[mortyops]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
ghcr.io/homeassistant-ai/ha-mcp	major	8.3.0 → 9.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

homeassistant-ai/ha-mcp (ghcr.io/homeassistant-ai/ha-mcp)

v9.0.0

Compare Source

Added

• Store snapshot backups where Home Assistant stores its own
  (#​2822)
• Redact operator-listed app option keys under redact_secrets
  (#​2849)
• component: Access switch to grant and revoke access to the in-process server
  (#​2821)
• Install from the main repo in HACS, pre-release notes, optional callback allowlist
  (#​2784)
• component: Add Download diagnostics for the custom component
  (#​2759)
• logs: Migrate ha_get_logs onto native Core and Supervisor paths
  (#​2770)
• component: Run the in-process server with an administrator's own token (#​2427)
  (#​2742)
• component: None-mode OAuth redirects only to allowlisted callbacks (#​2427)
  (#​2741)
• component: Run the server each component release pins instead of self-updating it (#​2427)
  (#​2740)
• component: Locked-down defaults for new server entries, no secrets in the log (#​2427)
  (#​2739)
• Add a per-state summary mode to ha_get_history
  (#​2760)
• Add custom_instructions setting for owner-defined server instructions
  (#​2734)

Changed

• component: Point legacy OAuth hint at the secret webhook URL for connection testing
  (#​2894)
• updates: State that install blocks and may time out or drop the connection
  (#​2762)

Fixed

• Restore entity backups to their registry settings and check what restores bring back
  (#​2846)
• visibility: Conceal hidden scripts, scenes and automations addressed by bare key or config id
  (#​2870)
• backup: Preserve final newline differences in text diffs
  (#​2847)
• logs: Return whole records for raw error_log reads (#​2768)
  (#​2813)
• restart: Refuse during a database upgrade on embedded; add safe_mode
  (#​2842)
• Keep a worker stopped during its cold import from binding the port
  (#​2845)
• Log the expected disconnect after a deferred embedded restart as one line
  (#​2838)
• Let Home Assistant validate group writes and report them as Core sees them
  (#​2824)
• auth: Bind the consent form's token to its own authorization code
  (#​2837)
• Steer agents to ha_get_skill_guide whenever it is served
  (#​2805)
• apps: Clarify connection failures and ESPHome MCP access
  (#​2803)
• Accept minutes in ha_get_history relative times
  (#​2753)
• Show a zone's registry icon in the ha_set_zone update reply
  (#​2757)
• Drop handwritten validity claims from the dashboard tools
  (#​2737)
• Route zone writes through the helper path and find zones in the registry
  (#​2707)
• integrations: Refuse ha_mcp_tools config entries in the generic integration tools
  (#​2749)
• Clarify that ha_config_set_yaml add merges one level deep
  (#​2751)
• Fall back to Docker Hub for the python base image in CI
  (#​2738)
• Don't report button-card styles.card as a misshapen card slot
  (#​2735)

---

Internal Changes

Changed

• Make the component path the default in the native contract
  (#​2871)
• tests: Name the registry leftover a deleted storage item leaves
  (#​2756)

Build System

• deps-dev: Bump fast-uri from 3.1.7 to 3.1.9 in /site
  (#​2817)
• deps: Bump undici from 8.10.2 to 8.12.3 in /site
  (#​2816)
• deps: Bump astro from 7.2.8 to 7.3.3 in /site
  (#​2811)

