The Unofficial and Awesome Home Assistant MCP Server
This report summarizes scanner evidence for homeassistant-ai/ha-mcp, a Python project with 5,018 GitHub stars. SynthScan examined 819,318 lines of code across 1982 source files, recording 21543 pattern matches distributed across 24 syntactic categories. The legacy adjusted pattern signal is 32.7 (High pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 16195 finding(s).
Are imports declared and package/API names verified? 1778 finding(s).
Are wrappers, guards, and repeated structures necessary? 18190 finding(s).
Which changes need focused human review? 21543 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 21543 distinct pattern matches across 24 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | homeassistant-addon/start.py | 37 | def widen_fastmcp_log_console(width: int = 200) -> None: | CODE |
| LOW | homeassistant-addon/start.py | 82 | def get_or_create_secret_path(data_dir: Path, custom_path: str = "") -> str: | CODE |
| LOW | homeassistant-addon/start.py | 165 | def maybe_persist_secret_path( | CODE |
| LOW | homeassistant-addon/start.py | 293 | def resolve_effective_log_level() -> int: | CODE |
| LOW | homeassistant-addon/start.py | 327 | def maybe_auto_enable_beta_master(config: dict[str, Any], subflags: list[str]) -> None: | CODE |
| LOW | homeassistant-addon/start.py | 373 | def cleanup_stale_migration_marker(data_dir: Path) -> None: | CODE |
| LOW | homeassistant-addon/start.py | 392 | def _warn_gated_off_beta_subflags( | CODE |
| LOW | homeassistant-addon/start.py | 418 | def _arm_kill_signal_diagnostics_if_debug(effective_log_level: int) -> None: | CODE |
| LOW⚡ | tests/uat/test_openai_agent.py | 806 | async def test_none_when_model_not_listed(self, monkeypatch): | CODE |
| LOW⚡ | tests/uat/test_openai_agent.py | 815 | async def test_none_when_entry_has_no_quant(self, monkeypatch): | CODE |
| LOW⚡ | tests/uat/test_openai_agent.py | 822 | async def test_none_on_transport_error(self, monkeypatch): | CODE |
| LOW⚡ | tests/uat/test_openai_agent.py | 831 | async def test_none_on_http_error_status(self, monkeypatch): | CODE |
| LOW⚡ | tests/uat/test_openai_agent.py | 855 | def test_extracts_requested_and_context_tokens(self): | CODE |
| LOW⚡ | tests/uat/test_openai_agent.py | 861 | def test_none_for_unrelated_bad_request(self): | CODE |
| LOW⚡ | tests/uat/test_openai_agent.py | 865 | def test_marker_without_numbers_returns_none_pair(self): | CODE |
| LOW⚡ | tests/uat/test_openai_agent.py | 870 | def test_extracts_from_sdk_wire_format(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 24 | def test_missing_required_args_exits(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 65 | def test_warmup_failure_is_reported_on_stderr(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 93 | def test_basic_tool_conversion(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 123 | def test_tool_with_no_parameters(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 142 | async def test_direct_text_response(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 169 | async def test_no_think_sends_enable_thinking_false(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 203 | async def test_no_think_default_omits_extra_body(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 225 | async def test_no_think_warns_when_backend_still_reasons(self, caplog): | CODE |
| LOW | tests/uat/test_openai_agent.py | 253 | async def test_no_think_silent_when_backend_honors_it(self, caplog): | CODE |
| LOW | tests/uat/test_openai_agent.py | 281 | async def test_reasoning_tokens_captured_in_tokens_thoughts(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 308 | async def test_tokens_thoughts_zero_when_backend_omits_details(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 333 | async def test_no_think_warns_on_reasoning_content_without_token_detail( | CODE |
| LOW | tests/uat/test_openai_agent.py | 365 | async def test_no_think_warns_on_inline_think_block(self, caplog): | CODE |
| LOW | tests/uat/test_openai_agent.py | 394 | async def test_no_think_warns_only_once_across_turns(self, caplog): | CODE |
| LOW | tests/uat/test_openai_agent.py | 488 | async def test_tool_call_failure_counted(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 529 | async def test_malformed_tool_arguments_reported_as_error(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 570 | async def test_max_iterations_reached(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 635 | async def test_empty_choices_raises(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 673 | async def test_no_think_prepends_token_and_sends_kwarg(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 691 | async def test_default_omits_prepend_and_kwarg(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 714 | def test_non_text_content_falls_back_to_str(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 724 | def test_no_content_falls_back_to_str(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 738 | async def test_returns_first_model_id(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 747 | async def test_raises_when_no_models(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 889 | async def test_overflow_raises_context_window_exceeded(self): | CODE |
| LOW | tests/uat/test_openai_agent.py | 912 | async def test_unrelated_bad_request_propagates(self): | CODE |
| LOW | tests/uat/openai_agent.py | 570 | async def create_and_warm_openai_client( | CODE |
| LOW | tests/uat/test_openai_agent_search_trace.py | 79 | async def test_trace_lists_the_tools_a_search_returned( | CODE |
| LOW | tests/uat/test_openai_agent_search_trace.py | 104 | async def test_trace_flags_a_search_result_it_cannot_read(self): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 74 | def test_tokens_thoughts_defaults_to_zero_when_absent(tmp_path): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 83 | def test_model_from_call_site_param(tmp_path): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 89 | def test_model_call_site_arg_wins_over_test_phase(tmp_path): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 95 | def test_model_from_test_phase(tmp_path): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 101 | def test_model_defaults_to_none_when_absent(tmp_path): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 108 | def test_quantization_threaded_into_record(tmp_path): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 114 | def test_quantization_defaults_to_none_when_absent(tmp_path): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 121 | def test_extract_model_reads_claude_session(tmp_path): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 127 | def test_extract_model_none_on_malformed_session(tmp_path): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 134 | def test_model_from_claude_session_fallback(tmp_path): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 144 | def test_compute_passed_incomplete_run_fails_despite_verify(): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 233 | def test_clean_record_omits_error_fields(tmp_path): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 245 | def test_run_completed_uses_explicit_flag(): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 251 | def test_run_completed_fail_closed_on_missing_summary(): | CODE |
| LOW⚡ | tests/uat/stories/test_run_story_record.py | 261 | def test_run_completed_present_summary_missing_flag_uses_exit_code(): | CODE |
| 14393 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/uat/run_uat.py | 74 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/run_uat.py | 76 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/run_uat.py | 138 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/run_uat.py | 140 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/run_uat.py | 307 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/run_uat.py | 309 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/run_uat.py | 653 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/run_uat.py | 655 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/run_uat.py | 773 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/run_uat.py | 775 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/conftest.py | 44 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/conftest.py | 46 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/conftest.py | 63 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/conftest.py | 65 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/conftest.py | 124 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/conftest.py | 126 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/conftest.py | 136 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/conftest.py | 138 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/test_run_story_record.py | 141 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/test_run_story_record.py | 143 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/test_run_story_record.py | 240 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/test_run_story_record.py | 244 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/test_run_story_record.py | 304 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/test_run_story_record.py | 309 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/run_story.py | 98 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/run_story.py | 100 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/run_story.py | 107 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/run_story.py | 109 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/run_story.py | 301 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/run_story.py | 303 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/run_story.py | 345 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/run_story.py | 364 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/run_story.py | 366 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/run_story.py | 177 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/run_story.py | 179 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/run_story.py | 670 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/run_story.py | 672 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/run_story.py | 720 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/run_story.py | 722 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/run_story.py | 773 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/run_story.py | 775 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/run_story.py | 993 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/run_story.py | 995 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/scripts/verify_story.py | 130 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/uat/stories/scripts/verify_story.py | 132 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/scripts/verify_story.py | 26 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/scripts/verify_story.py | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/scripts/verify_story.py | 209 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/scripts/verify_story.py | 211 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/scripts/verify_story.py | 300 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/scripts/verify_story.py | 302 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/scripts/verify_story.py | 360 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/scripts/verify_story.py | 362 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/scripts/verify_story.py | 386 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/uat/stories/scripts/verify_story.py | 388 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/haos_image_build/build_image.py | 125 | # ┌──────────────────────┬────────────────────────────────────────────────┐ | COMMENT |
| MEDIUM | tests/haos_image_build/build_image.py | 127 | # ├──────────────────────┼────────────────────────────────────────────────┤ | COMMENT |
| MEDIUM | tests/haos_image_build/build_image.py | 141 | # └──────────────────────┴────────────────────────────────────────────────┘ | COMMENT |
| MEDIUM | tests/haos_image_build/build_image.py | 280 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/haos_image_build/build_image.py | 282 | # --------------------------------------------------------------------------- | COMMENT |
| 1360 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/addon/test_webhook_proxy.py | 0 | a valid (code_verifier, code_challenge) pair per rfc 7636 s256. | STRING |
| HIGH | tests/src/unit/test_oauth_autoapprove.py | 0 | a valid (code_verifier, code_challenge) pair per rfc 7636 s256. | STRING |
| HIGH | tests/src/unit/test_oauth_legacy_component.py | 0 | a valid (code_verifier, code_challenge) pair per rfc 7636 s256. | STRING |
| HIGH | tests/src/unit/test_alias_fetch_chunking.py | 0 | create smartsearchtools with mocked global settings. | STRING |
| HIGH | tests/src/unit/test_deep_search_tier3_parallel.py | 0 | create smartsearchtools with mocked global settings. | STRING |
| HIGH | tests/src/unit/test_performance_parallelization.py | 0 | create smartsearchtools with mocked global settings. | STRING |
| HIGH | tests/src/unit/test_smart_search_flow_helpers.py | 0 | construct smartsearchtools without loading global settings. | STRING |
| HIGH | tests/src/unit/test_smart_search_scene_phase25.py | 0 | construct smartsearchtools without loading global settings. | STRING |
| HIGH | …/src/unit/test_deep_search_helper_dashboard_partial.py | 0 | construct smartsearchtools without loading global settings. | STRING |
| HIGH | tests/src/unit/test_deep_search_helper_rename_1794.py | 0 | construct smartsearchtools without loading global settings. | STRING |
| HIGH | tests/src/unit/test_radio_management.py | 0 | register tools onto a mock mcp and return {tool_name: bound_method}. | STRING |
| HIGH | tests/src/unit/test_radio_thread.py | 0 | register tools onto a mock mcp and return {tool_name: bound_method}. | STRING |
| HIGH | tests/src/unit/test_radio_zwave.py | 0 | register tools onto a mock mcp and return {tool_name: bound_method}. | STRING |
| HIGH | tests/src/unit/test_radio_zigbee.py | 0 | register tools onto a mock mcp and return {tool_name: bound_method}. | STRING |
| HIGH | tests/src/unit/test_helper_param_rejection.py | 0 | register helper config tools and return the captured tool functions. | STRING |
| HIGH | tests/src/unit/test_helper_registry_id_validation.py | 0 | register helper config tools and return the captured tool functions. | STRING |
| HIGH | tests/src/unit/test_action_and_collision.py | 0 | register helper config tools and return the captured tool functions. | STRING |
| HIGH | tests/src/unit/test_helper_update_persistence.py | 0 | register helper config tools and return the captured tool functions. | STRING |
