@coffeerunhobby/mcp-ha-connect 1.7.4 → 1.7.6

package/dist/tools/homeassistant/controlFan.js.map

@@ -1 +1 @@
-{"version":3,"file":"controlFan.js","sourceRoot":"","sources":["../../../src/tools/homeassistant/controlFan.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK3F,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAgB;IACxE,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EAAE,gEAAgE;QAC7E,WAAW,EAAE,gBAAgB,CAAC,KAAK;KACpC,EACD,eAAe,CAAC,YAAY,EAAE,KAAK,EAAE,IAAoB,EAAE,EAAE;QAC3D,IAAI,OAAO,GAAW,IAAI,CAAC,MAAM,CAAC;QAClC,MAAM,WAAW,GAA4B,EAAE,CAAC;QAEhD,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,GAAG,gBAAgB,CAAC;YAC3B,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;gBAAE,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAC9E,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;gBAAE,WAAW,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACjF,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YACrC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC5E,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAClH,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"controlFan.js","sourceRoot":"","sources":["../../../src/tools/homeassistant/controlFan.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAKxD,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAgB;IACxE,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EAAE,gEAAgE;QAC7E,WAAW,EAAE,gBAAgB,CAAC,KAAK;KACpC,EACD,eAAe,CAAC,YAAY,EAAE,KAAK,EAAE,IAAoB,EAAE,EAAE;QAC3D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,IAAI,OAAO,GAAW,IAAI,CAAC,MAAM,CAAC;QAClC,MAAM,WAAW,GAA4B,EAAE,CAAC;QAEhD,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,GAAG,gBAAgB,CAAC;YAC3B,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;gBAAE,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAC9E,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;gBAAE,WAAW,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACjF,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,OAAO;YACP,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YACrC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC5E,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAClH,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC"}

package/dist/tools/homeassistant/controlLight.js

@@ -2,11 +2,15 @@
  * controlLight tool - Control lights with advanced options
  */
 import { controlLightSchema, toToolResult, wrapToolHandler, Permission } from '../common.js';
+import { entityNotFoundResult } from './entityGuard.js';
 export function registerControlLightTool(server, client) {
     server.registerTool('controlLight', {
         description: 'Control a light with advanced options like brightness, color, and color temperature.',
         inputSchema: controlLightSchema.shape,
     }, wrapToolHandler('controlLight', async (args) => {
+        const missing = await entityNotFoundResult(client, args.entity_id);
+        if (missing)
+            return missing;
         const serviceData = {};
         if (args.brightness_pct !== undefined)
             serviceData.brightness_pct = args.brightness_pct;

package/dist/tools/homeassistant/controlLight.js.map

@@ -1 +1 @@
-{"version":3,"file":"controlLight.js","sourceRoot":"","sources":["../../../src/tools/homeassistant/controlLight.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK7F,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,MAAgB;IAC1E,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EAAE,sFAAsF;QACnG,WAAW,EAAE,kBAAkB,CAAC,KAAK;KACtC,EACD,eAAe,CAAC,cAAc,EAAE,KAAK,EAAE,IAAsB,EAAE,EAAE;QAC/D,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS;YAAE,WAAW,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QACxF,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;YAAE,WAAW,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACjG,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACzE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YACrC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC5E,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzI,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"controlLight.js","sourceRoot":"","sources":["../../../src/tools/homeassistant/controlLight.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAKxD,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,MAAgB;IAC1E,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EAAE,sFAAsF;QACnG,WAAW,EAAE,kBAAkB,CAAC,KAAK;KACtC,EACD,eAAe,CAAC,cAAc,EAAE,KAAK,EAAE,IAAsB,EAAE,EAAE;QAC/D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS;YAAE,WAAW,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QACxF,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;YAAE,WAAW,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACjG,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACzE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YACrC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC5E,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzI,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC"}

package/dist/tools/homeassistant/controlMediaPlayer.js

@@ -2,11 +2,15 @@
  * controlMediaPlayer tool - Control media players
  */
 import { controlMediaPlayerSchema, toToolResult, wrapToolHandler, Permission } from '../common.js';
+import { entityNotFoundResult } from './entityGuard.js';
 export function registerControlMediaPlayerTool(server, client) {
     server.registerTool('controlMediaPlayer', {
         description: 'Control a media player with playback, volume, and media selection.',
         inputSchema: controlMediaPlayerSchema.shape,
     }, wrapToolHandler('controlMediaPlayer', async (args) => {
+        const missing = await entityNotFoundResult(client, args.entity_id);
+        if (missing)
+            return missing;
         const actionMap = {
             play: 'media_play',
             pause: 'media_pause',