Chores

• Sync ratchet baselines after merge [skip ci]
  (73a6ed9)
• Sync tool docs after merge [skip ci]
  (34c0543)
• Machine-translate locale updates
  (9c4fd66)
• deps: Bump postcss-selector-parser in /site
  (#​2887)
• deps: Update dependency renovatebot/renovate to v44.172.1
  (#​2886)
• deps: Update uv
  (#​2885)
• Sync ratchet baselines after merge [skip ci]
  (4cce756)
• Sync tool docs after merge [skip ci]
  (7dfd2d5)
• deps: Update dependency home-assistant/operating-system to v18.4
  (#​2880)
• deps: Update public.ecr.aws/docker/library/python:3.13-slim docker digest to b3575dc
  (#​2878)
• deps: Update src/ha_mcp/resources/skills-vendor digest to 6d7fc78
  (#​2879)
• Sync ratchet baselines after merge [skip ci]
  (372d77e)
• deps: Update dependency home-assistant/supervisor to v2026.10.4
  (#​2872)
• Machine-translate locale updates
  (86c5b4d)
• Sync ratchet baselines after merge [skip ci]
  (0ff032e)
• Sync tool docs after merge [skip ci]
  (3690af6)
• Sync ratchet baselines after merge [skip ci]
  (4a03740)
• Sync ratchet baselines after merge [skip ci]
  (ed418c5)
• Sync tool docs after merge [skip ci]
  (b10fcbd)
• Sync ratchet baselines after merge [skip ci]
  (3317791)
• Machine-translate locale updates
  (eee3a1e)
• Sync ratchet baselines after merge [skip ci]
  (40c14c4)
• deps: Update ghcr.io/home-assistant/home-assistant docker tag to v2026.10.4
  (#​2840)
• Sync tool docs after merge [skip ci]
  (bbde06b)
• Sync ratchet baselines after merge [skip ci]
  (fad70b7)
• Sync ratchet baselines after merge [skip ci]
  (4874641)
• deps: Update dependency fastmcp-slim to v4.1.2 [security]
  (#​2818)
• deps: Raise openapi-pydantic floor and keep Dependabot off vendored pins
  (#​2826)
• Machine-translate locale updates
  (83f86f7)
• deps: Update ghcr.io/home-assistant/home-assistant docker tag to v2026.10.3
  (#​2814)
• Sync ratchet baselines after merge [skip ci]
  (f0338c4)
• Sync ratchet baselines after merge [skip ci]
  (42d014b)
• Sync ratchet baselines after merge [skip ci]
  (9c91e6e)
• Sync tool docs after merge [skip ci]
  (de2d5f3)
• deps: Update dependency home-assistant/supervisor to v2026.10.3
  (#​2804)
• deps: Update uv
  (#​2799)
• deps: Update dependency renovatebot/renovate to v44.155.9
  (#​2798)
• deps: Update dependency websockets to v17.2
  (#​2792)
• deps: Update dependency renovatebot/renovate to v44.155.7
  (#​2791)
• deps: Update dependency fastmcp-slim to v4.1.0
  (#​2790)
• deps: Update src/ha_mcp/resources/skills-vendor digest to 68f2690
  (#​2789)
• Machine-translate locale updates
  (625bd36)
• Sync ratchet baselines after merge [skip ci]
  (78b8147)
• Sync tool docs after merge [skip ci]
  (4be1508)
• Sync ratchet baselines after merge [skip ci]
  (47b40ae)
• Sync tool docs after merge [skip ci]
  (c4c2704)
• Sync ratchet baselines after merge [skip ci]
  (980daa9)
• Sync ratchet baselines after merge [skip ci]
  (fc2369e)
• Sync tool docs after merge [skip ci]
  (4937e64)
• Sync tool docs after merge [skip ci]
  (c05bfff)
• Sync tool docs after merge [skip ci]
  (1484980)
• Sync ratchet baselines after merge [skip ci]
  (572fb54)
• Sync tool docs after merge [skip ci]
  (dc36baa)
• Sync tool docs after merge [skip ci]
  (d3ecebc)
• Sync tool docs after merge [skip ci]
  (6789062)
• Sync ratchet baselines after merge [skip ci]
  (7e38013)
• deps: Update ghcr.io/home-assistant/home-assistant docker tag to v2026.10.2
  (#​2755)
• Sync tool docs after merge [skip ci]
  (c50c4cb)
• deps: Update dependency home-assistant/supervisor to v2026.10.2
  (#​2748)
• Machine-translate locale updates
  (1580a6c)
• Sync ratchet baselines after merge [skip ci]
  (285da7c)
• Sync ratchet baselines after merge [skip ci]
  (6b0dd5a)
• deps: Update vendored fastmcp
  (#​2731)
• addon: Publish version 8.7.0 [skip ci]
  (051e45f)

Continuous Integration

• Pull the python base image from a GHCR mirror before the rate-limited registries
  (#​2895)
• mirror: Keep the integration mirror's stable release in HACS's reach
  (#​2883)
• deps: Bump renovatebot/github-action
  (#​2868)
• intake: Read reports and answers as rendered and keep the sweep running
  (#​2788)
• site: Build the docs site from the stable tag instead of master
  (#​2808)
• deps: Bump vite from 8.1.5 to 8.3.4 in /site
  (#​2793)
• deps: Bump the github-actions group across 1 directory with 7 updates
  (#​2782)