| HIGH | tests/src/unit/test_helper_field_persistence.py | 0 | register helper config tools and return the captured tool functions. | STRING |
| HIGH | tests/src/unit/test_flow_name_injection.py | 0 | register helper config tools and return the captured tool functions. | STRING |
| HIGH | tests/src/unit/test_action_discriminator.py | 0 | register helper config tools and return the captured tool functions. | STRING |
| HIGH | tests/src/unit/test_yaml_themes.py | 0 | minimal hass mock that runs executor jobs synchronously. | STRING |
| HIGH | tests/src/unit/test_yaml_whole_file_replace.py | 0 | minimal hass mock that runs executor jobs synchronously. | STRING |
| HIGH | tests/src/unit/test_yaml_edit_untouched_content.py | 0 | minimal hass mock that runs executor jobs synchronously. | STRING |
| HIGH | tests/src/unit/test_yaml_dashboards.py | 0 | minimal hass mock that runs executor jobs synchronously. | STRING |
| HIGH | tests/src/unit/test_rest_client_retry.py | 0 | ``homeassistantclient`` with stubbed internals — no real network. | STRING |
| HIGH | tests/src/unit/test_rest_client_admin_gate.py | 0 | ``homeassistantclient`` with stubbed internals — no real network. | STRING |
| HIGH | tests/src/unit/test_rest_client_states.py | 0 | ``homeassistantclient`` with stubbed internals — no real network. | STRING |
| HIGH | tests/src/unit/test_oauth_autoapprove.py | 0 | return whether a module name is ``root`` or one of its children. | STRING |
| HIGH | tests/src/unit/test_oauth_ha_auth.py | 0 | return whether a module name is ``root`` or one of its children. | STRING |
| HIGH | tests/src/unit/test_oauth_dcr.py | 0 | return whether a module name is ``root`` or one of its children. | STRING |
| HIGH | …/unit/test_ha_config_list_helpers_component_routing.py | 0 | a non-unknown command error → legacy path and a warnings[] entry. | STRING |
| HIGH | tests/src/unit/test_ha_search_component_routing.py | 0 | a non-unknown command error → legacy path and a warnings[] entry. | STRING |
| HIGH | tests/src/unit/test_ha_get_zone_component_routing.py | 0 | a non-unknown command error → legacy path and a warnings[] entry. | STRING |
| HIGH | tests/src/unit/test_ha_overview_component_routing.py | 0 | a non-unknown command error → legacy path and a warnings[] entry. | STRING |
| HIGH | tests/src/unit/_ratchet_repo.py | 0 | an empty git repository with no exclusions and an empty baseline. | STRING |
| HIGH | tests/src/unit/test_module_size_ratchet.py | 0 | an empty git repository with no exclusions and an empty baseline. | STRING |
| HIGH | tests/src/unit/test_duplicate_code_ratchet.py | 0 | an empty git repository with no exclusions and an empty baseline. | STRING |
| HIGH | tests/src/unit/test_ws_connect_auth_classification.py | 0 | yield the singleton manager with isolated, restored pool state. | STRING |
| HIGH | tests/src/unit/test_ws_pool_loop_change_1994.py | 0 | yield the singleton manager with isolated, restored pool state. | STRING |
| HIGH | tests/src/unit/test_ws_pool_stale_client_2127.py | 0 | yield the singleton manager with isolated, restored pool state. | STRING |
| HIGH | tests/src/e2e/_conftest_embedded.py | 0 | parse a streamable-http mcp response (json body or sse) to a json-rpc dict. | STRING |
| HIGH | tests/src/e2e/haos_only/test_embedded_server_haos.py | 0 | parse a streamable-http mcp response (json body or sse) to a json-rpc dict. | STRING |
| HIGH | …sts/src/e2e/workflows/embedded/test_embedded_server.py | 0 | parse a streamable-http mcp response (json body or sse) to a json-rpc dict. | STRING |
| HIGH | …/src/e2e/workflows/dashboards/test_python_transform.py | 0 | test that python_transform is mutually exclusive with config. | STRING |
| HIGH | …sts/src/e2e/workflows/scripts/test_python_transform.py | 0 | test that python_transform is mutually exclusive with config. | STRING |
| HIGH | …/src/e2e/workflows/automation/test_python_transform.py | 0 | test that python_transform is mutually exclusive with config. | STRING |
| HIGH | custom_components/ha_mcp_tools/cloudhook.py | 0 | buffer the upstream reply into a plain response, with a deadline for cloudhooks. | STRING |
| HIGH | …ant-addon-webhook-proxy-dev/mcp_proxy_dev/cloudhook.py | 0 | buffer the upstream reply into a plain response, with a deadline for cloudhooks. | STRING |
| HIGH | …meassistant-addon-webhook-proxy/mcp_proxy/cloudhook.py | 0 | buffer the upstream reply into a plain response, with a deadline for cloudhooks. | STRING |
| HIGH | custom_components/ha_mcp_tools/oauth_dcr.py | 0 | (scheme, host, port) origin identity with the scheme default applied. the one normalizer shared by registration validati | STRING |
| HIGH | …ant-addon-webhook-proxy-dev/mcp_proxy_dev/oauth_dcr.py | 0 | (scheme, host, port) origin identity with the scheme default applied. the one normalizer shared by registration validati | STRING |
| HIGH | …meassistant-addon-webhook-proxy/mcp_proxy/oauth_dcr.py | 0 | (scheme, host, port) origin identity with the scheme default applied. the one normalizer shared by registration validati | STRING |
| HIGH | custom_components/ha_mcp_tools/oauth_dcr.py | 0 | the request body, or none when it exceeds ``max_dcr_body_bytes``. reads to eof rather than taking one ``streamreader.rea | STRING |
| HIGH | …ant-addon-webhook-proxy-dev/mcp_proxy_dev/oauth_dcr.py | 0 | the request body, or none when it exceeds ``max_dcr_body_bytes``. reads to eof rather than taking one ``streamreader.rea | STRING |
| HIGH | …meassistant-addon-webhook-proxy/mcp_proxy/oauth_dcr.py | 0 | the request body, or none when it exceeds ``max_dcr_body_bytes``. reads to eof rather than taking one ``streamreader.rea | STRING |
| HIGH | custom_components/ha_mcp_tools/oauth_dcr.py | 0 | bind the view to the ha instance; liveness is resolved per request. | STRING |
| HIGH | custom_components/ha_mcp_tools/mcp_webhook.py | 0 | bind the view to the ha instance; liveness is resolved per request. | STRING |
| HIGH | custom_components/ha_mcp_tools/oauth_autoapprove.py | 0 | bind the view to the ha instance; liveness is resolved per request. | STRING |
| HIGH | …n-webhook-proxy-dev/mcp_proxy_dev/oauth_autoapprove.py | 0 | bind the view to the ha instance; liveness is resolved per request. | STRING |
| 423 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/uat/run_uat.py | 18 | CODE | |
| LOW | tests/uat/conftest.py | 8 | CODE | |
| LOW | tests/uat/_logging.py | 3 | CODE | |
| LOW | tests/uat/ha_wait.py | 8 | CODE | |
| LOW | tests/uat/test_openai_agent.py | 3 | CODE | |
| LOW | tests/uat/openai_agent.py | 15 | CODE | |
| LOW | tests/uat/_inprocess.py | 8 | CODE | |
| LOW | tests/uat/test_openai_agent_search_trace.py | 3 | CODE | |
| LOW | tests/uat/stories/conftest.py | 10 | CODE | |
| LOW | tests/uat/stories/test_stories.py | 13 | CODE | |
| LOW | tests/uat/stories/test_run_story_record.py | 3 | CODE | |
| LOW | tests/uat/stories/test_verify_story.py | 3 | CODE | |
| LOW | tests/uat/stories/test_run_story_cli.py | 3 | CODE | |
| LOW | tests/uat/stories/run_story.py | 41 | CODE | |
| LOW | tests/uat/stories/scripts/verify_story.py | 3 | CODE | |
| LOW | tests/uat/stories/scripts/ha_query.py | 27 | CODE | |
| LOW | tests/uat/stories/scripts/measure_tools.py | 19 | CODE | |
| LOW | tests/haos_image_build/build_image.py | 16 | CODE | |
| LOW | tests/haos_image_build/screenshot_engine_mock/server.py | 24 | CODE | |
| LOW | …ts/initial_test_state/custom_components/hacs/update.py | 3 | CODE | |
| LOW | …itial_test_state/custom_components/hacs/coordinator.py | 3 | CODE | |
| LOW | …itial_test_state/custom_components/hacs/diagnostics.py | 3 | CODE | |
| LOW | …/initial_test_state/custom_components/hacs/frontend.py | 3 | CODE | |
| LOW | …/initial_test_state/custom_components/hacs/__init__.py | 7 | CODE | |
| LOW | …/initial_test_state/custom_components/hacs/__init__.py | 112 | CODE | |
| LOW | …ts/initial_test_state/custom_components/hacs/switch.py | 3 | CODE | |
| LOW | …s/initial_test_state/custom_components/hacs/repairs.py | 3 | CODE | |
| LOW | …itial_test_state/custom_components/hacs/data_client.py | 3 | CODE | |
| LOW | …ts/initial_test_state/custom_components/hacs/entity.py | 3 | CODE | |
| LOW | tests/initial_test_state/custom_components/hacs/base.py | 3 | CODE | |
| LOW | …itial_test_state/custom_components/hacs/config_flow.py | 3 | CODE | |
| LOW | …ustom_components/hacs/validate/integration_manifest.py | 1 | CODE | |
| LOW | …l_test_state/custom_components/hacs/validate/issues.py | 1 | CODE | |
| LOW | …test_state/custom_components/hacs/validate/archived.py | 1 | CODE | |
| LOW | …t_state/custom_components/hacs/validate/description.py | 1 | CODE | |
| LOW | …t_state/custom_components/hacs/validate/information.py | 1 | CODE | |
| LOW | …test_state/custom_components/hacs/validate/hacsjson.py | 1 | CODE | |
| LOW | …l_test_state/custom_components/hacs/validate/topics.py | 1 | CODE | |
| LOW | …l_test_state/custom_components/hacs/validate/brands.py | 1 | CODE | |
| LOW | …l_test_state/custom_components/hacs/validate/images.py | 1 | CODE | |
| LOW | …_test_state/custom_components/hacs/validate/manager.py | 3 | CODE | |
| LOW | …ial_test_state/custom_components/hacs/validate/base.py | 3 | CODE | |
| LOW | …est_state/custom_components/hacs/websocket/critical.py | 3 | CODE | |
| LOW | …est_state/custom_components/hacs/websocket/__init__.py | 3 | CODE | |
| LOW | …state/custom_components/hacs/websocket/repositories.py | 3 | CODE | |
| LOW | …t_state/custom_components/hacs/websocket/repository.py | 3 | CODE | |
| LOW | …tial_test_state/custom_components/hacs/utils/backup.py | 3 | CODE | |
| LOW | …ial_test_state/custom_components/hacs/utils/version.py | 3 | CODE | |
| LOW | …l_test_state/custom_components/hacs/utils/decorator.py | 3 | CODE | |
| LOW | …al_test_state/custom_components/hacs/utils/validate.py | 3 | CODE | |
| LOW | …test_state/custom_components/hacs/utils/file_system.py | 3 | CODE | |
| LOW | …nitial_test_state/custom_components/hacs/utils/path.py | 3 | CODE | |
| LOW | …nitial_test_state/custom_components/hacs/utils/json.py | 3 | CODE | |
| LOW | …itial_test_state/custom_components/hacs/utils/regex.py | 3 | CODE | |
| LOW | …ial_test_state/custom_components/hacs/utils/filters.py | 3 | CODE | |
| LOW | …nitial_test_state/custom_components/hacs/utils/data.py | 3 | CODE | |
| LOW | …st_state/custom_components/hacs/utils/queue_manager.py | 3 | CODE | |
| LOW | …est_state/custom_components/hacs/repositories/theme.py | 3 | CODE | |
| LOW | …_state/custom_components/hacs/repositories/__init__.py | 3 | CODE | |
| LOW | …ate/custom_components/hacs/repositories/integration.py | 3 | CODE | |
| 1544 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .gemini/styleguide.md | 210 | except Exception as exc: | CODE |
| LOW | homeassistant-addon/start.py | 122 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | homeassistant-addon/start.py | 132 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | homeassistant-addon/start.py | 314 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | homeassistant-addon/start.py | 435 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | homeassistant-addon/start.py | 498 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | homeassistant-addon/start.py | 623 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/test_env_manager.py | 232 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/test_env_manager.py | 262 | except Exception: # noqa: BLE001 | CODE |
| LOW | tests/test_env_manager.py | 353 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/uat/run_uat.py | 125 | except Exception: | CODE |
| LOW | tests/uat/openai_agent.py | 162 | except Exception as e: # best-effort enrichment, never fatal # noqa: BLE001 | CODE |
| LOW | tests/uat/openai_agent.py | 317 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/uat/openai_agent.py | 615 | except Exception: | CODE |
| LOW | tests/uat/openai_agent.py | 626 | except Exception: | CODE |
| LOW⚡ | tests/uat/stories/conftest.py | 147 | except Exception as e: | CODE |
| LOW | tests/uat/stories/conftest.py | 160 | except Exception as e: # noqa: BLE001 | CODE |
| LOW⚡ | tests/uat/stories/run_story.py | 294 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW⚡ | tests/uat/stories/run_story.py | 354 | except Exception: | CODE |
| LOW | tests/uat/stories/run_story.py | 155 | except Exception: | CODE |
| LOW | tests/uat/stories/run_story.py | 213 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | tests/uat/stories/run_story.py | 239 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | tests/uat/stories/run_story.py | 550 | except Exception as e: | CODE |
| LOW | tests/uat/stories/run_story.py | 686 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/uat/stories/run_story.py | 706 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/uat/stories/run_story.py | 1064 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/uat/stories/run_story.py | 1086 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/uat/stories/scripts/verify_story.py | 69 | except Exception: # noqa: BLE001 | CODE |
| LOW | tests/uat/stories/scripts/verify_story.py | 88 | except Exception: # noqa: BLE001 | CODE |
| LOW | tests/uat/stories/scripts/verify_story.py | 151 | except Exception: # noqa: BLE001 | CODE |
| LOW | tests/uat/stories/scripts/verify_story.py | 231 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/uat/stories/scripts/verify_story.py | 257 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/uat/stories/scripts/verify_story.py | 285 | except Exception as e: # noqa: BLE001 | CODE |
| MEDIUM | tests/uat/stories/scripts/ha_query.py | 250 | print(f"Error: {args.agent} CLI not found", file=sys.stderr) | CODE |
| LOW | tests/uat/stories/scripts/measure_tools.py | 148 | except Exception as e: # noqa: BLE001 | STRING |
| MEDIUM | tests/haos_image_build/build_image.py | 815 | def send() -> None: | CODE |
| LOW | tests/haos_image_build/build_image.py | 490 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/haos_image_build/build_image.py | 823 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | tests/haos_image_build/build_image.py | 2805 | except Exception: | CODE |
| LOW | …itial_test_state/custom_components/hacs/data_client.py | 56 | except Exception as exception: | CODE |
| LOW | …t_state/custom_components/hacs/websocket/repository.py | 50 | except Exception as exception: # pylint: disable=broad-except | CODE |
| LOW | …t_state/custom_components/hacs/websocket/repository.py | 266 | except Exception as exception: # pylint: disable=broad-except | CODE |
| LOW | …t_state/custom_components/hacs/websocket/repository.py | 351 | except Exception as exception: | CODE |
| LOW | …ate/custom_components/hacs/repositories/integration.py | 216 | except Exception: # pylint: disable=broad-except | CODE |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 1374 | except Exception: # pylint: disable=broad-except | CODE |
