Bearer token authentication, CORS restrictions to localhost, and origin validation to prevent cross-site attacks. Sensitive credentials (HA_TOKEN) are handled locally via a `.env` file and are only transmitted to the user's local Home Assistant API (defaulting to localhost:8123). The setup script (`scripts/setup.sh`) automates the deployment of Home Assistant via Docker and configures a macOS LaunchAgent for persistence, which is consistent with the stated purpose of maintaining a background control server.