Testing

• e2e: Wait for the app's own discovery flow in the MCP discovery test
  (#​2882)
• e2e: Cache and tune testcontainer bring-up
  (#​2852)
• Add public MCP regression coverage before runtime refactor
  (#​2856)

v8.7.0

Compare Source

Added

• One dashboard card search that reaches cards nested inside custom cards
  (#​2700)
• Identify the helper behind an entity before removing it
  (#​2695)
• Compact ha_search_tools results with a full-schema second hop
  (#​2670)
• Use native Core contracts for energy and recorder tools
  (#​2685)
• Describe and check dashboard cards from Home Assistant's frontend
  (#​2671)
• Take helper fields, validation and backups from Home Assistant
  (#​2648)
• policy: Match object keys with a *~ path segment
  (#​2641)
• radio: Read Z-Wave parameters without configuration entities
  (#​2607)
• policy: Author AND-ed conditions in the policy card editor
  (#​2630)
• Add backup access controls and report ignored tool disables
  (#​2636)
• Home Assistant 2026.10 MCP discovery and tool metadata
  (#​2613)
• Ha_set_entity use_device_name for Home Assistant 2026.10's Use device name switch
  (#​2639)
• Require an ha_report_issue report on new issues
  (#​2603)
• Resume tool security approvals through MRTR
  (#​2615)
• Add Thread dataset preference and deletion actions
  (#​2592)
• report: File ha_report_issue reports as finished GitHub issues
  (#​2588)

Changed

• Remove mcp-proxy setup recommendations
  (#​2710)
• Correct dev tag timing and addon-publish trigger after binary removal
  (#​2651)
• One English text per setting; render ranges and restart notes from the metadata
  (#​2669)
• Declare each setting once and generate the app options
  (#​2637)
• Retire the standalone binaries and .mcpb bundle; use uvx or Docker
  (#​2646)
• Split util_helpers.py by concern
  (#​2625)
• Split tools_search.py into a tools/search package
  (#​2623)
• Split tools_config_helpers.py into a config_helpers package
  (#​2624)
• Split the component's websocket_api.py into a package
  (#​2628)
• Split settings.js into nine parts
  (#​2622)
• Split server
  (#​2626)
• Split config.py into four modules
  (#​2621)
• Bring five long functions under the statement limit
  (#​2612)
• Fold simple-helper fields into config and route helper writes through the component
  (#​2618)
• Stop scanning every installed package for the version
  (#​2595)

Fixed

• Redact unmarked PEM private keys
  (#​2714)
• Clarify Claude Desktop approval guidance across write tools
  (#​2711)
• component: Take the component's flow helpers from Core's helper flow list
  (#​2697)
• Relay Nabu Casa cloudhooks through the webhook ingress
  (#​2703)
• Read statistics metadata after the rows in ha_get_history
  (#​2693)
• Reply before restarting HA when running embedded
  (#​2692)
• Support Home Assistant 2026.11 pip_kwargs() signature
  (#​2690)
• Use OAuth request credentials for HACS tools
  (#​2689)
• Resolve statistics units through native recorder metadata
  (#​2684)
• Correct OAuth metadata for read-only webhook connections
  (#​2683)
• validation: Tell agents how to fix rejected config tool calls
  (#​2652)
• component: Carry the caller's context on component service calls
  (#​2614)
• Ha_set_area_or_floor accepts null to clear floor_id, icon, picture and sensor references
  (#​2654)
• Update a zone's stored icon and refuse clearing it
  (#​2643)
• Name an unparseable Core version in the use_device_name refusal
  (#​2640)
• Ha_set_area_or_floor sets and clears area temperature/humidity sensors
  (#​2638)
• Include pinned tools in ha_search_tools and ask for English queries
  (#​2635)
• Clear names on whitespace, reject quote-only names, fix device_name echo
  (#​2617)
• Cap oversized system_log messages under compact
  (#​2606)
• Update skills-vendor to 6c9fffe and follow its reference file split
  (#​2574)
• Ship only ha_mcp in the wheel and build with uv_build
  (#​2599)

---

Internal Changes

Added

• ci: Maintainer slash agent for issues and PRs
  (#​2467)

Changed

• tests: Say rule 6 does not ask for committed dependencies
  (#​2678)
• Keep CI results out of the PR template Testing section
  (#​2644)
• Comment changes count for the component gate; PR CI needs a master base
  (#​2620)
• agents: Fix stale references and app wording in agent docs
  (#​2598)
• Split the e2e conftest into helper modules
  (#​2627)

Fixed

• ci: Queue slash review notifications without cancellation
  (#​2709)
• Clarify pre-merge live testing and slash-agent attestations
  (#​2705)

Build System

• deps: Bump devalue from 5.9.2 to 5.9.4 in /site
  (#​2605)
• deps: Bump brace-expansion in /site
  (#​2589)

Chores

• deps: Update uv
  (#​2730)
• deps: Update src/ha_mcp/resources/skills-vendor digest to 7690c5e
  (#​2728)
• deps: Update public.ecr.aws/docker/library/python:3.13-slim docker digest to 70729b4
  (#​2727)
• Sync ratchet baselines after merge [skip ci]
  (0dac79d)
• Machine-translate locale updates
  (ad7e648)
• Sync ratchet baselines after merge [skip ci]
  (3b895d6)
• Sync tool docs after merge [skip ci]
  (50e3e18)
• Sync ratchet baselines after merge [skip ci]
  (ff35ea2)
• deps: Update ghcr.io/home-assistant/home-assistant docker tag to v2026.10.1
  (#​2706)
• Machine-translate locale updates
  (2e2c34d)
• addon: Promote webhook-proxy dev -> stable 3.0.4
  (#​2704)
• Sync ratchet baselines after merge [skip ci]
  (fdbe457)
• Sync ratchet baselines after merge [skip ci]
  (f4cf27d)
• Sync tool docs after merge [skip ci]
  (3c97b08)
• Sync tool docs after merge [skip ci]
  (32880f1)
• Sync ratchet baselines after merge [skip ci]
  (7666c6c)
• Sync ratchet baselines after merge [skip ci]
  (c037881)
• Sync tool docs after merge [skip ci]
  (a797fb3)
• Sync ratchet baselines after merge [skip ci]
  (1e6254f)
• Sync ratchet baselines after merge [skip ci]
  (b5b743c)
• Sync tool docs after merge [skip ci]
  (6cbef88)
• Sync ratchet baselines after merge [skip ci]
  (7a61e2e)
• Sync ratchet baselines after merge [skip ci]
  (72f466f)
• Sync tool docs after merge [skip ci]
  (5fc6cd9)
• deps: Update ghcr.io/home-assistant/home-assistant docker tag to v2026.10.0
  (#​2686)
• Sync ratchet baselines after merge [skip ci]
  (3ac419f)
• Sync tool docs after merge [skip ci]
  (f50bc49)
• Sync ratchet baselines after merge [skip ci]
  (98da287)
• Machine-translate locale updates
  (a4d5216)
• deps: Update dependency fastmcp-slim to v4.0.10
  (#​2679)
• deps: Update uv
  (#​2680)
• deps: Bump source-map-js from 1.2.1 to 1.2.2 in /site
  (#​2677)
• deps: Bump sharp from 0.35.4 to 0.35.5 in /site
  (#​2675)
• deps: Bump smol-toml from 1.8.0 to 1.9.0 in /site
  (#​2674)
• Sync ratchet baselines after merge [skip ci]
  (6ba297e)
• deps: Update python:3.13-slim docker digest to bf44cdf
  (#​2672)
• deps: Update src/ha_mcp/resources/skills-vendor digest to 6ac284a
  (#​2673)
• Machine-translate locale updates
  (c763c5b)
• Sync ratchet baselines after merge [skip ci]
  (28386c0)
• Sync ratchet baselines after merge [skip ci]
  (32f27ae)
• Sync tool docs after merge [skip ci]
  (ce717d6)
• Sync ratchet baselines after merge [skip ci]
  (2849605)
• Machine-translate locale updates
  (adaa968)
• Sync ratchet baselines after merge [skip ci]
  (1efdcfb)
• Sync tool docs after merge [skip ci]
  (484b9ed)
• Sync ratchet baselines after merge [skip ci]
  (9cd24b7)
• Sync tool docs after merge [skip ci]
  (7e4a5f4)
• Sync ratchet baselines after merge [skip ci]
  (97e1735)
• Sync tool docs after merge [skip ci]
  (98b770a)
• Sync ratchet baselines after merge [skip ci]
  (7fb17ff)
• Sync ratchet baselines after merge [skip ci]
  (476ffa2)
• Sync tool docs after merge [skip ci]
  (9554c2a)
• Sync tool docs after merge [skip ci]
  (ee5cac3)
• Machine-translate locale updates
  (0ac705b)
• Sync tool docs after merge [skip ci]
  (89e4261)
• Sync tool docs after merge [skip ci]
  (1acce73)
• Sync tool docs after merge [skip ci]
  (da1eae7)
• Add a duplicate-code ratchet
  (#​2631)
• Sync tool docs after merge [skip ci]
  (f26f14e)
• Enable PLR0915 and mark the existing long functions
  (#​2610)
• Enable BLE001 and mark the existing blind excepts
  (#​2609)
• Sync tool docs after merge [skip ci]
  (5c38f99)
• Add a module-size ratchet
  (#​2608)
• Sync tool docs after merge [skip ci]
  (6985f0a)
• Remove unused and default settings from pyproject.toml
  (#​2604)
• Machine-translate locale updates
  (674f508)
• addon: Publish version 8.6.0 [skip ci]
  (7431f2f)

Continuous Integration

• deps: Bump the github-actions group with 3 updates
  (#​2716)
• Run the dev environment as a live HA, updated with ha-mcp's own tools
  (#​2702)
• Run the BAT runner tests in the unit test job
  (#​2657)
• Devenv reuses a cached HAOS image across component changes
  (#​2656)
• deps: Bump the github-actions group with 2 updates
  (#​2668)
• Encrypt the dev environment's URLs to a per-run public key
  (#​2647)
• Add a fork-only live dev HA environment (Docker or HAOS)
  (#​2645)
• Stop pull requests from editing the ratchet baselines
  (#​2642)
• Fail when a ratchet baseline grows against the base branch
  (#​2634)
• Hide release-note entries that change no user-facing file
  (#​2596)
• intake: Label filed ha_report_issue reports and ask for missing ones
  (#​2591)

Testing

• Assert the exact stdio bridge config
  (#​2712)
• uat: Log the tool names ha_search_tools returned in the BAT trace
  (#​2650)
• Run the JSDOM harness in one node process per pytest worker
  (#​2597)

v8.6.0

Compare Source

Added

• policy: Let a policy approve the calls it lists (allow list)
  (#​2554)
• Ha_get_skill_guide returns SKILL.md with no arguments
  (#​2556)
• Move runtime controls off ha_call_service onto dedicated tools
  (#​2529)
• ha_eval_template: Return Home Assistant's template errors; add variables, strict and condition testing
  (#​2524)
• Add automation runtime enable state
  (#​2448)
• policy: Announce pending tool approvals on the event bus
  (#​2514)
• i18n: Add Azerbaijani (az) locale
  (#​2499)
• calendar: Add update mode to ha_config_set_calendar_event
  (#​2490)
• bug-report: Identify the host app that launched ha-mcp
  (#​2488)
• Simplify component search and add scene discovery
  (#​2481)
• Assign Home Assistant labels to areas
  (#​2459)

Changed

• Antigravity subscriptions/listen workaround and HTTP transport badge
  (#​2549)
• Surface the hosted-connector rules in the FAQ and issue templates
  (#​2500)
• tools: Trim tool and property descriptions to what the model needs at call time
  (#​2528)
• Omit private tool metadata without an LLM API consumer
  (#​2487)

Fixed

• Refuse admin-only REST routes for non-admin tokens instead of tripping HA's IP ban
  (#​2551)
• Name list fields received as {"item": ...} or "" instead of passing on HA's unrelated error
  (#​2553)
• Prevent password autofill and invalid connection paths
  (#​2552)
• Return stored config entry options without flattening nested values
  (#​2543)
• Correct tool descriptions, delete binary files, restore UAT tool traces
  (#​2539)
• Log tool status lines instead of sending deprecated MCP log messages
  (#​2531)
• Add app support pointer to Supervisor errors
  (#​2534)
• Keep the entity's own-name alias when ha_set_entity writes aliases
  (#​2496)
• Surface Claude Desktop approval-hang guidance to agents and users
  (#​2480)
• Serialize concurrent registry label updates
  (#​2475)

---

Internal Changes

Changed

• tests: Align instructions and tests with the test design rules
  (#​2558)
• tests: Preserve meaningful regression coverage
  (62819d6)
• tests: Keep test-first order and fit JS and YAML tests
  (99865db)
• tests: Add test design rules
  (#​2555)
• Fix stale run instructions in skills and AGENTS.md
  (#​2537)

Fixed

• locales: One number rule for Locale Sync and its pre-push check
  (#​2523)
• Ignore Markdown code/bold markers when matching intake quotes
  (#​2517)
• Wait for Supervisor's running state before app lifecycle calls
  (#​2489)

Chores

• deps: Update uv
  (#​2578)
• deps: Update dependency fastmcp-slim to v4.0.5
  (#​2577)
• deps: Update python:3.13-slim docker digest to 7c61056
  (#​2573)
• Machine-translate locale updates
  (4634a98)
• Sync tool docs after merge [skip ci]
  (c765627)
• deps: Update dependency home-assistant/supervisor to v2026.09.3
  (#​2572)
• Machine-translate locale updates
  (70e71d9)
• deps: Update ghcr.io/home-assistant/home-assistant docker tag to v2026.9.4
  (#​2550)
• Sync tool docs after merge [skip ci]
  (1ce2ce4)
• Sync tool docs after merge [skip ci]
  (7d292d8)
• Machine-translate locale updates
  (f7ce464)
• deps: Update dependency renovatebot/renovate to v44.103.1
  (#​2536)
• deps: Update src/ha_mcp/resources/skills-vendor digest to bc73bda
  (#​2535)
• Sync tool docs after merge [skip ci]
  (359aeb8)
• Sync tool docs after merge [skip ci]
  (864463d)
• Machine-translate locale updates
  (1b56328)
• Sync tool docs after merge [skip ci]
  (af7631a)
• Sync tool docs after merge [skip ci]
  (3a64e7b)
• Machine-translate locale updates
  (0987ade)
• deps: Update uv
  (#​2520)
• Sync tool docs after merge [skip ci]
  (abf9862)
• deps: Update dependency renovatebot/renovate to v44.93.5
  (#​2521)
• deps: Update src/ha_mcp/resources/skills-vendor digest to 309c07a
  (#​2519)
• deps: Update python:3.13-slim docker digest to 8d9d0b8
  (#​2518)
• Sync tool docs after merge [skip ci]
  (2bc821d)
• Machine-translate locale updates
  (ae4db2d)
• Sync tool docs after merge [skip ci]
  (c9d8240)
• deps: Update dependency home-assistant/operating-system to v18.3
  (#​2493)
• deps: Update ghcr.io/home-assistant/home-assistant docker tag to v2026.9.3
  (#​2491)
• Sync tool docs after merge [skip ci]
  (d6d6c5e)
• Sync tool docs after merge [skip ci]
  (debbebd)
• Sync tool docs after merge [skip ci]
  (10a2bbb)
• deps: Update dependency home-assistant/supervisor to v2026.09.2
  (#​2473)
• addon: Publish version 8.5.0 [skip ci]
  (8182c6e)

Continuous Integration

• deps: Bump the github-actions group with 5 updates
  (#​2569)
• deps: Bump the github-actions group with 2 updates
  (#​2513)
• Replace issue enrichment with factual Codex documentation
  (#​2447)
• deps: Bump devalue from 5.8.1 to 5.9.2 in /site
  (#​2486)
• Track the HAOS pin from stable.json instead of GitHub releases
  (#​2485)

Testing

• e2e: Attach the Home Assistant log to failures and gate timeouts
  (#​2571)
• e2e: Keep local E2E runs out of the developer's ~/.ha-mcp
  (#​2544)
• Keep unit tests, BAT and app tests off the developer machine
  (#​2541)

v8.5.0

Compare Source

Added

• Add check_updates action to reload the app store
  (#​2460)
• Migrate to the vendored FastMCP 4.0.3 and MCP SDK 2.2.0
  (#​2443)
• Add read-only HTTP and Home Assistant webhook endpoints
  (#​2440)
• Make Extra YAML write keys a multiline editor
  (#​2441)
• Add opt-in HTTP diagnostics and JSON responses
  (#​2431)
• Back up and restore Template helper options
  (#​2419)
• i18n: Add Traditional Chinese locale
  (#​2267)
• Add native dashboard edits and structured patches
  (#​2403)
• Add history query workload safeguards
  (#​2371)
• Add optional cross-session tool concurrency limit
  (#​2369)
• search: Reach manage tools from every call proxy
  (#​2378)
• logs: Add fault_log source for home-assistant.log.fault
  (#​2377)
• Consolidate blueprint tools into ha_manage_blueprints with delete, save, and substitute
  (#​2356)