| LOW | tests/addon/test_addon_structure.py | 262 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | tests/src/haos_runtime.py | 268 | except Exception as probe_err: # noqa: BLE001 # pragma: no cover - diagnostics best-effort | CODE |
| LOW | tests/src/unit/_embedded_stubs.py | 269 | except Exception as err: # matches real HA's broad catch-and-log | CODE |
| MEDIUM | tests/src/unit/_embedded_stubs.py | 266 | def async_refresh(self) -> None: | CODE |
| LOW | tests/src/unit/test_session_disconnect_log_filter.py | 49 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | tests/src/unit/test_component_backup_prep_contract.py | 53 | except Exception as exc: # the REAL component's raise path | CODE |
| LOW | tests/src/unit/test_identifier_validation_family.py | 871 | except Exception: # noqa: BLE001 | CODE |
| MEDIUM | tests/src/unit/test_usage_logger.py | 113 | def writer_thread(thread_id): | CODE |
| MEDIUM | tests/src/unit/test_usage_logger.py | 125 | def reader_thread(): | CODE |
| LOW | tests/src/unit/test_usage_logger.py | 122 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/src/unit/test_usage_logger.py | 130 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/src/e2e/_conftest_readiness.py | 447 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | tests/src/e2e/_conftest_readiness.py | 510 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | tests/src/e2e/conftest.py | 233 | except Exception as e: # noqa: BLE001 | CODE |
| LOW | tests/src/e2e/conftest.py | 390 | except Exception as e: # noqa: BLE001 | CODE |
| 940 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/haos_image_build/build_image.py | 2452 | # the config_entries/disable WS command (disabled_by=null). | COMMENT |
| HIGH⚡ | tests/lab-setup/test_setup_script.py | 14 | assert 'git -C "$SETUP_HOME/ha-mcp" pull --ff-only || true' not in content | CODE |
| HIGH | tests/src/conftest.py | 8 | cd tests && uv run pytest src/unit/ -n2 | STRING |
| HIGH | tests/src/conftest.py | 9 | cd tests && uv run pytest src/e2e/ -n2 --dist loadscope | STRING |
| HIGH | tests/src/unit/test_webhook_proxy_oauth_unified.py | 1036 | b'{"refresh_token":null}', | CODE |
| HIGH | tests/src/unit/test_alias_fetch_chunking.py | 208 | then carries ``aliases: [null, ...]``. Ingesting the null would put | STRING |
| HIGH | tests/src/unit/test_tools_entities.py | 2464 | [[None, "Maanlamp"], '[null, "Maanlamp"]'], | CODE |
| HIGH | tests/src/unit/test_tools_entities.py | 2417 | """Registry has [null]; a string-only list must not drop it.""" | STRING |
| HIGH | tests/src/unit/test_helper_list_registry_join.py | 112 | """When the registry entry has no custom name (name is null), the current | STRING |
| HIGH | tests/src/unit/test_custom_card_limits.py | 50 | + ("undefined;" if module else "globalThis;") | STRING |
| HIGH | tests/src/unit/test_anti_fouc_behavior.py | 168 | getItem: (k) => _storage[k] || null, | CODE |
| HIGH | tests/src/unit/test_anti_fouc_behavior.py | 246 | getItem: (k) => _storage[k] || null, | CODE |
| HIGH | tests/src/unit/test_anti_fouc_behavior.py | 295 | getItem: (k) => _storage[k] || null, | CODE |
| HIGH⚡ | tests/src/unit/test_oauth_ha_auth.py | 1181 | b'{"refresh_token":null}', | CODE |
| HIGH⚡ | tests/src/unit/test_best_practice_checker.py | 2438 | """A variables key reading a LATER sibling renders undefined, silently.""" | STRING |
| HIGH | tests/src/unit/test_e2e_lane_env_shape.py | 521 | " - run: cd tests && uv run pytest src/e2e/performance/ -m perf\n" | CODE |
| HIGH | tests/src/unit/test_e2e_lane_env_shape.py | 524 | " - run: cd tests && uv run pytest src/e2e/ --tb=short\n", | CODE |
| HIGH⚡ | tests/src/unit/test_server_prefs_seed.py | 55 | getItem: (k) => _storage[k] || null, | CODE |
| HIGH⚡ | tests/src/unit/test_server_prefs_seed.py | 63 | value: {{ getAttribute: (name) => name === 'data-prefs' ? serverPrefsJson : null }}, | CODE |
| HIGH⚡ | tests/src/unit/test_server_prefs_seed.py | 83 | getItem: (k) => _storage[k] || null, | CODE |
| HIGH⚡ | tests/src/unit/test_server_prefs_seed.py | 90 | value: { getAttribute: (name) => name === 'data-prefs' ? '__HA_MCP_THEME_PREFS__' : null }, | CODE |
| HIGH⚡ | tests/src/unit/test_server_prefs_seed.py | 105 | getItem: (k) => _storage[k] || null, | CODE |
| HIGH⚡ | tests/src/unit/test_server_prefs_seed.py | 111 | value: { getAttribute: (name) => name === 'data-prefs' ? 'not valid json {{{' : null }, | CODE |
| HIGH | tests/src/unit/test_server_prefs_seed.py | 130 | getItem: (k) => _storage[k] || null, | CODE |
| HIGH | tests/src/unit/test_server_prefs_seed.py | 137 | value: {{ getAttribute: (name) => name === 'data-prefs' ? serverPrefsJson : null }}, | CODE |
| HIGH⚡ | tests/src/unit/test_graceful_shutdown.py | 510 | """Stdin should not be available when char device but not tty (like /dev/null).""" | STRING |
| HIGH | tests/src/unit/test_astro_setup_js_behavior.py | 552 | document.body.dataset.configCode = (codeEl && codeEl.textContent) || ''; | CODE |
| HIGH | tests/src/unit/test_astro_setup_js_behavior.py | 554 | (instructionsEl && instructionsEl.innerHTML || '').length | CODE |
| HIGH | tests/src/unit/test_astro_setup_js_behavior.py | 699 | (instructionsEl && instructionsEl.innerHTML) || '' | CODE |
| HIGH | tests/src/unit/test_astro_setup_js_behavior.py | 839 | (instructionsEl && instructionsEl.innerHTML) || '' | CODE |
| HIGH | …sts/src/unit/test_settings_ui_policy_and_conditions.py | 40 | if (path !== null) { | CODE |
| HIGH | …sts/src/unit/test_settings_ui_policy_and_conditions.py | 467 | if (opts && opts.method === 'PUT' && ++putCount === %d) await sleep(1500); | CODE |
| HIGH | …sts/src/unit/test_settings_ui_policy_and_conditions.py | 555 | await fill(null, '"garage"'); | CODE |
| HIGH | …sts/src/unit/test_settings_ui_policy_and_conditions.py | 220 | await fill(null, '"turn_off"'); | STRING |
| HIGH | …sts/src/unit/test_settings_ui_policy_and_conditions.py | 359 | if (opts && opts.method === 'PUT' && !held) { held = true; await sleep(2000); } | STRING |
| HIGH | …sts/src/unit/test_settings_ui_policy_and_conditions.py | 391 | if (opts && opts.method === 'PUT' && !held) { held = true; await sleep(2000); } | STRING |
| HIGH | …sts/src/unit/test_settings_ui_policy_and_conditions.py | 436 | if (opts && opts.method === 'PUT' && !held) { held = true; await sleep(2000); } | STRING |
| HIGH | …sts/src/unit/test_settings_ui_policy_and_conditions.py | 619 | await fill(null, '"garage"'); | STRING |
| HIGH | …sts/src/unit/test_settings_ui_policy_and_conditions.py | 656 | await fill(null, '"turn_off"'); | STRING |
| HIGH | …sts/src/unit/test_settings_ui_policy_and_conditions.py | 731 | .filter(n => !(n.classList && n.classList.contains('visually-hidden'))) | STRING |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 95 | # returns null) and the behavioural tests find an empty body. | COMMENT |
| HIGH⚡ | tests/src/unit/test_settings_ui_js_behavior.py | 1680 | master.indeterminate || master.disabled); | CODE |
| HIGH⚡ | tests/src/unit/test_settings_ui_js_behavior.py | 1682 | tool.indeterminate && tool.disabled); | CODE |
| HIGH⚡ | tests/src/unit/test_settings_ui_js_behavior.py | 1684 | !!notice && notice.classList.contains('show')); | CODE |
| HIGH⚡ | tests/src/unit/test_settings_ui_js_behavior.py | 1785 | !!notice && notice.classList.contains('show')); | CODE |
| HIGH⚡ | tests/src/unit/test_settings_ui_js_behavior.py | 1787 | master.indeterminate && master.disabled); | CODE |
| HIGH⚡ | tests/src/unit/test_settings_ui_js_behavior.py | 1789 | tool.indeterminate && tool.disabled); | CODE |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 1629 | probe.dataset.blocked = String(cb.indeterminate && cb.disabled); | CODE |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 1631 | !!notice && notice.classList.contains('show')); | CODE |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 2186 | const rem = card ? card.querySelector('.policy-remember-minutes') : null; | CODE |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 4553 | document.body.setAttribute('data-rendered', String(!!cb && cb.checked)); | CODE |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 5917 | !!notice && notice.classList.contains('show')); | CODE |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 6063 | + `dismiss=${!!(t && t.querySelector('.ha-toast-dismiss'))}`); | CODE |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 6101 | + `dismiss=${!!(t && t.querySelector('.ha-toast-dismiss'))}`); | CODE |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 6391 | if (document.activeElement && document.activeElement.blur) { | CODE |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 6459 | const checkedBefore = !!(before && before.checked); | CODE |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 6464 | document.body.setAttribute('data-after', String(!!(after && after.checked))); | CODE |
| HIGH | tests/src/unit/test_settings_ui_js_behavior.py | 7915 | policyState.toolsEffect = null; | CODE |
| HIGH | tests/src/unit/test_theme_toggle_behavior.py | 109 | getItem: (k) => _storage.hasOwnProperty(k) ? _storage[k] : null, | CODE |
| HIGH | tests/src/unit/test_theme_toggle_behavior.py | 161 | getItem: (k) => _storage.hasOwnProperty(k) ? _storage[k] : null, | CODE |
| 101 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/uat/run_uat.py | 426 | except json.JSONDecodeError: | CODE |
| HIGH | tests/uat/stories/run_story.py | 459 | except json.JSONDecodeError: | CODE |
| HIGH | tests/uat/stories/scripts/ha_query.py | 142 | except json.JSONDecodeError: | CODE |
| HIGH | tests/haos_image_build/build_image.py | 327 | except (OSError, UnicodeDecodeError): | CODE |
| HIGH | …/initial_test_state/custom_components/hacs/__init__.py | 82 | except BaseException: # lgtm [py/catch-base-exception] pylint: disable=broad-except | CODE |
| HIGH | …/initial_test_state/custom_components/hacs/__init__.py | 212 | except AttributeError: | CODE |
| HIGH | …/initial_test_state/custom_components/hacs/__init__.py | 113 | except ImportError: | CODE |
| HIGH | tests/initial_test_state/custom_components/hacs/base.py | 1036 | except HacsException: | CODE |
| HIGH | …ial_test_state/custom_components/hacs/utils/version.py | 25 | except (AwesomeVersionException, AttributeError, KeyError): | CODE |
| HIGH | …nitial_test_state/custom_components/hacs/utils/data.py | 164 | except HomeAssistantError: | CODE |
| HIGH | …st_state/custom_components/hacs/repositories/plugin.py | 108 | except BaseException: # lgtm [py/catch-base-exception] pylint: disable=broad-except | CODE |
| HIGH | …test_state/custom_components/hacs/repositories/base.py | 727 | except BaseException: | CODE |
| HIGH | tests/src/unit/conftest.py | 102 | except ImportError: | CODE |
| HIGH | tests/src/unit/_js_harness.py | 312 | except OSError: | CODE |
| HIGH | tests/src/unit/test_graceful_shutdown.py | 258 | except asyncio.CancelledError: | CODE |
| HIGH | tests/src/unit/test_graceful_shutdown.py | 294 | except (TimeoutError, asyncio.CancelledError): | CODE |
| HIGH | tests/src/unit/test_graceful_shutdown.py | 342 | except (TimeoutError, asyncio.CancelledError): | CODE |
| HIGH | tests/src/unit/test_graceful_shutdown.py | 418 | except asyncio.CancelledError: | CODE |
| HIGH | tests/src/unit/test_python_sandbox.py | 661 | except PythonSandboxValidationError: | CODE |
| HIGH | tests/src/unit/test_python_sandbox.py | 672 | except PythonSandboxExecutionError: | CODE |
| HIGH | tests/src/unit/test_identifier_validation_family.py | 699 | except (AttributeError, KeyError, TypeError): | CODE |
| HIGH | tests/src/unit/test_identifier_validation_family.py | 871 | except Exception: # noqa: BLE001 | CODE |
| HIGH | tests/src/unit/policy/test_middleware.py | 1420 | except ToolError: | CODE |
| HIGH | tests/src/e2e/_conftest_readiness.py | 201 | except requests.exceptions.RequestException: | CODE |
| HIGH | tests/src/e2e/_conftest_haos.py | 298 | except ( | CODE |
| HIGH | tests/src/e2e/_conftest_seed.py | 194 | except FileNotFoundError: | CODE |
| HIGH | tests/src/e2e/_conftest_embedded.py | 295 | except requests.exceptions.RequestException: | CODE |
| HIGH | tests/src/e2e/workflows/todo/test_lifecycle.py | 560 | except Exception: # noqa: BLE001 | CODE |
| HIGH | …rc/e2e/workflows/embedded/test_embedded_update_path.py | 322 | except OSError: | CODE |
| HIGH | …rc/e2e/workflows/embedded/test_embedded_update_path.py | 332 | except requests.exceptions.RequestException: | CODE |
| HIGH | …sts/src/e2e/workflows/embedded/test_embedded_server.py | 219 | except OSError: | CODE |
| HIGH | …sts/src/e2e/workflows/embedded/test_embedded_server.py | 229 | except requests.exceptions.RequestException: | CODE |
| HIGH | …orkflows/embedded/test_embedded_dependency_conflict.py | 352 | except OSError: | CODE |
| HIGH | …orkflows/embedded/test_embedded_dependency_conflict.py | 379 | except requests.exceptions.RequestException: | CODE |
| HIGH | …ts/src/e2e/workflows/hacs/test_auto_refresh_startup.py | 155 | except HomeAssistantCommandTimeout: | CODE |
| HIGH | tests/src/e2e/workflows/entities/test_show_as.py | 53 | except ToolError: | CODE |
| HIGH | tests/src/e2e/utilities/wait_helpers.py | 773 | except (websockets.exceptions.WebSocketException, OSError): | CODE |
| HIGH | tests/src/e2e/utilities/wait_helpers.py | 871 | except (websockets.exceptions.WebSocketException, OSError): | CODE |
| HIGH | custom_components/ha_mcp_tools/embedded_server.py | 1746 | except ImportError: | CODE |
| HIGH | custom_components/ha_mcp_tools/embedded_server.py | 1777 | except ImportError: | CODE |
| HIGH | custom_components/ha_mcp_tools/embedded_server.py | 484 | except RuntimeError: | CODE |
| HIGH | custom_components/ha_mcp_tools/embedded_setup.py | 368 | except ImportError: | CODE |
| HIGH | custom_components/ha_mcp_tools/embedded_setup.py | 366 | except CloudNotAvailable: | CODE |
| HIGH | custom_components/ha_mcp_tools/card_runtime.py | 26 | except metadata.PackageNotFoundError: | CODE |
| HIGH | …stom_components/ha_mcp_tools/dependency_diagnostics.py | 296 | except InvalidVersion: | CODE |
| HIGH | custom_components/ha_mcp_tools/oauth_ha_auth.py | 321 | except ValueError: | CODE |
| HIGH | custom_components/ha_mcp_tools/websocket_api/bulk.py | 297 | except TimeoutError: | CODE |
| HIGH | …_components/ha_mcp_tools/websocket_api/call_service.py | 379 | except TimeoutError: | CODE |
| HIGH | scripts/translate_locales.py | 766 | except (KeyError, IndexError, TypeError): | CODE |
| HIGH | scripts/bake_pagination_seed.py | 129 | except requests.exceptions.RequestException: | CODE |
| HIGH | scripts/bake_pagination_seed.py | 146 | except requests.exceptions.RequestException: | CODE |
| HIGH | scripts/bake_local_calendar.py | 139 | except requests.exceptions.RequestException: | CODE |
| HIGH | scripts/bake_local_calendar.py | 204 | except subprocess.CalledProcessError: | CODE |