package/dist/tools/homeassistant/controlMediaPlayer.js.map

@@ -1 +1 @@
-{"version":3,"file":"controlMediaPlayer.js","sourceRoot":"","sources":["../../../src/tools/homeassistant/controlMediaPlayer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAKnG,MAAM,UAAU,8BAA8B,CAAC,MAAiB,EAAE,MAAgB;IAChF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,WAAW,EAAE,oEAAoE;QACjF,WAAW,EAAE,wBAAwB,CAAC,KAAK;KAC5C,EACD,eAAe,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAA4B,EAAE,EAAE;QAC3E,MAAM,SAAS,GAA2B;YACxC,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,aAAa;YACpB,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,sBAAsB;YAChC,UAAU,EAAE,YAAY;YACxB,WAAW,EAAE,aAAa;SAC3B,CAAC;QAEF,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpE,WAAW,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxE,WAAW,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;YAC9C,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YACrC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC5E,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAClH,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"controlMediaPlayer.js","sourceRoot":"","sources":["../../../src/tools/homeassistant/controlMediaPlayer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAKxD,MAAM,UAAU,8BAA8B,CAAC,MAAiB,EAAE,MAAgB;IAChF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,WAAW,EAAE,oEAAoE;QACjF,WAAW,EAAE,wBAAwB,CAAC,KAAK;KAC5C,EACD,eAAe,CAAC,oBAAoB,EAAE,KAAK,EAAE,IAA4B,EAAE,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,SAAS,GAA2B;YACxC,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,aAAa;YACpB,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,sBAAsB;YAChC,UAAU,EAAE,YAAY;YACxB,WAAW,EAAE,aAAa;SAC3B,CAAC;QAEF,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpE,WAAW,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC/C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxE,WAAW,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QACrD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;YAC9C,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YACrC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;SAC5E,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAClH,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC"}

package/dist/tools/homeassistant/entityAction.js

@@ -2,6 +2,7 @@
  * entityAction tool - Simple entity actions (turn_on, turn_off, toggle)
  */
 import { entityActionSchema, toToolResult, wrapToolHandler, Permission } from '../common.js';
+import { entityNotFoundResult } from './entityGuard.js';
 export function registerEntityActionTool(server, client) {
     server.registerTool('entityAction', {
         description: 'Perform a simple action on an entity (turn_on, turn_off, toggle). Automatically detects the domain.',
@@ -11,6 +12,9 @@ export function registerEntityActionTool(server, client) {
         if (!domain) {
             return toToolResult({ error: 'Invalid entity_id format', hint: 'entity_id must be in domain.name format such as light.living_room — use the searchEntities tool to discover valid entity IDs' }, true);
         }
+        const missing = await entityNotFoundResult(client, entity_id);
+        if (missing)
+            return missing;
         const result = await client.callService({
             domain,
             service: action,

package/dist/tools/homeassistant/entityAction.js.map

@@ -1 +1 @@
-{"version":3,"file":"entityAction.js","sourceRoot":"","sources":["../../../src/tools/homeassistant/entityAction.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAK7F,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,MAAgB;IAC1E,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EAAE,qGAAqG;QAClH,WAAW,EAAE,kBAAkB,CAAC,KAAK;KACtC,EACD,eAAe,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAoB,EAAE,EAAE;QAChF,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,8HAA8H,EAAE,EAAE,IAAI,CAAC,CAAC;QACzM,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM;YACN,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,EAAE,SAAS,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"entityAction.js","sourceRoot":"","sources":["../../../src/tools/homeassistant/entityAction.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAKxD,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,MAAgB;IAC1E,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EAAE,qGAAqG;QAClH,WAAW,EAAE,kBAAkB,CAAC,KAAK;KACtC,EACD,eAAe,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAoB,EAAE,EAAE;QAChF,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,8HAA8H,EAAE,EAAE,IAAI,CAAC,CAAC;QACzM,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM;YACN,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,EAAE,SAAS,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC"}

package/dist/tools/homeassistant/entityGuard.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Existence guard for entity-targeted control tools.
+ *
+ * Home Assistant silently ignores service calls whose target entity_id does not
+ * exist: the call returns 200 with an empty change list. Without this guard the
+ * tool would report `success: true` for an action that never happened, so an
+ * LLM client would believe a typo'd light was switched on.
+ */
+import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { HaClient } from '../../haClient/index.js';
+/**
+ * Returns an error result when `entityId` does not exist in Home Assistant,
+ * or `null` when it does (the caller should then proceed with the action).
+ */
+export declare function entityNotFoundResult(client: HaClient, entityId: string): Promise<CallToolResult | null>;

package/dist/tools/homeassistant/entityGuard.js

@@ -0,0 +1,25 @@
+/**
+ * Existence guard for entity-targeted control tools.
+ *
+ * Home Assistant silently ignores service calls whose target entity_id does not
+ * exist: the call returns 200 with an empty change list. Without this guard the
+ * tool would report `success: true` for an action that never happened, so an
+ * LLM client would believe a typo'd light was switched on.
+ */
+import { toToolResult } from '../common.js';
+/**
+ * Returns an error result when `entityId` does not exist in Home Assistant,
+ * or `null` when it does (the caller should then proceed with the action).
+ */
+export async function entityNotFoundResult(client, entityId) {
+    const state = await client.getState(entityId);
+    if (state) {
+        return null;
+    }
+    return toToolResult({
+        error: 'Entity not found',
+        entity_id: entityId,
+        hint: 'No action was performed. Use the searchEntities tool with a keyword to find the correct entity_id',
+    }, true);
+}
+//# sourceMappingURL=entityGuard.js.map