Changed

• Clarify Claude.ai auto-detection and retry guidance
  (#​2425)
• Avoid unnecessary work for narrow overview requests
  (#​2370)

Fixed

• Point unknown tool arguments at the intended parameter
  (#​2465)
• Wait for scene and script registry identities after writes
  (#​2461)
• Make opt-in HTTP diagnostics visible under WARNING logging
  (#​2436)
• locale-sync: Retry an unparseable engine answer like a transient status
  (#​2424)
• Guard automation alias replacements with a prior config hash
  (#​2417)
• Enforce read-only mode inside ha_call_service
  (#​2418)
• policy: Consume an approval exactly once across concurrent identical calls
  (#​2399)
• Default auto-backup dir to /backups outside the add-on
  (#​2376)
• Refuse over-nested list-param JSON and fail a merge that strands the component under a released version
  (#​2375)

---

Internal Changes

Changed

• Restore scope anti-patterns and move general code conventions into AGENTS.md
  (#​2466)

Fixed

• deps: Preserve embedded compatibility with supported HA Core
  (#​2400)
• ci: Regenerate vendored websockets in Renovate updates
  (#​2385)

Chores

• deps: Update dependency astral-sh/uv to v0.12.11
  (#​2470)
• deps: Update dependency renovatebot/renovate to v44.69.11
  (#​2471)
• Sync tool docs after merge [skip ci]
  ([3a21cd0](https://redirect.github.co

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[github-actions]

✅ Automated recommendation: APPROVE

Analysis engine: pr-review-local (openai) · pr-reviewer-action v3.7.0

Recommendation

Approve. This is a straightforward Renovate-driven image bump from 8.3.0 to 9.0.0 of ghcr.io/homeassistant-ai/ha-mcp in a single MCPServer manifest. The diff is a one-line change with no structural, security, or configuration risk.

Change-by-Change Findings

kubernetes/apps/base/ai/toolhive/mcp-servers/ha-mcp/mcpserver.yaml

• Image tag updated 8.3.0 → 9.0.0 (major version bump).
• No other fields changed — transport, groupRef, and metadata are untouched.
• The MCPServer CR is a ToolHive resource (toolhive.stacklok.dev/v1alpha1); the operator will reconcile the new image on the next sync cycle.
• The release notes for v9.0.0 include several security-relevant changes (redacting operator-listed app option keys, locked-down defaults for new server entries, no secrets in logs), which is a positive signal for this bump.

Standards Compliance

• No plaintext secrets — the diff contains no secrets.
• No postRenderer — not applicable to this manifest.
• No ${...} substitution risk — no literal ${...} tokens present.
• No security.cephx.csi or rgw_sigv4_insecure changes — not applicable.
• No GitHub Actions workflow changes — not applicable.
• No Talos config changes — not applicable.
• No allowGitHubActionsToCreateAndApprovePullRequests — not applicable.

Unknowns / Needs Verification

• Runtime behavior of v9.0.0: The changelog notes several component-level changes (OAuth redirect allowlists, in-process server token pinning, diagnostics download). These are additive features and should not break the existing streamable-http transport, but a post-merge observation of the pod logs is recommended to confirm the new server entry is healthy.
• No digest pin: The image is referenced by tag (9.0.0). If the repo's convention for this app requires a digest pin, that is a separate concern not addressed by this PR.

Tool Harness Findings

No tool harness findings are present in the corpus.

Required Checks

No must_check items were provided in the PR classification metadata. No mandatory review questions to disposition.

[mortyops]

--- MCPServer ai/ha-mcp
+++ MCPServer ai/ha-mcp
@@ -13,7 +13,7 @@
     value: http://home-assistant.home-automation:8123
   groupRef:
     name: mcp-tools
-  image: ghcr.io/homeassistant-ai/ha-mcp:8.3.0
+  image: ghcr.io/homeassistant-ai/ha-mcp:9.0.0
   podTemplateSpec:
     spec:
       containers: