// SCAN REPORT

Openhab

25 tools. 14 can modify or destroy data without limits.

4 destructive tools with no built-in limits. Policy required.

Last updated: 2 Aug 2026

14 can modify or destroy data

11 read-only

25 tools total

Community server · catalogue entry checked 02/08/2026

How to control Openhab ↓

TOOL MAP

What Openhab exposes to your agents

Read (11) Write / Execute (10) Destructive / Financial (4)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Openhab tools

Destructive · High manage_item The tool spans multiple categories including Destructive (delete, remove_tag, remove_metadata), Write (create_or_update, update_state, add_tag, set_metadata), and Execute (update_state triggers physical device changes in Destructive · High manage_rule The tool supports 'delete' which irreversibly removes automation rules, making it Destructive. Destructive · High manage_thing The tool explicitly supports 'delete' as one of its actions, which irreversibly removes things from the OpenHAB configuration. Destructive · High manage_ui The tool spans multiple categories but includes irreversible destructive actions (uninstall_addon removes installed add-ons, delete_tag permanently removes semantic tags).

14 of Openhab's 25 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Openhab

PolicyLayer is an MCP gateway — it sits between your AI agents and Openhab, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "manage_item": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "manage_link": {
    "limits": [
      {
        "counter": "manage_link_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "analyze_home": {
    "limits": [
      {
        "counter": "analyze_home_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Openhab — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON OPENHAB →

Instant setup, no code required.

FULL CATALOGUE

All 25 Openhab tools

DESTRUCTIVE 4 tools

Destructive manage_item Modify items. action: create_or_update, delete, update_state, add_tag, remove_tag, set_metadata, remove_metada Destructive manage_rule Manage automation rules. action: create, update, delete, enable, disable, run. Destructive manage_thing Manage things. action: create, update, delete, enable, disable, configure. Destructive manage_ui UI, add-ons, sitemaps, semantic tags, and discovery inbox. action: addons, install_addon, uninstall_addon, sit

EXECUTE 7 tools

Execute automation Automation generation and testing. action: generate_rule (from NL), discover_patterns (temporal correlation), Execute control_media Control a media player equipment item. action: play, pause, next, previous, volume_up, volume_down. Execute execute_batch Execute multiple commands in parallel. Use for Execute manage_system System config, loggers, voice/audio, and binding scans. action: system_info, services, service_config_get, ser Execute remediate Bulk remediation and generation. Execute schedule_command Schedule a command to run after a delay (e.g. Execute send_command Send a command (ON, OFF, numeric value, etc.) to a single item.

WRITE 3 tools

Write manage_link Manage item-channel links. action: list, link, unlink, configure (apply a link profile). Write manage_persistence Persistence data operations. action: services (list), get_data, store_data, statistics, summarize. Write manage_scene Named scene management. action: capture (save current item states), activate (restore a saved scene).

READ 11 tools

Read analyze_home Home-wide analysis. action: health (offline + battery), safety_audit, energy, stale_items, orphans (broken lin Read diagnose_item Item diagnostics. action: explain (forensic state + rules + history), topology (Mermaid home graph). Read generate_home_blueprint Full room-by-room Markdown guide of the home. Use for layout exploration or when a user explicitly asks for a Read get_system_summary High-density snapshot of the OpenHAB system: items, things, rooms, health. Read initial_discovery One-shot bootstrap: returns a compact guidance context with a room-grouped quick-reference of every item (name Read manage_logs OpenHAB log access. Logs are on the remote OpenHAB server — ask the user for the path and call set_folder firs Read mcp_status MCP server metadata. action: health (SSE/cache metrics), capabilities, prompt_context (AI priming context for Read query_items Read item data. action: all (list with optional filters), get (by name), multi (batch by names), search (fuzzy Read query_rules Read automation rules. action: all (list all), get (by UID). Read query_things Read thing data. action: all (list all), get (by UID), status (status info). Read resolve_item PRIMARY item finder. Converts natural-language intent (

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Openhab

Can an AI agent delete data through the Openhab MCP server? +

Yes. The Openhab server exposes 4 destructive tools including manage_item, manage_rule, manage_thing. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Openhab? +

The Openhab server has 3 write tools including manage_link, manage_persistence, manage_scene. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Openhab.

How many tools does the Openhab MCP server expose? +

25 tools across 3 categories: Execute, Read, Write. 11 are read-only. 14 can modify, create, or delete data.

How do I enforce a policy on Openhab? +

Register the Openhab MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Openhab tool call.

Deterministic rules across all 25 Openhab tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON OPENHAB →

Instant setup, no code required.

25 Openhab tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Openhab's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →