Atlas / MCP servers / higangssh / HomeButler

HomeButlerBLOCK

mcp/higangssh/homebutler

🏠 Tells you what changed on your server — only what's worth telling. Single Go binary, no database, nothing running on the machines it watches. MCP server built in.

Verdict
BLOCK
Grade
F
Trust score
59 /100
Exposed tools
1 1r · 0w · 0d
Transport
stdio
License
MIT
Stars
298
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

HomeButler

Only the changes worth mentioning. A single Go binary that remembers what your server looked like last time, and tells you — or an agent — what moved.

Website · Docs · Releases

``

Read from source at commit f1ee068b61e4OBSERVED · 2026-10-06
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add homebutler -- npx -y [email protected]
03

Exposed tools (1)

1 read · 0 write · 0 destructive.

ToolRiskDescription
portainerreadDocker management GUI
04

Trust audit

BLOCKgrade F · trust 59/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (13 observation(s))
Network
declared (5 observation(s))
Shell
declared (4 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
cmd/init.go:276
defaultKey = "~/.ssh/id_rsa"
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
cmd/init.go:363
filepath.Join(home, ".ssh", "id_ed25519"),
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
cmd/init.go:364
filepath.Join(home, ".ssh", "id_rsa"),
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
cmd/init.go:365
filepath.Join(home, ".ssh", "id_ecdsa"),
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
homebutler.example.yaml:14
key: ~/.ssh/id_ed25519  # optional, tries id_ed25519 and id_rsa by default
Why it matters. touches a credential store
HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427
skills/SKILL.md:234
Configured under `proxmox:` with an API token. The read credential and the one
Why it matters. asks the agent to read credentials
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
assets/bake-web-report.mjs:23
const BASE = 'http://127.0.0.1:8791';
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
internal/server/server.go:460
if origin == allowed || origin == fmt.Sprintf("http://localhost:%d", s.port) || origin == fmt.Sprintf("http://127.0.0.1:%d", s.port) {
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
cmd/serve_test.go:44
const secret = "tok_do_not_write_this_down"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
internal/config/validate_test.go:808
const token = "tok_must_not_be_printed"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
internal/doctor/doctor_proxmox_test.go:161
const secret = "should-never-appear-in-a-finding"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
internal/notify/leak_test.go:48
secret: "aVerySecretWebhookToken",
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
internal/remote/hostkey_test.go:120
Password: "correct-horse-battery-staple",
LOWInventory / provenance · inv.hidden_file · CWE-1104
.golangci.yml
.golangci.yml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.goreleaser.yaml
.goreleaser.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
internal/backup/extract_test.go:296
for _, name := range []string{"../../etc/passwd", "data", "/abs/path"} {
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
internal/backup/restore_security_test.go:154
paths := []string{"/etc", "/", "../../etc", "/var/run/docker.sock", "-v", "_leading"}
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
internal/doctor/categories_test.go:20
readme, err := os.ReadFile("../../README.md")
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
internal/install/install_test.go:854
{"../../etc", true},
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
internal/install/install_test.go:873
traversalNames := []string{"../../etc/passwd", "../foo", "foo/../../bar"}
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CHANGELOG.md:440
❌ discord: request to http://127.0.0.1:1 failed: dial tcp 127.0.0.1:1: connect: connection refused
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
assets/README.md:34
http://127.0.0.1:8901/assets/report-card.svg /tmp/card.png
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
assets/README.md:111
http://127.0.0.1:8901/assets/social-preview.html assets/social-preview.png
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
web/package.json
@playwright/test, @sveltejs/vite-plugin-svelte, @testing-library/svelte, jsdom, svelte, vite, vitest
Why it matters. 7 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
CHANGELOG.md:320
- the skill told an agent that reads were safe to call unattended, and stopped there (#218). A read changes nothing on the machine, which is what the class means and all the file said. What comes back
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: no_behavioural_pass.

Audited 2026-10-06 · audit v0.4.1 · source sha f1ee068b61e4full audit observations/trust-audit/mcp-server/higangssh__homebutler.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-06f1ee068b61e4BLOCKF59first audit
06

Questions

What is the HomeButler MCP server?

🏠 Tells you what changed on your server — only what's worth telling. Single Go binary, no database, nothing running on the machines it watches. MCP server built in.

What tools does HomeButler expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is HomeButler safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (59/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does HomeButler need?

No credential environment variables were found in its source, so it appears to need none.

How does HomeButler run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as homebutler-web at 0.0.0.

How current is this page?

The grade is for one exact copy of the source (f1ee068b61e4), read on 2026-10-06. The repository is watched and re-audited when it changes.

Advertisement