advanced-homeassistant-mcp

The server implements comprehensive security measures including rate limiting, input sanitization (using `sanitize-html` and custom logic), JWT authentication, and security headers (using `helmet`). Critical secrets like `HASS_TOKEN`, `ANTHROPIC_API_KEY`, and `JWT_SECRET` are correctly managed via environment variables. CORS is broadly enabled (`Access-Control-Allow-Origin: *`) in some HTTP contexts, which is often necessary for client-facing APIs like MCP, but should be noted. No direct `eval` calls, code obfuscation, or obvious malicious patterns were found; JSON parsing is used for standard JSON-RPC/WebSocket communication.