| HIGH | .github/dev-ha-env/hold.py | 184 | except requests.ConnectionError: | CODE |
| HIGH | homeassistant-addon-webhook-proxy-dev/start.py | 708 | except OSError: | CODE |
| HIGH | homeassistant-addon-webhook-proxy-dev/start.py | 245 | except Exception: | CODE |
| HIGH | homeassistant-addon-webhook-proxy-dev/start.py | 276 | except Exception: | CODE |
| HIGH | homeassistant-addon-webhook-proxy-dev/start.py | 542 | except OSError: | CODE |
| HIGH | homeassistant-addon-webhook-proxy-dev/start.py | 1670 | except OSError: | CODE |
| HIGH | …sistant-addon-webhook-proxy-dev/mcp_proxy_dev/oauth.py | 250 | except OSError: | CODE |
| 110 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/src/e2e/workflows/device_control/test_lights.py | 28 | Validate and return entity state data. Args: state_data: Parsed MCP result from ha_get_state entity | STRING |
| HIGH | tests/src/e2e/utilities/wait_helpers.py | 359 | Poll an MCP tool until the result satisfies a predicate. Useful when an entity was just created and needs time | STRING |
| HIGH | tests/src/e2e/utilities/wait_helpers.py | 668 | Subscribe → sample-after-subscribe → wait-for-event pattern, test-side. Mirrors :func:`ha_mcp.tools.ws_waiters._ws_ | STRING |
| HIGH | src/ha_mcp/tools/backup.py | 223 | Retrieve default backup password from Home Assistant configuration. Args: ws_client: Connected WebSock | STRING |
| HIGH | src/ha_mcp/tools/device_control.py | 111 | Universal smart device control with async verification. This tool provides intelligent device control | STRING |
| HIGH | src/ha_mcp/tools/coercion.py | 37 | Parse flexibly JSON string or return existing dict/list. Args: param: JSON string, dict, list, or None | STRING |
| HIGH | src/ha_mcp/tools/flow_helper_lookup.py | 155 | Resolve a flow-helper target to its config_entry_id via entity_registry. Used by ha_remove_helpers_integrations whe | STRING |
| HIGH | src/ha_mcp/tools/helpers.py | 179 | Reject ``None``, empty, or whitespace-only identifier values. Surfaces a structured ``VALIDATION_INVALID_PARAMETER` | STRING |
| HIGH | src/ha_mcp/tools/helpers.py | 565 | Convert an exception to a structured error response. This function maps common exception types to appropriate | STRING |
| HIGH | src/ha_mcp/tools/smart_search/_entities.py | 75 | Search entities with fuzzy matching and typo tolerance. Args: query: Search query (can be | STRING |
| HIGH | src/ha_mcp/tools/smart_search/_entities.py | 458 | Get entities grouped by area/room using the HA registries for accurate area resolution. Uses the entit | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/tools/tool_transform.py | 48 | Forward to parent tool with argument transformation applied. This function can only be called from within a transfo | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/tools/tool_transform.py | 78 | Forward directly to parent tool without transformation. This function bypasses all argument transformation and vali | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/tools/tool_transform.py | 413 | Create a transformed tool from a parent tool. Args: tool: The parent tool to transform. | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/server.py | 1384 | Call a tool by name. This is the public API for executing tools. By default, middleware is applied. Ar | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/server.py | 1574 | Read a resource by URI. This is the public API for reading resources. By default, middleware is applied. | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/server.py | 1733 | Render a prompt by name. This is the public API for rendering prompts. By default, middleware is applied. | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/dependencies.py | 1417 | Get a specific claim from the access token. This dependency extracts a single claim value from the current access t | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/lifespan.py | 95 | Compose with another lifespan using the | operator. Args: other: Another Lifespan instance. | STRING |
| HIGH | …_mcp/_vendor/fastmcp/server/auth/identity_assertion.py | 330 | Validate an ID-JAG and return its claims. Args: assertion: The compact-serialized ID-JAG JWT. | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/auth/ssrf.py | 176 | Resolve hostname to IP addresses using DNS. Args: hostname: Hostname to resolve port: Port number ( | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/auth/ssrf.py | 275 | Validate URL for SSRF and resolve to IPs. Args: url: URL to validate require_path: If True, require | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/auth/ssrf.py | 378 | Fetch URL with comprehensive SSRF protection and DNS pinning. Security measures: 1. HTTPS only 2. DNS resol | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/auth/cimd.py | 316 | Fetch and validate a CIMD document with SSRF protection. Uses ssrf_safe_fetch_response for the HTTP layer, whic | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/auth/cimd.py | 534 | Validate JWT assertion from client. Args: assertion: The JWT assertion string client_id | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/auth/cimd.py | 654 | Extract public key from inline JWKS. Args: token: JWT token to extract kid from jwks: J | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/auth/cimd.py | 803 | Validate JWT assertion for private_key_jwt auth. Args: assertion: JWT assertion string from client | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/server/auth/jwt_issuer.py | 237 | Verify and decode a FastMCP token. Validates JWT signature, expiration, issuer, audience, and token type. | STRING |
| HIGH | …/ha_mcp/_vendor/fastmcp/server/auth/providers/azure.py | 630 | Get a cached or new OnBehalfOfCredential for OBO token exchange. Credentials are cached by user assertion so th | STRING |
| HIGH | …/ha_mcp/_vendor/fastmcp/server/auth/providers/azure.py | 872 | Exchange the user's Entra token for a downstream API token via OBO. This dependency performs a Microsoft Entra On-B | STRING |
| HIGH | …endor/fastmcp/server/providers/filesystem_discovery.py | 143 | Import a Python file as a module. If the file is part of a package (directory has __init__.py), imports it as a | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/utilities/auth.py | 11 | Decode a JWT part (header or payload) without signature verification. Args: token: JWT token string (header | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/utilities/auth.py | 33 | Decode JWT header without signature verification. Useful for extracting the key ID (kid) for JWKS lookup. Args | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/utilities/auth.py | 50 | Decode JWT payload without signature verification. Use only for tokens received directly from trusted sources (e.g. | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/utilities/skills.py | 88 | Get the manifest for a specific skill. Args: client: Connected FastMCP client skill_name: Name of t | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/utilities/skills.py | 134 | Download a skill and all its files to a local directory. Creates a subdirectory named after the skill containing al | STRING |
| HIGH | …c/ha_mcp/_vendor/fastmcp/utilities/json_schema_type.py | 170 | Convert JSON schema to appropriate Python type with validation. Args: schema: A JSON Schema dictionary defi | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/utilities/pagination.py | 65 | Paginate a sequence of items. Args: items: The full sequence to paginate. cursor: Optional cursor f | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/utilities/openapi/parser.py | 626 | Extract only the schema definitions needed for input (parameters and request body). Args: | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/utilities/openapi/schemas.py | 80 | Replace openapi $ref with jsonschema $defs recursively. Examples: - {"type": "object", "properties": {"$re | STRING |
| HIGH | …cp/utilities/mcp_server_config/v1/mcp_server_config.py | 224 | Load configuration from a JSON file. Args: file_path: Path to the configuration file Retur | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/apps/file_upload.py | 233 | Read a file's contents by name. Args: name: The filename to read. ctx: The current requ | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/client.py | 897 | Send an initialize request to the server. This method performs the MCP initialization handshake with the server | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/client.py | 1166 | Await a coroutine while monitoring the session task for errors. When using HTTP transports, server errors (4xx/ | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/client.py | 1470 | Send a completion request and return the complete MCP protocol result. Args: ref (mcp_types.Resourc | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/client.py | 1501 | Send a completion request to the server. Args: ref (mcp_types.ResourceTemplateReference | mcp_types | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/tools.py | 40 | Send a tools/list request and return the complete MCP protocol result. Args: cursor: Optional pagin | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/tools.py | 96 | Retrieve all tools available on the server. This method automatically fetches all pages if the server paginates | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/tools.py | 154 | Send a tools/call request and return the complete MCP protocol result. This method returns the raw CallToolResu | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/tools.py | 292 | Call a tool on the server. Unlike call_tool_mcp, this method raises a ToolError if the tool call results in an | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/prompts.py | 34 | Send a prompts/list request and return the complete MCP protocol result. Args: cursor: Optional pag | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/prompts.py | 76 | Retrieve all prompts available on the server. This method automatically fetches all pages if the server paginat | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/prompts.py | 126 | Send a prompts/get request and return the complete MCP protocol result. Args: name (str): The name | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/prompts.py | 194 | Retrieve a rendered prompt message list from the server. Args: name (str): The name of the prompt t | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/resources.py | 34 | Send a resources/list request and return the complete MCP protocol result. Args: cursor: Optional p | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/resources.py | 76 | Retrieve all resources available on the server. This method automatically fetches all pages if the server pagin | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/resources.py | 125 | Send a resources/listResourceTemplates request and return the complete MCP protocol result. Args: c | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/resources.py | 170 | Retrieve all resource templates available on the server. This method automatically fetches all pages if the ser | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/resources.py | 218 | Send a resources/read request and return the complete MCP protocol result. Args: uri (AnyUrl | str) | STRING |
| HIGH | src/ha_mcp/_vendor/fastmcp/client/mixins/resources.py | 274 | Read the contents of a resource or resolved template. Args: uri (AnyUrl | str): The URI of the reso | STRING |
| 56 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_env_manager.py | 34 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | tests/uat/stories/conftest.py | 37 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/uat/stories/test_stories.py | 25 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | …ts/initial_test_state/custom_components/hacs/update.py | 148 | def _update_download_progress(self, data: dict) -> None: | CODE |
| LOW⚡ | …ts/initial_test_state/custom_components/hacs/update.py | 155 | def _update_in_progress(self, progress: int | bool) -> None: | CODE |
| LOW | …ts/initial_test_state/custom_components/hacs/entity.py | 68 | def _update_and_write_state(self, _: Any) -> None: | CODE |
| LOW | tests/initial_test_state/custom_components/hacs/base.py | 136 | def update_from_dict(self, data: dict) -> None: | CODE |
| LOW | tests/initial_test_state/custom_components/hacs/base.py | 388 | def set_stage(self, stage: HacsStage | None) -> None: | CODE |
| LOW | tests/initial_test_state/custom_components/hacs/base.py | 765 | def set_active_categories(self) -> None: | CODE |
| LOW | tests/initial_test_state/custom_components/hacs/base.py | 994 | async def update_repository(repository: HacsRepository) -> None: | CODE |
| LOW | tests/initial_test_state/custom_components/hacs/base.py | 1010 | async def update_coordinators() -> None: | CODE |
| LOW | …nitial_test_state/custom_components/hacs/utils/json.py | 5 | __all__ = ["json_loads"] | CODE |
| LOW | …est_state/custom_components/hacs/repositories/theme.py | 113 | def update_filenames(self) -> None: | CODE |
| LOW | …st_state/custom_components/hacs/repositories/plugin.py | 111 | def update_filenames(self) -> None: | CODE |
| LOW | …st_state/custom_components/hacs/repositories/plugin.py | 205 | async def update_dashboard_resources(self) -> None: | CODE |
| LOW | …e/custom_components/hacs/repositories/python_script.py | 105 | def update_filenames(self) -> None: | CODE |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 194 | def update_data(self, data: dict, action: bool = False) -> None: | CODE |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 256 | def update_data(self, data: dict) -> None: | CODE |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 467 | async def update_repository(self, ignore_issues=False, force=False) -> None: | CODE |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 1018 | def update_filenames(self) -> None: | CODE |
| LOW | tests/src/unit/_embedded_stubs.py | 401 | def set_cookie(self, name: str, value: str, **attrs: Any) -> None: | CODE |
| LOW | …src/unit/test_ha_dev_server_entry_component_routing.py | 69 | def set_flow(self, entry_id: str, flow: Any) -> None: | CODE |
| LOW | tests/src/unit/test_ha_search_component_routing.py | 132 | def _setup_visibility_disabled(tmp_path: Any, monkeypatch: Any) -> None: | CODE |
| LOW | tests/src/unit/test_ha_overview_component_routing.py | 159 | def _setup_visibility_disabled(tmp_path: Any, monkeypatch: Any) -> None: | CODE |
| LOW | tests/src/unit/_component_ws_api.py | 24 | __all__ = ["COMPONENT_VERSION", "wsapi"] | CODE |
| LOW | tests/src/unit/test_wait_helpers.py | 374 | def set_unsubscribe_failure(self, exc: Exception | None) -> None: | CODE |
| LOW | tests/src/e2e/_conftest_readiness.py | 13 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/conftest.py | 95 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/_conftest_testcontainer.py | 54 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/_conftest_haos.py | 53 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/_conftest_seed.py | 14 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/_conftest_seed.py | 145 | def _setup_config_permissions(config_path: Path) -> None: | CODE |
| LOW | tests/src/e2e/_conftest_embedded.py | 18 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_radio_management.py | 41 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_security_policy_tool.py | 33 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | tests/src/e2e/tools/test_deep_search_exact_match.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_bm25_fuzzy_search.py | 18 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_skills_resources.py | 17 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_search_entities.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_create_custom_tool.py | 24 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_dev_mode_tools.py | 32 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_deep_search_many_configs.py | 24 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_deep_search.py | 12 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_logbook.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_search_reference_graph.py | 36 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_tools_knx.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_tools_energy.py | 18 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/tools/test_ha_call_event.py | 15 | logger = logging.getLogger(__name__) | CODE |
| LOW | …s/src/e2e/haos_only/test_dashboard_screenshot_addon.py | 203 | async def _set_options(mcp_client: Any, slug: str, options: dict[str, Any]) -> None: | CODE |
| LOW | tests/src/e2e/haos_only/test_manage_addon_modes.py | 50 | logger = logging.getLogger(__name__) | CODE |
| LOW | …ts/src/e2e/haos_only/test_zz_reentrant_log_deadlock.py | 41 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/haos_only/test_stdio_entity_visibility.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | tests/src/e2e/haos_only/test_webhook_proxy_addon.py | 164 | async def _set_options(mcp_client: Any, slug: str, options: dict[str, Any]) -> None: | CODE |
| LOW | tests/src/e2e/basic/test_connection.py | 11 | logger = logging.getLogger(__name__) | CODE |
| LOW | …/src/e2e/workflows/webhook_proxy/test_webhook_proxy.py | 23 | logger = logging.getLogger(__name__) | CODE |
| LOW | …rc/e2e/workflows/scenes/test_yaml_scene_not_storage.py | 37 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/workflows/scenes/test_lifecycle.py | 28 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/workflows/blueprints/test_blueprints.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | …flows/device_control/test_action_service_resolution.py | 27 | logger = logging.getLogger(__name__) | CODE |
| LOW | tests/src/e2e/workflows/device_control/test_lights.py | 24 | logger = logging.getLogger(__name__) | CODE |
| 436 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | pyproject.toml | 61 | "uvicorn>=0.35; sys_platform != 'emscripten'", | COMMENT |
| LOW | pyproject.toml | 341 | # stalls the run silently until the JOB timeout - observed as a 22-minute | COMMENT |
| LOW | pyproject.toml | 401 | # Real voluptuous-openapi for the embedded e2e LLM-API test: it converts | COMMENT |
| LOW | docker-compose.screenshot.yml | 1 | # Example: dashboard-screenshot engine sidecar for Docker / Container installs | COMMENT |
| LOW | docker-compose.screenshot.yml | 21 | # No `volumes:` here on purpose. Compose merges service volumes by their | COMMENT |
| LOW | docker-compose.yml | 21 | - "8086:8086" | COMMENT |
| LOW | docker-compose.yml | 41 | COMMENT | |
| LOW | .coderabbit.yaml | 1 | # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json | COMMENT |
| LOW | .coderabbit.yaml | 21 | # a rate-limited push gets a comment plus a deliberately-passing "Review | COMMENT |
| LOW | homeassistant-addon/config.yaml | 21 | # homeassistant-addon-dev/config.yaml. | COMMENT |
| LOW | homeassistant-addon/start.py | 521 | subflags = beta_subflags(options) | COMMENT |
| LOW | homeassistant-addon/start.py | 621 | try: | COMMENT |
| LOW | tests/haos_image_build/requirements.txt | 1 | # Build-script dependencies. Installed in CI by the haos-e2e-tests, | COMMENT |
| LOW | tests/haos_image_build/build_image.py | 61 | # project's style guide. | COMMENT |
| LOW | tests/haos_image_build/build_image.py | 121 | # new addon doesn't add a shape that no other entry covers, it does not | COMMENT |
| LOW | tests/haos_image_build/build_image.py | 141 | # └──────────────────────┴────────────────────────────────────────────────┘ | COMMENT |
| LOW | tests/haos_image_build/build_image.py | 161 | # which is the canonical "hidden sidebar" shape that ``ha_get_app`` | COMMENT |
| LOW | tests/haos_image_build/build_image.py | 201 | COMMENT | |
| LOW | tests/haos_image_build/build_image.py | 221 | # the fastmcp tree plus a server thread, and we only want that cost on the one | COMMENT |
| LOW | tests/haos_image_build/build_image.py | 241 | # that if the _conftest_haos.py delivery step ever fails to overwrite it, the entry's | COMMENT |
| LOW | tests/haos_image_build/build_image.py | 261 | # that serves balloob Puppet's HTTP contract WITHOUT Chromium. The real Puppet | COMMENT |
| LOW | tests/haos_image_build/build_image.py | 1141 | # the addon boots cleanly. | COMMENT |
| LOW | tests/haos_image_build/build_image.py | 1221 | # in root" (verified on PR #1375 CI run 29357350 for Node-RED). | COMMENT |
| LOW | tests/haos_image_build/build_image.py | 1461 | f"homeassistant-addon-webhook-proxy not found at {src_dir} — " | COMMENT |
| LOW | tests/haos_image_build/build_image.py | 2761 | # Stage the ha-mcp dev addon source into /supervisor/addons/local/ BEFORE first | COMMENT |
| LOW | tests/initial_test_state/configuration.yaml | 21 | # NO `http:` BLOCK HERE, DELIBERATELY. HA 2026.8 moved HTTP config into a | COMMENT |
| LOW | tests/initial_test_state/configuration.yaml | 41 | input_number: | COMMENT |
| LOW | …t_state/custom_packages/core_2026_9_child_devices.yaml | 1 | # Core 2026.9 fixture with one main power-strip device and child outlet devices. | COMMENT |
| LOW | tests/addon/test_webhook_proxy.py | 3441 | first_install, version_changed = start._install_integration() | COMMENT |
| LOW | tests/addon/test_webhook_proxy.py | 6501 | COMMENT | |
| LOW | tests/src/haos_runtime.py | 81 | OVMF_CODE_PATH = os.environ.get("HAOS_BUILD_OVMF", "/usr/share/OVMF/OVMF_CODE.fd") | COMMENT |
| LOW | tests/src/haos_runtime.py | 101 | # deps into the test runtime path). | COMMENT |
| LOW | tests/src/haos_runtime.py | 121 | # build_image.install_advanced_ssh; available on host port | COMMENT |
| LOW | tests/src/haos_runtime.py | 161 | # of ``-p`` on the command line — ``-p`` makes the credential | COMMENT |
| LOW | tests/src/haos_runtime.py | 421 | COMMENT | |
| LOW | tests/src/haos_runtime.py | 601 | # ``home-assistant_v2.db-shm`` in the supervisor data dir. Our | COMMENT |
| LOW | tests/src/haos_runtime.py | 1881 | time.sleep(3.0) | COMMENT |
| LOW | tests/src/doomed_run.py | 41 | return False | COMMENT |
| LOW | …/unit/test_ha_config_list_helpers_component_routing.py | 61 | # {"storage": [...], "config": [...]} — the UI-created persons and the | COMMENT |
| LOW | tests/src/unit/test_component_ws_phase2_async.py | 1901 | COMMENT | |
| LOW | tests/src/unit/test_e2e_lane_env_shape.py | 441 | assert path.is_file(), f"{workflow} no longer exists, but is excluded" | COMMENT |
| LOW | tests/src/unit/test_llm_api.py | 941 | async def test_loopback_factory_works_on_pre_1_24_sdks(self, monkeypatch): | COMMENT |
| LOW | tests/src/unit/test_backup_manager.py | 2121 | assert result["patch"] == [] | COMMENT |
| LOW | tests/src/unit/test_locale_parity.py | 81 | COMPONENT_STRINGS = _REPO_ROOT / "custom_components" / "ha_mcp_tools" / "strings.json" | COMMENT |
| LOW | tests/src/unit/test_locale_parity.py | 1021 | COMMENT | |
| LOW | tests/src/unit/test_locale_parity.py | 1241 | _MAX_COMPONENT_IDENTICAL_SHARE, | COMMENT |
| LOW | tests/src/unit/test_locale_parity.py | 1441 | if key in sent and not _is_owed_a_rewrite(TOOL_SOURCES_SURFACE, key, locale) | COMMENT |
| LOW | tests/src/unit/test_locale_parity.py | 1461 | # carries its own floor, and the set of surfaces is asserted rather than | COMMENT |
| LOW | tests/src/unit/test_locale_parity.py | 2041 | # ... and a grouped endpoint stays one endpoint, not two numbers. | COMMENT |
| LOW | tests/src/unit/test_locale_parity.py | 2321 | # The whole letter run is the suffix. "5KB" is five kilobytes where | COMMENT |
| LOW | tests/src/unit/test_locale_parity.py | 2341 | # "9584 to", which case-folding would read as terabytes. | COMMENT |
| LOW | tests/src/unit/test_read_only.py | 741 | # safe because it is gated by an inspected dispatch field (scope/action/ | COMMENT |
| LOW | tests/src/unit/test_read_only.py | 881 | # Selector for the allowed reads (list/get/substitute) and for the | COMMENT |
| LOW | tests/src/unit/test_settings_ui_js_behavior.py | 81 | # enable_security_policy_tool (#2148) — registers | COMMENT |
| LOW | tests/src/unit/test_settings_ui_js_behavior.py | 2341 | # to a value the server no longer holds, under a message asserting exactly | COMMENT |
| LOW | tests/src/unit/test_settings_ui_js_behavior.py | 4241 | window.__fb = fb ? fb.innerHTML : ''; | COMMENT |
| LOW | tests/src/unit/test_translate_locales.py | 41 | # Catalogs that carry translated text. A catalog with no `messages` yet has no | COMMENT |
| LOW | tests/src/unit/test_helper_classifier.py | 161 | "error_str,expected_code", | COMMENT |
| LOW | tests/src/unit/test_advanced_settings_coverage.py | 121 | field = FieldInfo(annotation=annotation, default=0, alias="SOME_ENV") | COMMENT |
| LOW | …/unit/test_fields_projection_docstring_completeness.py | 41 | # ``fields=`` Annotated[..., Field(description=...)] text | COMMENT |
| 440 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | homeassistant-addon/start.py | 82 | CODE | |
| LOW | tests/test_env_manager.py | 284 | CODE | |
| LOW | tests/test_env_manager.py | 307 | CODE | |
| LOW | tests/test_env_manager.py | 145 | CODE | |
| LOW | tests/uat/run_uat.py | 570 | CODE | |
| LOW | tests/uat/ha_wait.py | 24 | CODE | |
| LOW | tests/uat/ha_wait.py | 60 | CODE | |
| LOW | tests/uat/openai_agent.py | 139 | CODE | |
| LOW | tests/uat/stories/run_story.py | 180 | CODE | |
| LOW | tests/uat/stories/run_story.py | 220 | CODE | |
| LOW | tests/uat/stories/run_story.py | 264 | CODE | |
| LOW | tests/haos_image_build/build_image.py | 355 | CODE | |
| LOW | tests/haos_image_build/build_image.py | 379 | CODE | |
| LOW | tests/haos_image_build/build_image.py | 397 | CODE | |
| LOW | tests/initial_test_state/custom_components/hacs/base.py | 430 | CODE | |
| LOW | tests/initial_test_state/custom_components/hacs/base.py | 523 | CODE | |
| LOW | tests/initial_test_state/custom_components/hacs/base.py | 838 | CODE | |
| LOW | tests/initial_test_state/custom_components/hacs/base.py | 433 | CODE | |
| LOW | …t_state/custom_components/hacs/validate/information.py | 21 | CODE | |
| LOW | …ial_test_state/custom_components/hacs/utils/filters.py | 8 | CODE | |
| LOW | …nitial_test_state/custom_components/hacs/utils/data.py | 156 | CODE | |
| LOW | …st_state/custom_components/hacs/repositories/plugin.py | 111 | CODE | |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 194 | CODE | |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 360 | CODE | |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 410 | CODE | |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 657 | CODE | |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 781 | CODE | |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 1046 | CODE | |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 1171 | CODE | |
| LOW | …test_state/custom_components/hacs/repositories/base.py | 684 | CODE | |
| LOW | tests/src/haos_runtime.py | 476 | CODE | |
| LOW | tests/src/haos_runtime.py | 1843 | CODE | |
| LOW | tests/src/haos_runtime.py | 2178 | CODE | |
| LOW | tests/src/haos_runtime.py | 2225 | CODE | |
| LOW | tests/src/unit/test_renovate_configuration.py | 12 | CODE | |
| LOW | tests/src/unit/test_area_filter_search.py | 46 | CODE | |
| LOW | tests/src/unit/test_haos_image_workflow_shape.py | 100 | CODE | |
| LOW | tests/src/unit/test_lite_docstrings.py | 735 | CODE | |
| LOW | tests/src/unit/test_lite_docstrings.py | 303 | CODE | |
| LOW | tests/src/unit/test_e2e_lane_env_shape.py | 354 | CODE | |
| LOW | tests/src/unit/test_tool_schema_exclusive_bounds.py | 87 | CODE | |
| LOW | tests/src/unit/test_graceful_shutdown.py | 354 | CODE | |
| LOW | tests/src/unit/test_template_restore_safety.py | 339 | CODE | |
| LOW | tests/src/unit/test_locale_parity.py | 397 | CODE | |
| LOW | tests/src/unit/test_read_only.py | 916 | CODE | |
| LOW | tests/src/unit/test_read_only.py | 923 | CODE | |
| LOW | tests/src/unit/test_creation_snapshot_flow.py | 88 | CODE | |
| LOW | tests/src/unit/test_settings_ui_handler_selection.py | 85 | CODE | |
| LOW | tests/src/unit/test_advanced_settings_coverage.py | 198 | CODE | |
| LOW | tests/src/unit/test_advanced_settings_coverage.py | 249 | CODE | |
| LOW | …/unit/test_fields_projection_docstring_completeness.py | 242 | CODE | |
| LOW | …/unit/test_fields_projection_docstring_completeness.py | 293 | CODE | |
| LOW | …/unit/test_fields_projection_docstring_completeness.py | 386 | CODE | |
| LOW | …/unit/test_fields_projection_docstring_completeness.py | 433 | CODE | |
| LOW | …/unit/test_fields_projection_docstring_completeness.py | 669 | CODE | |
| LOW | tests/src/unit/test_skill_content_wiring.py | 300 | CODE | |
| LOW | tests/src/unit/test_skill_content_wiring.py | 328 | CODE | |
| LOW | tests/src/unit/test_dashboard_edit_routing.py | 901 | CODE | |
| LOW | tests/src/unit/test_agent_docs_structure.py | 100 | CODE | |
| LOW | tests/src/unit/test_skills_instructions.py | 520 | CODE | |
| 423 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …s/uat/stories/catalog/s02_automation_motion_light.yaml | 18 | # Create an input_boolean to simulate a motion sensor | COMMENT |
| MEDIUM | …ories/catalog/s07_automation_update_add_condition.yaml | 18 | # Create the automation to be modified | COMMENT |
| MEDIUM | …ories/catalog/s07_automation_update_add_condition.yaml | 34 | # Create a presence indicator | COMMENT |
| MEDIUM | tests/addon/test_webhook_proxy.py | 547 | # Create the package object first so submodules have a parent with __path__. | COMMENT |
| MEDIUM | tests/src/unit/test_oauth.py | 383 | # Create a stateless refresh token (as exchange_authorization_code would) | COMMENT |
| MEDIUM | tests/src/unit/test_oauth.py | 1316 | # Create a cached client | COMMENT |
| MEDIUM | tests/src/unit/test_graceful_shutdown.py | 74 | # Create a mock event | COMMENT |
| MEDIUM | tests/src/unit/test_graceful_shutdown.py | 226 | # Create a mock MCP that runs forever | COMMENT |
| MEDIUM | tests/src/unit/policy/test_approval_queue.py | 275 | # Create a second entry — forces eviction of 'a' (only one pending) | COMMENT |
| MEDIUM | tests/src/e2e/test_entity_visibility.py | 147 | # Create a label and assign it to the probe so the entity-registry entry | COMMENT |
| MEDIUM⚡ | tests/src/e2e/tools/test_deep_search_exact_match.py | 25 | # Create an automation with a distinctive entity reference | COMMENT |
| MEDIUM | tests/src/e2e/tools/test_deep_search_exact_match.py | 141 | # Create a dashboard with a distinctive entity reference | COMMENT |
| MEDIUM | tests/src/e2e/tools/test_bm25_fuzzy_search.py | 106 | # Create an automation with terms that are non-adjacent | COMMENT |
| MEDIUM | tests/src/e2e/tools/test_deep_search.py | 46 | # Create the automation | COMMENT |
| MEDIUM | tests/src/e2e/tools/test_deep_search.py | 116 | # Create a test script with distinctive content | COMMENT |
| MEDIUM | tests/src/e2e/tools/test_deep_search.py | 128 | # Create the script | COMMENT |
| MEDIUM | tests/src/e2e/tools/test_deep_search.py | 203 | # Create a test input_select helper with distinctive options | COMMENT |
| MEDIUM | tests/src/e2e/tools/test_deep_search.py | 209 | # Create the helper | COMMENT |
| MEDIUM | tests/src/e2e/workflows/calendar/test_calendar.py | 215 | # Create an event for tomorrow | COMMENT |
| MEDIUM | tests/src/e2e/workflows/core/test_service.py | 194 | # Create a test automation first | COMMENT |
| MEDIUM | tests/src/e2e/workflows/core/test_service.py | 373 | # Create a test input_boolean | COMMENT |
| MEDIUM⚡ | tests/src/e2e/workflows/config/test_label_crud.py | 308 | # Create a test label | COMMENT |
| MEDIUM | tests/src/e2e/workflows/config/test_label_crud.py | 398 | # Create a test label | COMMENT |
| MEDIUM | tests/src/e2e/workflows/config/test_label_crud.py | 439 | # Create a test label | COMMENT |
| MEDIUM | tests/src/e2e/workflows/config/test_label_crud.py | 480 | # Create a test label | COMMENT |
| MEDIUM | tests/src/e2e/workflows/config/test_helper_crud.py | 1838 | # Create a dedicated area | COMMENT |
| MEDIUM | tests/src/e2e/workflows/config/test_helper_crud.py | 1902 | # Create a dedicated label | COMMENT |
| MEDIUM | tests/src/e2e/workflows/config/test_helper_crud.py | 1973 | # Create a dedicated area | COMMENT |
| MEDIUM | tests/src/e2e/workflows/config/test_helper_crud.py | 2263 | # Create a dedicated area + label | COMMENT |
| MEDIUM | …/e2e/workflows/auto_backup/test_capture_and_restore.py | 244 | # Create an automation to snapshot. We do NOT edit it — the | COMMENT |
| MEDIUM | tests/src/e2e/workflows/labels/test_label_operations.py | 49 | # Create the test label | COMMENT |
| MEDIUM | tests/src/e2e/workflows/labels/test_label_operations.py | 341 | # Create a test label | COMMENT |
| MEDIUM | tests/src/e2e/workflows/filesystem/test_yaml_config.py | 737 | # Create a file with a list value | COMMENT |
| MEDIUM | tests/src/e2e/workflows/filesystem/test_yaml_config.py | 1042 | # Create a file with !secret tag under 'template' key | COMMENT |
| MEDIUM | tests/src/e2e/workflows/filesystem/test_yaml_config.py | 1268 | # Create the theme file. | COMMENT |
| MEDIUM | tests/src/e2e/workflows/filesystem/test_yaml_config.py | 1441 | # Create the key — no prior value, so capture is skipped. | COMMENT |
| MEDIUM | …s/src/e2e/workflows/filesystem/test_file_operations.py | 690 | # Create a file to delete | COMMENT |
| MEDIUM | tests/src/e2e/workflows/groups/test_verification.py | 69 | # Create a group first | COMMENT |
| MEDIUM | …/workflows/integrations/test_integration_management.py | 96 | # Create a temporary light group helper | COMMENT |
| MEDIUM | tests/src/e2e/workflows/system/test_system_tools.py | 825 | # Create a test notification | COMMENT |
| MEDIUM | tests/src/e2e/workflows/dashboards/test_resources.py | 375 | # Create a resource first | COMMENT |
| MEDIUM | tests/src/e2e/workflows/dashboards/test_resources.py | 415 | # Create a known inline resource so the flag has something to act on; | COMMENT |
| MEDIUM | …sts/src/e2e/workflows/registry/test_voice_assistant.py | 96 | # Create a test entity first | COMMENT |
| MEDIUM | …sts/src/e2e/workflows/registry/test_voice_assistant.py | 145 | # Create a test entity | COMMENT |
| MEDIUM | …sts/src/e2e/workflows/registry/test_voice_assistant.py | 202 | # Create a test entity | COMMENT |
| MEDIUM | …sts/src/e2e/workflows/registry/test_device_registry.py | 611 | # Create the labels this test assigns. Creation happens inside the | COMMENT |
| MEDIUM | tests/src/e2e/workflows/automation/test_lifecycle.py | 930 | # Create the automation - THIS IS THE KEY TEST | COMMENT |
| MEDIUM | …/src/e2e/workflows/automation/test_python_transform.py | 580 | # Create a category | COMMENT |
| MEDIUM | tests/src/e2e/workflows/convenience/test_backup.py | 271 | # Create a backup (which internally retrieves config/password) | COMMENT |
| MEDIUM⚡ | …2e/workflows/categories/test_config_tool_categories.py | 28 | # Create a category first | COMMENT |
| MEDIUM | …2e/workflows/categories/test_config_tool_categories.py | 87 | # Create a category first | COMMENT |
| MEDIUM | …2e/workflows/categories/test_config_tool_categories.py | 145 | # Create a category | COMMENT |
| MEDIUM | …2e/workflows/categories/test_config_tool_categories.py | 254 | # Create a category | COMMENT |
| MEDIUM | …2e/workflows/categories/test_config_tool_categories.py | 317 | # Create a category | COMMENT |
| MEDIUM | …2e/workflows/categories/test_config_tool_categories.py | 361 | # Create a category for helpers | COMMENT |
| MEDIUM | …sts/src/e2e/workflows/categories/test_category_crud.py | 235 | # Create a test category | COMMENT |
| MEDIUM | …sts/src/e2e/workflows/categories/test_category_crud.py | 281 | # Create a test category | COMMENT |
| MEDIUM⚡ | tests/src/e2e/workflows/entities/test_entity_remove.py | 19 | # Create a temporary input_boolean to remove | COMMENT |
| MEDIUM | …s/src/e2e/workflows/entities/test_entity_management.py | 41 | # Create a test area | COMMENT |
| MEDIUM | …s/src/e2e/workflows/entities/test_entity_management.py | 393 | # Create a test area | COMMENT |
| 46 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/src/unit/test_oauth.py | 765 | # Step 5: Verify access token contains only ha_token (no ha_url - SSRF fix) | COMMENT |
| LOW⚡ | tests/src/unit/test_oauth.py | 771 | # Step 6: Use stateless refresh token to get new access token | COMMENT |
| LOW⚡ | tests/src/unit/test_oauth.py | 785 | # Step 7: Verify refreshed access token is valid and carries HA credentials | COMMENT |
| LOW⚡ | tests/src/unit/test_oauth.py | 792 | # Step 8: Verify chained refresh also works | COMMENT |
| LOW | tests/src/unit/test_oauth.py | 695 | # Step 1: Client registration | COMMENT |
| LOW | tests/src/unit/test_oauth.py | 709 | # Step 2: Authorization request | COMMENT |
| LOW | tests/src/unit/test_oauth.py | 729 | # Step 3: Simulate consent form submission | COMMENT |
| LOW | tests/src/unit/test_oauth.py | 753 | # Step 4: Exchange auth code for tokens | COMMENT |
| LOW⚡ | tests/src/unit/test_flow_multistep.py | 563 | # Step 1: the user step | COMMENT |
| LOW⚡ | tests/src/unit/test_flow_multistep.py | 571 | # Step 2: the state_characteristic step — MUST receive its key, | COMMENT |
| LOW⚡ | tests/src/e2e/tools/test_create_custom_tool.py | 1053 | # Step 1: save a tool we'll then delete. | COMMENT |
| LOW | tests/src/e2e/tools/test_create_custom_tool.py | 1065 | # Step 2: delete it from inside the sandbox. | COMMENT |
| LOW | tests/src/e2e/tools/test_create_custom_tool.py | 1086 | # Step 3: confirm running it now fails (entry is gone). | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1243 | # Step 1: List automation blueprints | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1253 | # Step 2: List script blueprints | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1263 | # Step 3: If blueprints exist, explore one | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1334 | # Step 1: List available blueprints | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1349 | # Step 2: Get blueprint details to understand required inputs | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1358 | # Step 3: Create automation from blueprint (no trigger/action fields) | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1406 | # Step 4: Wait for automation to be registered, then verify no trigger/action fields | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1414 | # Step 5: Clean up | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/system/test_system_tools.py | 716 | # Step 1: Check configuration (folded into ha_get_system_health) | COMMENT |
| LOW | tests/src/e2e/workflows/system/test_system_tools.py | 728 | # Step 2: Reload automations | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/scripts/test_lifecycle.py | 1185 | # Step 2: Get blueprint details to understand required inputs | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/scripts/test_lifecycle.py | 1194 | # Step 3: Create script from blueprint (no sequence field) | COMMENT |
| LOW | tests/src/e2e/workflows/scripts/test_lifecycle.py | 1240 | # Step 4: Wait for script to be registered, then verify no sequence field | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/services/test_list_services.py | 373 | # Step 1: Discover light services (use full detail to see fields) | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/services/test_list_services.py | 383 | # Step 2: Find a light entity to test with | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/services/test_list_services.py | 400 | # Step 3: Use discovered service to control light | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/services/test_list_services.py | 410 | # Step 4: Call discovered service | COMMENT |
| LOW | .claude/skills/bat-story-eval/SKILL.md | 31 | ## Step 0: Triage (Diff Analysis + Custom Story Design) | COMMENT |
| LOW | .claude/skills/bat-story-eval/SKILL.md | 108 | ## Step 1: Run Baseline Version | COMMENT |
| LOW | .claude/skills/bat-story-eval/SKILL.md | 169 | ## Step 2: Run Target Version | COMMENT |
| LOW | .claude/skills/bat-story-eval/SKILL.md | 184 | ## Step 3: White-Box Analysis | COMMENT |
| LOW | .claude/skills/bat-story-eval/SKILL.md | 217 | ## Step 4: Score & Compare | COMMENT |
| LOW | .claude/skills/bat-story-eval/SKILL.md | 261 | ## Step 5: Update JSONL | COMMENT |
| LOW | .claude/skills/bat-story-eval/SKILL.md | 272 | ## Step 6: Report | COMMENT |
| LOW | .claude/skills/bat-story-eval/SKILL.md | 329 | ## Step 7: Investigate Outliers | COMMENT |
| LOW | .claude/skills/bat-story-eval/SKILL.md | 343 | ## Step 8: Tool Description Size | COMMENT |
| LOW | …kills/bat-story-eval/references/regression-protocol.md | 29 | ## Step 1: Re-Run (Flakiness Check) | COMMENT |
| LOW | …kills/bat-story-eval/references/regression-protocol.md | 45 | ## Step 2: Control Run (Baseline Version) | COMMENT |
| LOW | …kills/bat-story-eval/references/regression-protocol.md | 62 | ## Step 3: Cross-Agent Check | COMMENT |
| LOW | …kills/bat-story-eval/references/regression-protocol.md | 92 | ## Step 4: Diagnose | COMMENT |
| LOW | …kills/bat-story-eval/references/regression-protocol.md | 133 | ## Step 5: Report | COMMENT |
| LOW | .claude/skills/my-pr-checker/SKILL.md | 12 | ## Step 1: Full PR Assessment | COMMENT |
| LOW | .claude/skills/my-pr-checker/SKILL.md | 34 | ## Step 2: Triage Comments | COMMENT |
| LOW | .claude/skills/my-pr-checker/SKILL.md | 42 | ## Step 3: Fix Code Issues | COMMENT |
| LOW | .claude/skills/my-pr-checker/SKILL.md | 59 | ## Step 4: Resolve Each Thread (both steps required) | COMMENT |
| LOW | .claude/skills/my-pr-checker/SKILL.md | 80 | ## Step 5: Wait and Re-check | COMMENT |
| LOW | .claude/skills/my-pr-checker/SKILL.md | 91 | ## Step 6: Final Report | COMMENT |
| LOW | .claude/skills/issue-analysis/SKILL.md | 15 | ## Step 1: Fetch Issue Details | COMMENT |
| LOW⚡ | .claude/skills/issue-analysis/SKILL.md | 26 | ## Step 2: Research Phase (before drawing conclusions) | COMMENT |
| LOW⚡ | .claude/skills/issue-analysis/SKILL.md | 33 | ## Step 3: Assess Other Open Issues (for priority context) | COMMENT |
| LOW⚡ | .claude/skills/issue-analysis/SKILL.md | 39 | ## Step 4: Determine Labels | COMMENT |
| LOW | .claude/skills/issue-analysis/SKILL.md | 51 | ## Step 5: Draft Analysis for User | COMMENT |
| LOW | .claude/skills/issue-analysis/SKILL.md | 57 | ## Step 6: Apply Labels and Post Comment | COMMENT |
| LOW | docs/macOS-uv-guide.md | 7 | ## Step 1: Create a Claude Account | COMMENT |
| LOW | docs/macOS-uv-guide.md | 11 | ## Step 2: Run the Installer | COMMENT |
| LOW⚡ | docs/macOS-uv-guide.md | 60 | ## Step 3: Install or Restart Claude Desktop | COMMENT |
| LOW⚡ | docs/macOS-uv-guide.md | 66 | ## Step 4: Test It | COMMENT |
| 48 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | homeassistant-addon/start.py | 109 | # Check if we have a stored secret path | COMMENT |
| LOW | tests/src/unit/_js_harness.py | 606 | # Check if this is a data-purpose script and incorporate that | COMMENT |
| LOW | tests/src/e2e/_conftest_testcontainer.py | 438 | # Check if container is actually running | COMMENT |
| LOW | tests/src/e2e/_conftest_seed.py | 352 | # Check if HACS is installed and frontend is missing or invalid. | COMMENT |
| LOW | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1380 | # Check if it was our validation or HA's validation that failed | COMMENT |
| LOW | tests/src/e2e/workflows/device_control/test_lights.py | 40 | # Check if this is a successful response with entity data | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/config/test_label_crud.py | 318 | # Assign label to entity | COMMENT |
| LOW | tests/src/e2e/workflows/config/test_helper_crud.py | 1160 | # Check if 'data' key exists (not 'success' key which doesn't exist in parse_mcp_result) | COMMENT |
| LOW | tests/src/e2e/workflows/config/test_helper_crud.py | 1179 | # Check if 'data' key exists (not 'success' key which doesn't exist in parse_mcp_result) | COMMENT |
| LOW | …s/src/e2e/workflows/filesystem/test_file_operations.py | 158 | # Check if we got the "not installed" error | COMMENT |
| LOW | …s/src/e2e/workflows/filesystem/test_file_operations.py | 642 | # Write file with nested directories | COMMENT |
| LOW | tests/src/e2e/workflows/todo/test_lifecycle.py | 581 | # Check if any todo entities found | COMMENT |
| LOW | tests/src/e2e/workflows/scripts/test_lifecycle.py | 1214 | # Check if it was our validation or HA's validation that failed | COMMENT |
| LOW | tests/src/e2e/workflows/scripts/test_lifecycle.py | 358 | if state_data.get("success"): # Check if state is accessible | CODE |
| LOW | tests/src/e2e/workflows/automation/test_helpers.py | 54 | # Check if we have valid entity data | COMMENT |
| LOW | tests/src/e2e/workflows/automation/test_helpers.py | 1156 | # Check if our test helper is in the results | COMMENT |
| LOW | tests/src/e2e/workflows/convenience/test_backup.py | 59 | # Check if backup password is configured | COMMENT |
| LOW | tests/src/e2e/workflows/convenience/test_backup.py | 131 | # Check if backup password is configured | COMMENT |
| LOW | tests/src/e2e/workflows/convenience/test_backup.py | 289 | # Check if error is about missing password | COMMENT |
| LOW | …sts/src/e2e/workflows/categories/test_category_crud.py | 247 | # Assign category to entity | COMMENT |
| LOW | …s/src/e2e/workflows/entities/test_entity_management.py | 52 | # Assign entity to area | COMMENT |
| LOW | …s/src/e2e/workflows/entities/test_entity_management.py | 96 | # Assign entity to area first | COMMENT |
| LOW | tests/src/e2e/utilities/wait_helpers.py | 171 | # Check if 'data' key exists (not 'success' key which doesn't exist in parse_mcp_result) | COMMENT |
| LOW | tests/src/e2e/utilities/assertions.py | 62 | # Check if this is an error response (from ToolError). fastmcp's | COMMENT |
| LOW | tests/src/e2e/utilities/cleanup.py | 201 | # Check if entity ID or name contains test patterns | COMMENT |
| LOW | custom_components/ha_mcp_tools/__init__.py | 1220 | # Check if it's one of the explicitly allowed files in config root | COMMENT |
| LOW | custom_components/ha_mcp_tools/__init__.py | 1224 | # Check if path starts with an allowed directory | COMMENT |
| LOW | scripts/install.sh | 250 | # Check if config file exists and handle accordingly | COMMENT |
| LOW | scripts/install.sh | 258 | # Check if ha-mcp is already configured | COMMENT |
| LOW | homeassistant-addon-webhook-proxy-dev/start.py | 976 | # Check if integration already loaded (user restarted fast) | COMMENT |
| LOW | homeassistant-addon-webhook-proxy/start.py | 974 | # Check if integration already loaded (user restarted fast) | COMMENT |
| LOW | src/ha_mcp/__main__.py | 835 | # Check if stdin is available (fails in Docker without -i flag) | COMMENT |
| LOW | src/ha_mcp/__main__.py | 211 | # Check if stdin is closed | STRING |
| LOW | src/ha_mcp/tools/tools_yaml_config.py | 436 | # Check if custom component is available | COMMENT |
| LOW⚡ | src/ha_mcp/tools/tools_traces.py | 452 | # Check if enabled (state is 'on' for automations, 'off' is disabled) | COMMENT |
| LOW⚡ | src/ha_mcp/tools/tools_traces.py | 462 | # Check if tracing is stored - only for automations | COMMENT |
| LOW | src/ha_mcp/tools/tools_filesystem.py | 591 | # Check if custom component is available | COMMENT |
| LOW | src/ha_mcp/tools/tools_filesystem.py | 707 | # Check if custom component is available | COMMENT |
| LOW | src/ha_mcp/tools/tools_filesystem.py | 815 | # Check if custom component is available | COMMENT |
| LOW | src/ha_mcp/tools/tools_filesystem.py | 911 | # Check if custom component is available | COMMENT |
| LOW | src/ha_mcp/tools/tools_updates.py | 391 | # Check if rate limited | COMMENT |
| LOW | src/ha_mcp/tools/tools_updates.py | 453 | # Check if rate limited | COMMENT |
| LOW | src/ha_mcp/tools/tools_config_dashboards.py | 2257 | # Check if request failed (after potential retry) | COMMENT |
| LOW | src/ha_mcp/tools/tools_service.py | 1198 | # Check if this is a timeout - for service calls, timeouts typically | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/mcp_config.py | 322 | # Check if any values look like server configs | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/tool_transform.py | 336 | # Check if this parameter has a default_factory from transform_args | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/tool_transform.py | 512 | # Check if function returns ToolResult (or subclass) - if so, don't fall back to parent. | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/tool_transform.py | 543 | # Check if function is missing any parameters required after transformation | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/tool_transform.py | 660 | # Check if parameter is in transform_args | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/function_parsing.py | 483 | # Check if schema is an object type, resolving $ref references | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/resources/template.py | 778 | # Check if required parameters are a subset of the path parameters | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/resources/template.py | 784 | # Check if all URI parameters are valid function parameters (skip if **kwargs present) | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/server/elicitation.py | 61 | # Check if items are enum/Literal | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/server/elicitation.py | 73 | # Check if items are Literal (which Pydantic represents differently) | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/server/elicitation.py | 511 | # Check if it's a primitive type | COMMENT |
| LOW | …_vendor/fastmcp/server/middleware/response_limiting.py | 141 | # Check if we should limit this tool | COMMENT |
| LOW | …mcp/_vendor/fastmcp/server/auth/redirect_validation.py | 456 | # Check if URI matches any allowed pattern | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/server/auth/cimd.py | 625 | # Check if JTI was already used (and hasn't expired from cache) | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/server/auth/middleware.py | 75 | # Check if Authorization header is present | COMMENT |
| LOW | …a_mcp/_vendor/fastmcp/server/auth/oauth_proxy/proxy.py | 1256 | # Check if code expired | COMMENT |
| 57 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/uat/stories/run_story.py | 407 | CODE | |
| LOW | tests/src/unit/test_config_get_component_routing.py | 88 | CODE | |
| LOW | tests/src/unit/_js_harness.py | 135 | CODE | |
| LOW | tests/src/unit/test_statistics_units.py | 47 | CODE | |
| LOW | tests/src/unit/test_component_ws_search.py | 193 | CODE | |
| LOW | tests/src/unit/test_component_ws_search.py | 289 | CODE | |
| LOW | tests/src/unit/test_component_ws_search.py | 435 | CODE | |
| LOW | tests/src/unit/test_component_ws_search.py | 514 | CODE | |
| LOW | tests/src/unit/test_component_ws_search.py | 653 | CODE | |
| LOW | tests/src/unit/test_component_ws_search.py | 748 | CODE | |
| LOW | src/ha_mcp/tools/tools_config_helpers.py | 532 | CODE | |
| LOW | src/ha_mcp/tools/tools_energy.py | 85 | CODE | |
| LOW | src/ha_mcp/tools/auto_backup.py | 149 | CODE | |
| LOW | src/ha_mcp/tools/log_sources.py | 241 | CODE | |
| LOW | src/ha_mcp/tools/tools_history.py | 206 | CODE | |
| LOW | src/ha_mcp/tools/backup.py | 1646 | CODE | |
| LOW | src/ha_mcp/tools/tools_config_scripts.py | 485 | CODE | |
| LOW | src/ha_mcp/tools/tools_search.py | 60 | CODE | |
| LOW | src/ha_mcp/tools/tools_search.py | 430 | CODE | |
| LOW | src/ha_mcp/tools/tools_bug_report.py | 840 | CODE | |
| LOW | src/ha_mcp/tools/tools_traces.py | 44 | CODE | |
| LOW | src/ha_mcp/tools/tools_dev.py | 825 | CODE | |
| LOW | src/ha_mcp/tools/tools_logs.py | 167 | CODE | |
| LOW | src/ha_mcp/tools/tools_registry.py | 774 | CODE | |
| LOW | src/ha_mcp/tools/tools_config_automations.py | 656 | CODE | |
| LOW | src/ha_mcp/tools/tools_config_scenes.py | 612 | CODE | |
| LOW | src/ha_mcp/tools/tools_system.py | 485 | CODE | |
| LOW | src/ha_mcp/tools/tools_dashboard_screenshot.py | 116 | CODE | |
| LOW | src/ha_mcp/tools/tools_assist_pipeline.py | 541 | CODE | |
| LOW | src/ha_mcp/tools/tools_config_dashboards.py | 1634 | CODE | |
| LOW | src/ha_mcp/tools/tools_config_dashboards.py | 2454 | CODE | |
| LOW | src/ha_mcp/tools/tools_blueprints.py | 164 | CODE | |
| LOW | src/ha_mcp/tools/tools_integrations.py | 448 | CODE | |
| LOW | src/ha_mcp/tools/tools_integrations.py | 1734 | CODE | |
| LOW | src/ha_mcp/tools/tools_areas.py | 607 | CODE | |
| LOW | src/ha_mcp/tools/tools_addons.py | 1645 | CODE | |
| LOW | src/ha_mcp/tools/tools_addons.py | 2274 | CODE | |
| LOW | src/ha_mcp/tools/tools_addons.py | 3822 | CODE | |
| LOW | src/ha_mcp/tools/tools_entities.py | 1473 | CODE | |
| LOW | src/ha_mcp/tools/tools_service.py | 1820 | CODE | |
| LOW | src/ha_mcp/tools/tools_service.py | 2196 | CODE | |
| LOW | src/ha_mcp/tools/search/legacy.py | 152 | CODE | |
| LOW | src/ha_mcp/tools/search/legacy.py | 438 | CODE | |
| LOW | src/ha_mcp/tools/smart_search/_deep.py | 131 | CODE | |
| LOW | src/ha_mcp/tools/smart_search/_deep.py | 1239 | CODE | |
| LOW | src/ha_mcp/tools/smart_search/_deep.py | 1357 | CODE | |
| LOW | src/ha_mcp/tools/smart_search/_overview.py | 36 | CODE | |
| LOW | src/ha_mcp/tools/smart_search/_entities.py | 62 | CODE | |
| LOW | src/ha_mcp/_vendor/fastmcp/telemetry.py | 66 | CODE | |
| LOW | …/_vendor/fastmcp/experimental/transforms/jev_search.py | 129 | CODE | |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/tool_transform.py | 399 | CODE | |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/function_tool.py | 514 | CODE | |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/function_tool.py | 531 | CODE | |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/function_tool.py | 550 | CODE | |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/function_tool.py | 219 | CODE | |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/base.py | 311 | CODE | |
| LOW | src/ha_mcp/_vendor/fastmcp/tools/base.py | 443 | CODE | |
| LOW | …/ha_mcp/_vendor/fastmcp/resources/function_resource.py | 223 | CODE | |
| LOW | …/ha_mcp/_vendor/fastmcp/resources/function_resource.py | 84 | CODE | |
| LOW | src/ha_mcp/_vendor/fastmcp/resources/template.py | 337 | CODE | |
| 107 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/src/unit/test_oauth.py | 765 | # Step 5: Verify access token contains only ha_token (no ha_url - SSRF fix) | COMMENT |
| LOW⚡ | tests/src/unit/test_oauth.py | 771 | # Step 6: Use stateless refresh token to get new access token | COMMENT |
| LOW⚡ | tests/src/unit/test_oauth.py | 785 | # Step 7: Verify refreshed access token is valid and carries HA credentials | COMMENT |
| LOW⚡ | tests/src/unit/test_oauth.py | 792 | # Step 8: Verify chained refresh also works | COMMENT |
| LOW | tests/src/unit/test_oauth.py | 695 | # Step 1: Client registration | COMMENT |
| LOW | tests/src/unit/test_oauth.py | 709 | # Step 2: Authorization request | COMMENT |
| LOW | tests/src/unit/test_oauth.py | 729 | # Step 3: Simulate consent form submission | COMMENT |
| LOW | tests/src/unit/test_oauth.py | 753 | # Step 4: Exchange auth code for tokens | COMMENT |
| LOW⚡ | tests/src/unit/test_flow_multistep.py | 563 | # Step 1: the user step | COMMENT |
| LOW⚡ | tests/src/unit/test_flow_multistep.py | 571 | # Step 2: the state_characteristic step — MUST receive its key, | COMMENT |
| LOW⚡ | tests/src/e2e/tools/test_create_custom_tool.py | 1053 | # Step 1: save a tool we'll then delete. | COMMENT |
| LOW | tests/src/e2e/tools/test_create_custom_tool.py | 1065 | # Step 2: delete it from inside the sandbox. | COMMENT |
| LOW | tests/src/e2e/tools/test_create_custom_tool.py | 1086 | # Step 3: confirm running it now fails (entry is gone). | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1243 | # Step 1: List automation blueprints | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1253 | # Step 2: List script blueprints | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1263 | # Step 3: If blueprints exist, explore one | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1334 | # Step 1: List available blueprints | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1349 | # Step 2: Get blueprint details to understand required inputs | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1358 | # Step 3: Create automation from blueprint (no trigger/action fields) | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1406 | # Step 4: Wait for automation to be registered, then verify no trigger/action fields | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/blueprints/test_blueprints.py | 1414 | # Step 5: Clean up | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/system/test_system_tools.py | 716 | # Step 1: Check configuration (folded into ha_get_system_health) | COMMENT |
| LOW | tests/src/e2e/workflows/system/test_system_tools.py | 728 | # Step 2: Reload automations | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/scripts/test_lifecycle.py | 1185 | # Step 2: Get blueprint details to understand required inputs | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/scripts/test_lifecycle.py | 1194 | # Step 3: Create script from blueprint (no sequence field) | COMMENT |
| LOW | tests/src/e2e/workflows/scripts/test_lifecycle.py | 1240 | # Step 4: Wait for script to be registered, then verify no sequence field | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/services/test_list_services.py | 373 | # Step 1: Discover light services (use full detail to see fields) | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/services/test_list_services.py | 383 | # Step 2: Find a light entity to test with | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/services/test_list_services.py | 400 | # Step 3: Use discovered service to control light | COMMENT |
| LOW⚡ | tests/src/e2e/workflows/services/test_list_services.py | 410 | # Step 4: Call discovered service | COMMENT |
| LOW | scripts/install.sh | 89 | # Step 1: Check/install uv | COMMENT |
| LOW | scripts/install.sh | 200 | # Step 3: Pre-download dependencies | COMMENT |
| LOW⚡ | scripts/install.sh | 239 | # Step 2: Configure Claude Desktop | COMMENT |
| LOW | scripts/install.sh | 372 | # Step 3: Pre-download dependencies | COMMENT |
| LOW⚡ | src/ha_mcp/tools/tools_integrations.py | 2546 | # Step 2: collect sub-entity IDs for the wait phase | COMMENT |
| LOW⚡ | src/ha_mcp/tools/tools_integrations.py | 2550 | # Step 3: delete the config entry | COMMENT |
| LOW⚡ | src/ha_mcp/tools/tools_integrations.py | 2560 | # Step 4: wait for all sub-entities to be removed in parallel | COMMENT |
| LOW | src/ha_mcp/tools/tools_integrations.py | 2495 | # Step 1: resolve target → entry_id (typed reason on failure) | COMMENT |
| LOW | …/ha_mcp/_vendor/fastmcp/server/auth/providers/clerk.py | 112 | # Step 1: Validate token via introspection (RFC 7662). | COMMENT |
| LOW | …/ha_mcp/_vendor/fastmcp/server/auth/providers/clerk.py | 187 | # Step 2: Fetch user profile via userinfo. | COMMENT |
| LOW | …ha_mcp/_vendor/fastmcp/server/auth/providers/google.py | 114 | # Step 1: Verify token via tokeninfo endpoint. | COMMENT |
| LOW | …ha_mcp/_vendor/fastmcp/server/auth/providers/google.py | 180 | # Step 2: Fetch user profile from v2 userinfo endpoint. | COMMENT |
| LOW | …fastmcp/contrib/component_manager/component_manager.py | 101 | # We need to check if it's a template (contains {}) and use "template" if so | COMMENT |
| LOW⚡ | …c/ha_mcp/_vendor/fastmcp/utilities/json_schema_type.py | 580 | # Step 1: replace everything except [0-9a-zA-Z_] with underscores | COMMENT |
| LOW⚡ | …c/ha_mcp/_vendor/fastmcp/utilities/json_schema_type.py | 582 | # Step 2: deduplicate underscores | COMMENT |
| LOW⚡ | …c/ha_mcp/_vendor/fastmcp/utilities/json_schema_type.py | 584 | # Step 3: if the first char of original name isn't a letter or underscore, prepend field_ | COMMENT |
| LOW⚡ | …c/ha_mcp/_vendor/fastmcp/utilities/json_schema_type.py | 587 | # Step 4: deduplicate again | COMMENT |
| LOW⚡ | …c/ha_mcp/_vendor/fastmcp/utilities/json_schema_type.py | 589 | # Step 5: only strip trailing underscores if they weren't in the original name | COMMENT |
| LOW⚡ | …c/ha_mcp/_vendor/fastmcp/utilities/json_schema_type.py | 592 | # Step 6: if result is a Python keyword, append an underscore (PEP 8 convention) | COMMENT |
| LOW⚡ | …dor/fastmcp/utilities/openapi/json_schema_converter.py | 92 | # Step 1: Handle nullable field conversion (OpenAPI 3.0 only) | COMMENT |
| LOW⚡ | …dor/fastmcp/utilities/openapi/json_schema_converter.py | 96 | # Step 2: Convert oneOf to anyOf if requested | COMMENT |
| LOW⚡ | …dor/fastmcp/utilities/openapi/json_schema_converter.py | 100 | # Step 3: Preserve discriminator tag presence before removing the keyword | COMMENT |
| LOW⚡ | …dor/fastmcp/utilities/openapi/json_schema_converter.py | 103 | # Step 4: Remove OpenAPI-specific fields | COMMENT |
| LOW⚡ | …dor/fastmcp/utilities/openapi/json_schema_converter.py | 107 | # Step 5: Handle readOnly/writeOnly property removal | COMMENT |
| LOW⚡ | …dor/fastmcp/utilities/openapi/json_schema_converter.py | 113 | # Step 6: Recursively process nested schemas | COMMENT |
| LOW⚡ | …c/ha_mcp/_vendor/fastmcp/utilities/openapi/director.py | 72 | # Step 1: Un-flatten arguments into path, query, body, etc. using parameter map | COMMENT |
| LOW⚡ | …c/ha_mcp/_vendor/fastmcp/utilities/openapi/director.py | 81 | # Step 2: Serialize query parameters according to OpenAPI style/explode | COMMENT |
| LOW⚡ | …c/ha_mcp/_vendor/fastmcp/utilities/openapi/director.py | 84 | # Step 3: Build base URL with path parameters | COMMENT |
| LOW⚡ | …c/ha_mcp/_vendor/fastmcp/utilities/openapi/director.py | 87 | # Step 4: Prepare request data | COMMENT |
| LOW⚡ | …c/ha_mcp/_vendor/fastmcp/utilities/openapi/director.py | 94 | # Step 5: Determine the declared content type from the OpenAPI spec. | COMMENT |
| 8 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | pyproject.toml | 203 | "ASYNC", # async best practices | CODE |
| MEDIUM | pyproject.toml | 205 | "LOG", # logging best practices | CODE |
| MEDIUM | pyproject.toml | 381 | # runtime harness, the image bake, wait_helpers) to talk to Home | COMMENT |
| MEDIUM | tests/haos_image_build/build_image.py | 208 | # The secret_path option must be set deterministically so the test harness | COMMENT |
| MEDIUM | tests/src/haos_runtime.py | 2110 | # The e2e harness logs at INFO, so a DEBUG-only cause would leave a | COMMENT |
| MEDIUM | tests/src/unit/_js_harness.py | 32 | # Path to the harness — repo-relative, resolved once at import time. | COMMENT |
| MEDIUM | tests/src/unit/_js_harness.py | 214 | # surface in the harness's own error reporting. | COMMENT |
| MEDIUM | tests/src/unit/test_oauth_autoapprove.py | 227 | # this HTTP-level harness and must not leak into the rest of the unit suite. | COMMENT |
| MEDIUM⚡ | tests/src/unit/test_server_prefs_seed.py | 71 | # the harness result, but we can infer correctness by re-running the | STRING |
| MEDIUM | tests/src/unit/test_tools_utility_supervisor_logs.py | 253 | # module attribute) is robust to either `import httpx` or a future | COMMENT |
| MEDIUM | tests/src/unit/test_locale_parity.py | 2418 | # The harness puts `scripts/` on PYTHONPATH, and the child would inherit | COMMENT |
| MEDIUM | tests/src/unit/test_astro_setup_js_behavior.py | 796 | # placeholder in this harness), so this doesn't assert its contents. | STRING |
| MEDIUM⚡ | tests/src/unit/test_build_skill_content.py | 116 | assert result == {"SKILL.md": "# best practices\n"} | CODE |
| MEDIUM | tests/src/unit/test_build_skill_content.py | 50 | (skill / "SKILL.md").write_text("# best practices\n") | CODE |
| MEDIUM | tests/src/unit/test_settings_ui_js_behavior.py | 976 | // assertion below — querying via JS is more robust than | COMMENT |
| MEDIUM | tests/src/unit/test_settings_ui_js_behavior.py | 1007 | # flipped one. The harness's `responses: [...]` shape advances | STRING |
| MEDIUM | tests/src/unit/test_settings_ui_js_behavior.py | 4245 | # The harness serialises window globals into result.dom — pick | STRING |
| MEDIUM | tests/src/unit/test_astro_tools_description_fold.py | 22 | # The harness has no module resolution, and the rest of the frontmatter walks | COMMENT |
| MEDIUM | tests/src/e2e/tools/test_radio_management.py | 100 | # robust to exactly where they land. | COMMENT |
| MEDIUM | tests/src/e2e/tools/test_search_entities.py | 1824 | # penalty → 80. Asserting ``< 100`` keeps the test robust to small | COMMENT |
| MEDIUM | tests/src/e2e/tools/test_deep_search_many_configs.py | 120 | # failing setup — keeps the fixture robust if the WS path drops | COMMENT |
| MEDIUM | …/e2e/workflows/auto_backup/test_capture_and_restore.py | 525 | # ``replace`` ops on a path ending in ``/alias`` to stay robust | COMMENT |
| MEDIUM | tests/src/e2e/workflows/filesystem/test_yaml_config.py | 1548 | # robust whether the read fails because the file is missing or | COMMENT |
| MEDIUM | …/workflows/integrations/test_integration_management.py | 398 | # integration in the harness that implements async_step_reconfigure, and it | COMMENT |
| MEDIUM | tests/src/e2e/workflows/system/test_system_tools.py | 783 | # Log comprehensive overview | COMMENT |
| MEDIUM | tests/src/e2e/workflows/automation/test_lifecycle.py | 185 | # Extract automation entity ID with robust error handling | COMMENT |
| MEDIUM⚡ | custom_components/ha_mcp_tools/ui_panel.py | 519 | # harness for every surface); coverage = the node --check syntax test plus the | COMMENT |
| MEDIUM | …_components/ha_mcp_tools/websocket_api/call_service.py | 314 | # the unit-test harness MagicMock-stubs ``homeassistant.core``, so the decorator | COMMENT |
| MEDIUM | scripts/bake_pagination_seed.py | 38 | HOST_PORT = 32788 # off the dev-harness 32769 to avoid clashes | CODE |
| MEDIUM | src/ha_mcp/settings_ui/__init__.py | 116 | # esbuild/jsdom JS harness (tests/js/harness.mjs) -- `const DEFAULT_PINNED = | COMMENT |
| MEDIUM | src/ha_mcp/tools/tools_bug_report.py | 559 | # Broad by design — the bug-report path must stay robust whatever the | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/server/lifespan.py | 136 | # self._fn is already a context manager factory, just call it | COMMENT |
| MEDIUM | src/ha_mcp/_vendor/fastmcp/server/middleware/logging.py | 149 | """Middleware that provides comprehensive request and response logging. | STRING |
| MEDIUM | src/ha_mcp/_vendor/fastmcp/server/auth/ssrf.py | 378 | """Fetch URL with comprehensive SSRF protection and DNS pinning. | STRING |
| LOW | …mcp/_vendor/fastmcp/server/auth/oauth_proxy/consent.py | 582 | # Keep the browser's consent state bounded. The cookie just set always | COMMENT |
| MEDIUM | …mcp/_vendor/fastmcp/server/auth/providers/in_memory.py | 114 | # The AuthorizationHandler already does robust validation using client.validate_redirect_uri | COMMENT |
| LOW⚡ | …_mcp/_vendor/fastmcp/server/auth/handlers/authorize.py | 276 | # If we can't parse the response, just return the original | STRING |
| LOW | …endor/fastmcp/server/providers/filesystem_discovery.py | 50 | # If root is a file, just return it (if it's a .py file) | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/cli/cli.py | 60 | return "npx" # On Unix-like systems, just use npx | CODE |
| MEDIUM | src/ha_mcp/_vendor/fastmcp/utilities/asgi_transport.py | 315 | # A harness must surface a broken teardown rather than swallow it — but never at | COMMENT |
| LOW | …c/ha_mcp/_vendor/fastmcp/utilities/json_schema_type.py | 825 | # Otherwise just use the data | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/utilities/cli.py | 81 | # MCPConfig - we don't process these here, just pass through | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/utilities/cli.py | 94 | # Not a valid MCPServerConfig, just pass through | COMMENT |
| LOW | src/ha_mcp/_vendor/fastmcp/utilities/cli.py | 97 | # Not a valid JSON file, just pass through | COMMENT |
| MEDIUM | src/ha_mcp/_vendor/websockets/frames.py | 194 | # and robust. Also support frames fragmented within UTF-8 sequences. | COMMENT |
| LOW | …c/ha_mcp/_vendor/mcp/server/auth/handlers/authorize.py | 111 | # if the redirect URI is invalid, ignore it & just return the | COMMENT |
| LOW | src/ha_mcp/_vendor/mcp/server/auth/handlers/revoke.py | 74 | # if token is not found, just return HTTP 200 per the RFC | COMMENT |
| LOW | …vendor/mcp/server/mcpserver/utilities/func_metadata.py | 324 | # This raise could perhaps be skipped, and we (MCPServer) just call | COMMENT |
| LOW | src/ha_mcp/_vendor/mcp/cli/cli.py | 53 | return "npx" # On Unix-like systems, just use npx | CODE |
| MEDIUM | src/ha_mcp/_vendor/mcp/client/session_group.py | 312 | # Create read and write streams that facilitate io with the server. | COMMENT |
| MEDIUM | src/ha_mcp/utils/fuzzy_search.py | 465 | """Calculate a comprehensive fuzzy score for an entity name/domain. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/src/unit/test_settings_ui_js_behavior.py | 124 | # Full modal scaffold (mirrors settings.html) so the focus-trap | COMMENT |
| MEDIUM | tests/src/unit/test_e2e_wait_helpers.py | 3 | The test-side migration in #1382 added a WS-event-driven path to three | STRING |
| MEDIUM⚡ | tests/src/unit/test_tools_bug_report.py | 1855 | # what biases agents and invites hallucinations). | COMMENT |
| MEDIUM⚡ | tests/src/unit/test_tools_bug_report.py | 1864 | # hallucination bait we removed. | COMMENT |
| MEDIUM | tests/src/unit/test_tools_bug_report.py | 1696 | # hallucination-bait we removed. | COMMENT |
| MEDIUM | tests/src/e2e/haos_only/test_integration_setup.py | 59 | # substantial new test scaffolding; for now the integration-setup | COMMENT |
| MEDIUM | tests/src/e2e/workflows/config/test_ws_event_waiter.py | 2 | E2E regression coverage for #1152 — WS-event-driven entity-registration wait. | STRING |
| MEDIUM | tests/src/e2e/workflows/config/test_ws_event_waiter.py | 46 | """Regression coverage for the #1152 WS-event-driven waiter.""" | STRING |
| MEDIUM | tests/src/e2e/utilities/wait_helpers.py | 286 | # event-driven re-samples against the right baseline. | COMMENT |
| MEDIUM | tests/src/e2e/utilities/wait_helpers.py | 441 | PR #1382 for the broader event-driven-wait migration. | STRING |
| MEDIUM | tests/src/e2e/utilities/wait_helpers.py | 1048 | # the sample-after-subscribe pattern the other event-driven waiters | COMMENT |
| MEDIUM | src/ha_mcp/tool_dispatch.py | 20 | # Code mode is local orchestration that can issue many nested HA calls. Its | COMMENT |
| MEDIUM | src/ha_mcp/tools/log_sources.py | 291 | # the LLM context window during debugging workflows. | COMMENT |
| MEDIUM | src/ha_mcp/tools/ws_waiters.py | 24 | # --- WS-event-driven wait helpers (#1152) ----------------------------------- | COMMENT |
| MEDIUM | src/ha_mcp/tools/ws_waiters.py | 35 | # The new pattern is WS-event-driven with a REST sample after subscribe and a | COMMENT |
| MEDIUM | src/ha_mcp/tools/tools_code.py | 73 | # scaffolding rather than per-user data, that ``run_saved`` executes with the | COMMENT |
| MEDIUM | src/ha_mcp/tools/hacs_registration.py | 158 | # dominant cost in the HAOS E2E suite per #1515); 10 s still leaves event-driven | COMMENT |
| MEDIUM | src/ha_mcp/tools/hacs_registration.py | 253 | # we subscribed successfully but the event-driven path | COMMENT |
| MEDIUM | src/ha_mcp/_vendor/fastmcp/server/context.py | 281 | # Set current server for dependency injection (use weakref to avoid reference cycles) | COMMENT |
| MEDIUM | …a_mcp/_vendor/fastmcp/server/auth/providers/descope.py | 113 | # An MCP server ID extends the project's agentic path and a tenant ID | COMMENT |
| MEDIUM | …a_mcp/_vendor/fastmcp/server/auth/providers/descope.py | 115 | # The agentic path is checked first as the more specific of the two. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | tests/src/unit/test_webhook_proxy_liveness.py | 100 | assert oauth.web.json_response.call_args.kwargs.get("status") in (None, 200) | CODE |
| CRITICAL | tests/src/unit/test_session_disconnect_log_filter.py | 32 | exception -- reproducing the actual shape mcp.server.lowlevel.server.Server.run() | STRING |
| CRITICAL | src/ha_mcp/log_filters.py | 62 | ``mcp.server.lowlevel.server.Server.run()`` dispatches each incoming | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …cp/_vendor/fastmcp/contrib/component_manager/README.md | 108 | -H "Authorization: Bearer YOUR_TOKEN_HERE" \ | CODE |
| HIGH | …cp/_vendor/fastmcp/contrib/component_manager/README.md | 134 | -H "Authorization: Bearer YOUR_TOKEN_HERE" \ | CODE |
| HIGH | …cp/_vendor/fastmcp/contrib/component_manager/README.md | 140 | -H "Authorization: Bearer YOUR_TOKEN_HERE" \ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/src/unit/test_card_review_round6.py | 61 | assert result["value"][0]["selector"]["icon"]["placeholder"] == "mdi:link" | CODE |
| LOW | tests/src/unit/test_config.py | 470 | monkeypatch.setenv("SUPERVISOR_TOKEN", "fake-token-for-test") | CODE |
| LOW | tests/src/unit/test_config.py | 507 | monkeypatch.setenv("SUPERVISOR_TOKEN", "fake-token-for-test") | CODE |
| LOW⚡ | tests/src/e2e/policy/test_redact_secrets.py | 119 | assert "placeholder" in error.get("message", ""), body | CODE |
| LOW | src/ha_mcp/settings_ui/settings_js/01_i18n_state.js | 123 | for (const attribute of ['placeholder', 'title', 'aria-label']) { | CODE |
| LOW | src/ha_mcp/tools/tools_bug_report.py | 1339 | - Email addresses -> Replace with "user@example.com" | CODE |
| LOW | …ha_mcp/_vendor/fastmcp/utilities/openapi/formatters.py | 163 | return "user@example.com" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/src/unit/test_python_sandbox.py | 330 | expr = "def helper():\n return 1" | CODE |
| LOW | src/ha_mcp/_vendor/mcp/server/streamable_http.py | 474 | async def handle_request(self, scope: Scope, receive: Receive, send: Send) -> None: | CODE |
| LOW | …c/ha_mcp/_vendor/mcp/server/streamable_http_manager.py | 176 | async def handle_request(self, scope: Scope, receive: Receive, send: Send) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.screenshot.yml | 57 | # Usage: | COMMENT |
| LOW | docker-compose.yml | 50 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/ha_mcp/_vendor/fastmcp/client/transports/base.py | 124 | CODE |