package/dist/tools/homeassistant/entityGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entityGuard.js","sourceRoot":"","sources":["../../../src/tools/homeassistant/entityGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAgB,EAAE,QAAgB;IAC3E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,YAAY,CAAC;QAClB,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,mGAAmG;KAC1G,EAAE,IAAI,CAAC,CAAC;AACX,CAAC"}

package/dist/tools/homeassistant/sceneAndScript.js

@@ -2,11 +2,15 @@
  * Scene and Script tools - Activate scenes and run scripts
  */
 import { entityIdSchema, runScriptSchema, toToolResult, wrapToolHandler, Permission } from '../common.js';
+import { entityNotFoundResult } from './entityGuard.js';
 export function registerActivateSceneTool(server, client) {
     server.registerTool('activateScene', {
         description: 'Activate a Home Assistant scene.',
         inputSchema: entityIdSchema.shape,
     }, wrapToolHandler('activateScene', async ({ entity_id }) => {
+        const missing = await entityNotFoundResult(client, entity_id);
+        if (missing)
+            return missing;
         const result = await client.callService({
             domain: 'scene',
             service: 'turn_on',
@@ -20,6 +24,9 @@ export function registerRunScriptTool(server, client) {
         description: 'Run a Home Assistant script with optional variables.',
         inputSchema: runScriptSchema.shape,
     }, wrapToolHandler('runScript', async ({ entity_id, variables }) => {
+        const missing = await entityNotFoundResult(client, entity_id);
+        if (missing)
+            return missing;
         const result = await client.callService({
             domain: 'script',
             service: 'turn_on',

package/dist/tools/homeassistant/sceneAndScript.js.map

@@ -1 +1 @@
-{"version":3,"file":"sceneAndScript.js","sourceRoot":"","sources":["../../../src/tools/homeassistant/sceneAndScript.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAM1G,MAAM,UAAU,yBAAyB,CAAC,MAAiB,EAAE,MAAgB;IAC3E,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,WAAW,EAAE,kCAAkC;QAC/C,WAAW,EAAE,cAAc,CAAC,KAAK;KAClC,EACD,eAAe,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,SAAS,EAAgB,EAAE,EAAE;QACrE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,EAAE,SAAS,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAgB;IACvE,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,WAAW,EAAE,sDAAsD;QACnE,WAAW,EAAE,eAAe,CAAC,KAAK;KACnC,EACD,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAiB,EAAE,EAAE;QAC7E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,EAAE,SAAS,EAAE;YACrB,YAAY,EAAE,SAAgD;SAC/D,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sceneAndScript.js","sourceRoot":"","sources":["../../../src/tools/homeassistant/sceneAndScript.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1G,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAMxD,MAAM,UAAU,yBAAyB,CAAC,MAAiB,EAAE,MAAgB;IAC3E,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,WAAW,EAAE,kCAAkC;QAC/C,WAAW,EAAE,cAAc,CAAC,KAAK;KAClC,EACD,eAAe,CAAC,eAAe,EAAE,KAAK,EAAE,EAAE,SAAS,EAAgB,EAAE,EAAE;QACrE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,EAAE,SAAS,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAgB;IACvE,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,WAAW,EAAE,sDAAsD;QACnE,WAAW,EAAE,eAAe,CAAC,KAAK;KACnC,EACD,eAAe,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAiB,EAAE,EAAE;QAC7E,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,EAAE,SAAS,EAAE;YACrB,YAAY,EAAE,SAAgD;SAC/D,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CACvB,CAAC;AACJ,CAAC"}

package/dist/tools/omada/graph.d.ts

@@ -55,6 +55,12 @@ export declare const readSchema: z.ZodObject<{
 export declare function createBrowseHandler(client: OmadaClient): (args: {
     path: string;
 }, extra: ToolExtra) => Promise<import("@modelcontextprotocol/sdk/types").CallToolResult>;
+/**
+ * `omada_read` is usable iff the caller holds the permission of at least one readable
+ * (fetchable) resource node; otherwise it is hidden from `tools/list`. Kept next to the
+ * handler so the rule cannot drift from the per-path check it summarises.
+ */
+export declare function canReadAnyResource(callerPermissions: number): boolean;
 /** Shared `omada_read` handler — same dual-face reuse as createBrowseHandler. */
 export declare function createReadHandler(client: OmadaClient): (args: {
     path: string;

package/dist/tools/omada/graph.js

@@ -16,8 +16,8 @@
  */
 import { z } from 'zod';
 import { hasPermission, getPermissionNames } from '../../permissions/index.js';
-import { toToolResult, wrapToolHandler, getCallerPermissions, Permission } from '../common.js';
-import { childrenOf, getResourceNode, normalizePath } from './namespace.js';
+import { toToolResult, wrapToolHandler, getCallerPermissions, setToolVisibilityRule, Permission } from '../common.js';
+import { OMADA_RESOURCES, childrenOf, getResourceNode, normalizePath } from './namespace.js';
 /** Compact, model-friendly metadata for a node (used in browse output). */
 function nodeSummary(node) {
     return {
@@ -76,8 +76,17 @@ export function createBrowseHandler(client) {
         });
     }, Permission.QUERY);
 }
+/**
+ * `omada_read` is usable iff the caller holds the permission of at least one readable
+ * (fetchable) resource node; otherwise it is hidden from `tools/list`. Kept next to the
+ * handler so the rule cannot drift from the per-path check it summarises.
+ */
+export function canReadAnyResource(callerPermissions) {
+    return OMADA_RESOURCES.some((node) => node.fetch !== undefined && hasPermission(callerPermissions, node.permission));
+}
 /** Shared `omada_read` handler — same dual-face reuse as createBrowseHandler. */
 export function createReadHandler(client) {
+    setToolVisibilityRule('omada_read', canReadAnyResource);
     // No static permission: each path declares its own, enforced below (fail-closed).
     return wrapToolHandler('omada_read', async (args, extra) => {
         const norm = normalizePath(args.path);

package/dist/tools/omada/graph.js.map

@@ -1 +1 @@
-{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../../src/tools/omada/graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,UAAU,EAAkB,MAAM,cAAc,CAAC;AAC/G,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAoC,MAAM,gBAAgB,CAAC;AAE9G,2EAA2E;AAC3E,SAAS,WAAW,CAAC,IAAkB;IACrC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM;QACnE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS;QAClC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,OAAO,CAAC,GAAG,CAAC;SACZ,QAAQ,CAAC,oFAAoF,CAAC;CAClG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wFAAwF,CAAC;IACnH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACtG,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;IACjH,MAAM,EAAE,CAAC;SACN,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAClB,QAAQ,EAAE;SACV,QAAQ,CAAC,8GAA8G,CAAC;IAC3H,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IAC1G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAC/G,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,KAAK,MAAM,CAAC,CAAC,4EAA4E;IACzF,OAAO,eAAe,CACpB,cAAc,EACd,KAAK,EAAE,EAAE,IAAI,EAAgC,EAAE,KAAgB,EAA4C,EAAE;QAC3G,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,IAAI,sCAAsC,EAAE,EACvG,IAAI,CACL,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;aAC9B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;aACxD,GAAG,CAAC,WAAW,CAAC,CAAC;QACpB,OAAO,YAAY,CAAC;YAClB,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS;YAClC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpG,QAAQ;SACT,CAAC,CAAC;IACL,CAAC,EACD,UAAU,CAAC,KAAK,CACjB,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,kFAAkF;IAClF,OAAO,eAAe,CACpB,YAAY,EACZ,KAAK,EAAE,IAAgC,EAAE,KAAgB,EAA4C,EAAE;QACrG,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,IAAI,8CAA8C,EAAE,EAC/G,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,IAAI,0DAA0D,EAAE,EACtG,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,IAAI,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EACvH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;aAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,IAAI,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,OAAO,EAAE,EACtH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAa;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1D,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAiB,EAAE,MAAmB;IAC5E,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EACT,8GAA8G;YAC9G,mHAAmH;YACnH,mFAAmF;QACrF,WAAW,EAAE,YAAY,CAAC,KAAK;KAChC,EACD,mBAAmB,CAAC,MAAM,CAAC,CAC5B,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EACT,qHAAqH;YACrH,6GAA6G;YAC7G,qDAAqD;QACvD,WAAW,EAAE,UAAU,CAAC,KAAK;KAC9B,EACD,iBAAiB,CAAC,MAAM,CAAC,CAC1B,CAAC;IAEF,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../../src/tools/omada/graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,UAAU,EAAkB,MAAM,cAAc,CAAC;AACtI,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAoC,MAAM,gBAAgB,CAAC;AAE/H,2EAA2E;AAC3E,SAAS,WAAW,CAAC,IAAkB;IACrC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM;QACnE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS;QAClC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,OAAO,CAAC,GAAG,CAAC;SACZ,QAAQ,CAAC,oFAAoF,CAAC;CAClG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wFAAwF,CAAC;IACnH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACtG,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;IACjH,MAAM,EAAE,CAAC;SACN,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAClB,QAAQ,EAAE;SACV,QAAQ,CAAC,8GAA8G,CAAC;IAC3H,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IAC1G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAC/G,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,KAAK,MAAM,CAAC,CAAC,4EAA4E;IACzF,OAAO,eAAe,CACpB,cAAc,EACd,KAAK,EAAE,EAAE,IAAI,EAAgC,EAAE,KAAgB,EAA4C,EAAE;QAC3G,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,IAAI,sCAAsC,EAAE,EACvG,IAAI,CACL,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC;aAC9B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;aACxD,GAAG,CAAC,WAAW,CAAC,CAAC;QACpB,OAAO,YAAY,CAAC;YAClB,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,SAAS;YAClC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpG,QAAQ;SACT,CAAC,CAAC;IACL,CAAC,EACD,UAAU,CAAC,KAAK,CACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,iBAAyB;IAC1D,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,qBAAqB,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACxD,kFAAkF;IAClF,OAAO,eAAe,CACpB,YAAY,EACZ,KAAK,EAAE,IAAgC,EAAE,KAAgB,EAA4C,EAAE;QACrG,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,IAAI,8CAA8C,EAAE,EAC/G,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,IAAI,0DAA0D,EAAE,EACtG,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,IAAI,0BAA0B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,EACvH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;aAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,YAAY,CACjB,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,IAAI,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,OAAO,EAAE,EACtH,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAa;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1D,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAiB,EAAE,MAAmB;IAC5E,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,WAAW,EACT,8GAA8G;YAC9G,mHAAmH;YACnH,mFAAmF;QACrF,WAAW,EAAE,YAAY,CAAC,KAAK;KAChC,EACD,mBAAmB,CAAC,MAAM,CAAC,CAC5B,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,WAAW,EACT,qHAAqH;YACrH,6GAA6G;YAC7G,qDAAqD;QACvD,WAAW,EAAE,UAAU,CAAC,KAAK;KAC9B,EACD,iBAAiB,CAAC,MAAM,CAAC,CAC1B,CAAC;IAEF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/version.d.ts

@@ -2,4 +2,4 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export declare const VERSION = "1.7.4";
+export declare const VERSION = "1.7.6";

package/dist/version.js

@@ -2,5 +2,5 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export const VERSION = '1.7.4';
+export const VERSION = '1.7.6';
 //# sourceMappingURL=version.js.map

package/docs/CHANGELOG.md

@@ -1,3 +1,17 @@
+### 1.7.6
+- **`omada_read` is hidden from callers who can read no Omada resource.** It has no single static permission (it checks per resource path), so 1.7.5 still listed it to every caller, including unmapped tokens that could read nothing. A new per-tool visibility rule lists it only when the caller holds the permission of at least one readable node (e.g. a `QUERY` or an `ADMIN`-only mask); a `NONE`/`NOTIFY`-only caller no longer sees it. Per-path checks are unchanged.
+- **CI: `actions/checkout` and `actions/setup-node` v4 → v7** (Node 24 runtime; v4 targeted the deprecated Node 20 action runtime). No workflow changes were needed: the breaking changes in v5–v7 concern automatic caching (not triggered — no `packageManager` field) and credential persistence (CI never pushes with git).
+- `AGENTS.md`: the GHCR push token is fetched from the maintainer's password manager at push time — never stored as an environment variable.
+- +4 tests (`omada_read` visibility for NONE / QUERY / ADMIN-only / NOTIFY-only masks).
+
+### 1.7.5
+- **Security — `tools/list` is filtered by the caller's permissions.** A token is only offered the tools it may call (e.g. a `readonly` token no longer sees `restartHomeAssistant`, `deleteAutomation`, `invokeAction` or the Omada write tools). Previously every valid token was shown all tools; calls were already denied, but LLM clients planned around tools they could not use and the admin surface was disclosed. Each tool's static permission is recorded by `wrapToolHandler`; `createServer({ callerPermissions })` disables the rest, so the SDK omits them from the list and rejects calls to them. Per-call RBAC is unchanged; stdio (local trust) is unfiltered; `omada_read`/`omada_browse` stay listed (they gate per resource path).
+- **Fix — control tools no longer report success for a non-existent entity.** Home Assistant silently ignores service calls to unknown `entity_id`s, so `entityAction`, `controlLight`, `controlClimate`, `controlFan`, `controlCover`, `controlMediaPlayer`, `activateScene` and `runScript` returned `success: true` for typos. They now check existence first and return `isError` "Entity not found" ("No action was performed") without calling the service.
+- **Warning — permissive `defaultRole`.** With bearer auth, the server logs a startup warning when `MCP_PERMISSIONS_CONFIG` `defaultRole` grants anything, since it applies to every valid token with an unmapped `sub`. README now recommends `defaultRole: NONE` plus one `users` entry per client (and fixes the `ADMIN` role row, which wrongly said "all except AI").
+- **Fix — `generate:jwt` prints the token once.** stdout carries only the bare token; details go to stderr, so `TOKEN=$(npm run -s generate:jwt -- ...)` captures exactly one token.
+- Added `.codex/review-rules.md` (the repo's hard rules for pre-release code review).
+- +26 tests: permission-filtered `tools/list` over an MCP client and over the real HTTP path (bearer auth → stream transport, incl. interleaved callers), the entity guard for all eight tools, `defaultRoleWarning` and its wiring in the auth middleware, and the `generate:jwt` stdout contract (subprocess).
+
 ### 1.7.4
 - **Security — cleared every advisory in the dependency tree** (`npm audit` and `npm audit --omit=dev` both report 0). Runtime range declarations are unchanged; all fixes are in-range lockfile bumps:
   - Production: `undici` 6.28.0→6.29.0 (WebSocket DoS ×2, retry-interceptor response splitting), `fast-uri` 3.1.6→3.1.8 (authority injection / host confusion; via ajv), `hono` 4.13.3→4.13.11, `ip-address` 10.5.0→10.7.2, `qs` 6.15.3→6.16.0 (all three transitive under the SDK's express stack).

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Home Assistant MCP Wrapper",
-    "version": "1.7.4",
+    "version": "1.7.6",
     "description": "REST endpoints that wrap MCP tools for Home Assistant integration."
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffeerunhobby/mcp-ha-connect",
-  "version": "1.7.4",
+  "version": "1.7.6",
   "description": "Smart home MCP server for Home Assistant plus Local AI integration",
   "type": "module",
   "main": "dist/index.js",

package/scripts/generate-jwt.ts

@@ -107,16 +107,15 @@ function main() {
 
   const token = createJwt(payload, secret);
 
-  console.log('\n=== JWT Token Generated ===\n');
-  console.log('Subject:', sub);
-  console.log('Issued at:', new Date(iat * 1000).toISOString());
-  console.log('Expires at:', new Date(expTime * 1000).toISOString());
-  console.log('Duration:', exp);
-  console.log('\n--- Token ---\n');
+  // Details go to stderr; stdout carries ONLY the bare token, exactly once, so
+  // `TOKEN=$(npm run -s generate:jwt -- ...)` captures one usable token.
+  console.error('\n=== JWT Token Generated ===\n');
+  console.error('Subject:', sub);
+  console.error('Issued at:', new Date(iat * 1000).toISOString());
+  console.error('Expires at:', new Date(expTime * 1000).toISOString());
+  console.error('Duration:', exp);
+  console.error('\nUsage: curl -H "Authorization: Bearer <token>" http://localhost:3000/mcp ...\n');
   console.log(token);
-  console.log('\n--- Usage ---\n');
-  console.log(`curl -H "Authorization: Bearer ${token}" http://localhost:3000/mcp ...`);
-  console.log('');
 }
 
 main();

package/src/permissions/index.ts

@@ -80,6 +80,24 @@ export function getUserPermissions(sub: string | undefined, config: PermissionsC
   return resolveRoleName(user.role);
 }
 
+/**
+ * Warning text when `defaultRole` grants anything, or `undefined` when it is NONE.
+ *
+ * `defaultRole` applies to every validly signed token whose `sub` is not listed in
+ * `users` — so a non-NONE default silently gives unmapped clients real access. The
+ * recommended setup is `defaultRole: none` plus one explicit `users` entry per client.
+ */
+export function defaultRoleWarning(config: PermissionsConfig): string | undefined {
+  const mask = resolveRoleName(config.defaultRole);
+  if (mask === Role.NONE) {
+    return undefined;
+  }
+  return (
+    `MCP_PERMISSIONS_CONFIG defaultRole is "${config.defaultRole}": any valid token with an unmapped sub ` +
+    `gets [${getPermissionNames(mask).join(', ')}]. Recommended: defaultRole "none" and one users[] entry per client.`
+  );
+}
+
 /**
  * Check if a permission mask includes required permission
  */

package/src/server/auth.ts

@@ -5,7 +5,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
 import { verifyJwt, type JwtPayload } from '../utils/jwt.js';
-import { getUserPermissions, Role, type PermissionsConfig } from '../permissions/index.js';
+import { defaultRoleWarning, getUserPermissions, Role, type PermissionsConfig } from '../permissions/index.js';
 import { logger } from '../utils/logger.js';
 
 export type AuthMethod = 'none' | 'bearer';
@@ -99,6 +99,16 @@ function validateJwt(
 export function createAuthMiddleware(config: AuthConfig): (req: IncomingMessage, res: ServerResponse) => boolean {
   const { method, secret, permissions: permConfig, skipPaths = [], requireExp, issuer, audience } = config;
 
+  // Loudly flag a permissive defaultRole: it silently grants every valid token whose
+  // sub is unmapped. Lives here (not in server startup) because this middleware is
+  // what applies defaultRole, so the warning cannot be bypassed.
+  if (method === 'bearer' && permConfig) {
+    const warning = defaultRoleWarning(permConfig);
+    if (warning) {
+      logger.warn(warning);
+    }
+  }
+
   return (req: IncomingMessage, res: ServerResponse): boolean => {
     if (method === 'none') {
       // No auth = full permissions via AuthInfo.extra

package/src/server/common.ts

@@ -3,11 +3,12 @@
  * Shared across all transport types (stdio, SSE, stream)
  */
 
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer, type RegisteredTool } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { HaClient } from '../haClient/index.js';
 import type { LocalAIClient } from '../localAI/index.js';
 import type { OmadaClient } from '../omadaClient/index.js';
 import { registerAllTools } from '../tools/index.js';
+import { isToolVisibleTo } from '../tools/common.js';
 import type { OmadaRegistrationMode } from '../tools/omada/index.js';
 import type { RestAction } from '../tools/infra/index.js';
 import { registerAllResources } from '../resources/index.js';
@@ -23,10 +24,17 @@ export interface CreateServerOptions {
   restActions?: Record<string, RestAction>;
   /** Tool registration strategy for the Omada plugin (default 'eager'). */
   toolRegistrationMode?: OmadaRegistrationMode;
+  /**
+   * The caller's permission mask. When set, tools whose static permission the
+   * caller lacks are disabled, which hides them from `tools/list` (and the SDK
+   * rejects calls to them). Undefined = no filtering (stdio local trust).
+   * Execution-time RBAC in wrapToolHandler still applies either way.
+   */
+  callerPermissions?: number;
 }
 
 export function createServer(options: CreateServerOptions): McpServer {
-  const { haClient, omadaClient, aiClient, restActions, toolRegistrationMode } = options;
+  const { haClient, omadaClient, aiClient, restActions, toolRegistrationMode, callerPermissions } = options;
   logger.debug('Creating MCP server instance');
 
   // Generate instructions based on enabled plugins
@@ -48,15 +56,32 @@ export function createServer(options: CreateServerOptions): McpServer {
 
   logger.debug('Server instructions generated', { length: instructions.length });
 
-  // Register all tools based on configured clients
-  registerAllTools({
-    server,
-    haClient,
-    omadaClient,
-    aiClient,
-    restActions,
-    toolRegistrationMode,
-  });
+  // Register all tools based on configured clients, capturing each RegisteredTool
+  // handle so tools the caller can never use can be hidden afterwards.
+  const registeredTools = new Map<string, RegisteredTool>();
+  const originalRegisterTool = server.registerTool;
+  server.registerTool = ((...args: Parameters<McpServer['registerTool']>) => {
+    const tool = (originalRegisterTool as (...a: unknown[]) => RegisteredTool).apply(server, args);
+    registeredTools.set(args[0], tool);
+    return tool;
+  }) as McpServer['registerTool'];
+  try {
+    registerAllTools({
+      server,
+      haClient,
+      omadaClient,
+      aiClient,
+      restActions,
+      toolRegistrationMode,
+    });
+  } finally {
+    server.registerTool = originalRegisterTool;
+  }
+
+  if (callerPermissions !== undefined) {
+    const hidden = hideUnpermittedTools(registeredTools, callerPermissions);
+    logger.debug('Filtered tools by caller permissions', { visible: registeredTools.size - hidden, hidden });
+  }
 
   // Register Home Assistant resources (if HA client provided)
   if (haClient) {
@@ -67,3 +92,20 @@ export function createServer(options: CreateServerOptions): McpServer {
 
   return server;
 }
+
+/**
+ * Disable every tool the caller cannot use (it lacks the tool's static permission, or the
+ * tool's visibility rule — e.g. omada_read's per-path one — finds nothing usable). Disabled
+ * tools are omitted from `tools/list`, so an LLM client only plans with tools it can use.
+ * Returns the number of tools hidden.
+ */
+export function hideUnpermittedTools(tools: Map<string, RegisteredTool>, callerPermissions: number): number {
+  let hidden = 0;
+  for (const [name, tool] of tools) {
+    if (!isToolVisibleTo(name, callerPermissions)) {
+      tool.disable();
+      hidden++;
+    }
+  }
+  return hidden;
+}

package/src/server/stream.ts

@@ -12,6 +12,7 @@ import type { LocalAIClient } from '../localAI/index.js';
 import type { OmadaClient } from '../omadaClient/index.js';
 import { logger } from '../utils/logger.js';
 import { createServer } from './common.js';
+import type { AuthenticatedRequest } from './auth.js';
 
 interface StreamTransportState {
   transport: StreamableHTTPServerTransport;
@@ -92,7 +93,7 @@ export function buildTransportSecurityOptions(config: EnvironmentConfig): Transp
  * Creates a Streamable HTTP transport
  * This implements the MCP protocol version 2025-03-26
  */
-export function createStreamTransport(options: StreamTransportOptions): StreamTransportState {
+export function createStreamTransport(options: StreamTransportOptions, callerPermissions?: number): StreamTransportState {
   const { haClient, omadaClient, aiClient, config } = options;
   const mcpServer = createServer({
     haClient,
@@ -100,6 +101,8 @@ export function createStreamTransport(options: StreamTransportOptions): StreamTr
     aiClient,
     restActions: config.restActions,
     toolRegistrationMode: config.toolRegistrationMode,
+    // Hide tools this caller can never use from tools/list (RBAC still enforced per call).
+    callerPermissions,
   });
 
   const enableStatefulSessions = config.stateful;
@@ -158,7 +161,9 @@ export async function handleStreamRequest(
   });
 
   // Reuse existing transport if provided, otherwise create new one
-  const state = existingTransport ?? createStreamTransport(options);
+  // The auth middleware attached the caller's mask; a new server lists only the tools it permits.
+  const callerPermissions = (req as AuthenticatedRequest).auth?.extra?.permissions as number | undefined;
+  const state = existingTransport ?? createStreamTransport(options, callerPermissions);
 
   if (!existingTransport) {
     await state.server.connect(state.transport);

package/src/tools/common.ts

@@ -73,6 +73,45 @@ export function safeSerialize(value: unknown): string {
   }
 }
 
+/**
+ * Static permission bit each tool declares via `wrapToolHandler`, keyed by tool
+ * name. Lets the server hide tools a caller can never use from `tools/list`.
+ * Tools with no static bit (e.g. `omada_read`/`omada_browse`, which gate per
+ * resource path) are absent and therefore always listed.
+ */
+const toolPermissions = new Map<string, number>();
+
+/** The static permission a tool requires, or `undefined` when it declares none. */
+export function getToolRequiredPermission(name: string): number | undefined {
+  return toolPermissions.get(name);
+}
+
+/**
+ * Visibility rules for tools that gate per call rather than with one static bit
+ * (e.g. `omada_read`, whose permission depends on the resource path). The rule
+ * answers "can this caller use the tool at all?".
+ */
+const toolVisibilityRules = new Map<string, (callerPermissions: number) => boolean>();
+
+/** Declare when a tool without a static permission should be listed to a caller. */
+export function setToolVisibilityRule(name: string, isUsable: (callerPermissions: number) => boolean): void {
+  toolVisibilityRules.set(name, isUsable);
+}
+
+/**
+ * Whether `tools/list` should offer `name` to a caller: false when the caller lacks
+ * the tool's static permission, or when its visibility rule says the caller can use
+ * none of it. Tools with neither stay visible (their handlers still enforce RBAC).
+ */
+export function isToolVisibleTo(name: string, callerPermissions: number): boolean {
+  const required = toolPermissions.get(name);
+  if (required !== undefined && !hasPermission(callerPermissions, required)) {
+    return false;
+  }
+  const rule = toolVisibilityRules.get(name);
+  return rule ? rule(callerPermissions) : true;
+}
+
 /**
  * Wrap a tool handler with logging, error handling, and permission checking
  * Includes session ID and args in logs for debugging
@@ -86,6 +125,9 @@ export function wrapToolHandler<T>(
   handler: (args: T, extra: ToolExtra) => Promise<CallToolResult>,
   requiredPermission?: number
 ): (args: T, extra: ToolExtra) => Promise<CallToolResult> {
+  if (requiredPermission !== undefined) {
+    toolPermissions.set(name, requiredPermission);
+  }
   return async (args: T, extra: ToolExtra): Promise<CallToolResult> => {
     const sessionId = extra.sessionId ?? 'unknown-session';
     // Extract permissions from MCP SDK authInfo.extra.permissions.

package/src/tools/homeassistant/controlClimate.ts

@@ -5,6 +5,7 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { HaClient } from '../../haClient/index.js';
 import { controlClimateSchema, toToolResult, wrapToolHandler, Permission } from '../common.js';
+import { entityNotFoundResult } from './entityGuard.js';
 import type { z } from 'zod';
 
 type ControlClimateArgs = z.infer<typeof controlClimateSchema>;
@@ -17,6 +18,8 @@ export function registerControlClimateTool(server: McpServer, client: HaClient):
       inputSchema: controlClimateSchema.shape,
     },
     wrapToolHandler('controlClimate', async (args: ControlClimateArgs) => {
+      const missing = await entityNotFoundResult(client, args.entity_id);
+      if (missing) return missing;
       const results: unknown[] = [];
 
       if (args.hvac_mode !== undefined) {

package/src/tools/homeassistant/controlCover.ts

@@ -5,6 +5,7 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { HaClient } from '../../haClient/index.js';
 import { controlCoverSchema, toToolResult, wrapToolHandler, Permission } from '../common.js';
+import { entityNotFoundResult } from './entityGuard.js';
 import type { z } from 'zod';
 
 type ControlCoverArgs = z.infer<typeof controlCoverSchema>;
@@ -17,6 +18,8 @@ export function registerControlCoverTool(server: McpServer, client: HaClient): v
       inputSchema: controlCoverSchema.shape,
     },
     wrapToolHandler('controlCover', async (args: ControlCoverArgs) => {
+      const missing = await entityNotFoundResult(client, args.entity_id);
+      if (missing) return missing;
       const actionMap: Record<string, string> = {
         open: 'open_cover',
         close: 'close_cover',

package/src/tools/homeassistant/controlFan.ts

@@ -5,6 +5,7 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { HaClient } from '../../haClient/index.js';
 import { controlFanSchema, toToolResult, wrapToolHandler, Permission } from '../common.js';
+import { entityNotFoundResult } from './entityGuard.js';
 import type { z } from 'zod';
 
 type ControlFanArgs = z.infer<typeof controlFanSchema>;
@@ -17,6 +18,8 @@ export function registerControlFanTool(server: McpServer, client: HaClient): voi
       inputSchema: controlFanSchema.shape,
     },
     wrapToolHandler('controlFan', async (args: ControlFanArgs) => {
+      const missing = await entityNotFoundResult(client, args.entity_id);
+      if (missing) return missing;
       let service: string = args.action;
       const serviceData: Record<string, unknown> = {};