Security and permissions

Who can do what

• Only the home owner sees and changes the speech, brains, tools and skills settings.
• The speaker and the MCP server get settings, write the log and get the music token with the speaker key and only through the Homer server's home endpoint. From outside, these addresses refuse.
• A voice is a sign, not a password: a recording or the TV can fake it. Homer recognizes the household by voice and keeps cameras, tasks, memory and plan editing away from guests, but a voice can never widen rights. So everything dangerous goes through Opus with a log, the speaker's tool set can be cut down, and tasks can be locked with a PIN.

What the tools can't do

Without full access after PIN, the tools can't:

• Run programs or shell commands, read or write files.
• Make arbitrary network requests.
• Delete devices, change configuration, update or restart Home Assistant.
• Call Home Assistant services outside the allowlist.

What Claude receives

The brains run on your computer, but the model reasons in the Anthropic cloud, as with any Claude Code request. Along with the phrase, a home snapshot goes there: device names, rooms, states. Camera recordings, tokens and passwords don't.

Log

Everything dangerous and every Opus step is written to the home's Telegram group — see Telegram log. It's both oversight and a way to look back: who, when, what, and with what result.

What to turn off if the speaker is in a shared room

• delegate for the speaker: no tasks at all.
• zigbee_* for tasks: nobody can open the network or rename devices by voice.
• music_play: if children use the speaker.
• Confirm your household's voices in Household voices: everyone else becomes a guest and gets no cameras, tasks, memory or plan editing.

Task PIN

Settings → Speaker → Homer brains → Task PIN. The owner sets a PIN (4–8 digits) or a passphrase (2–6 words).

With a PIN, each task for the smart model goes like this:

1. The speaker repeats the request: “Did I get it right: open the calculator on the computer? If yes, say the PIN”.
2. You say the PIN. The speaker understands “1234”, “one two three four” and “twelve thirty-four”.
3. If the PIN is correct, the task starts. For the next 5 minutes, “yes” is enough instead of the PIN.

“No” or “cancel” cancels the task. Three wrong PINs in a row cancel it and pause tasks for 5 minutes; an entry goes to the log.

The PIN is never stored in plain text: the Homer server keeps a salt and a hash, and the speaker checks what it heard against the hash. A spoken PIN doesn't get into the speaker log, “Speaker conversations” or the brain's memory.

Via Alice and out loud

A PIN said to Alice is recognized by Yandex servers and stays in your account's request history. And anyone nearby hears it when you say it. This protects against an accidental command and against a guest, not against someone who overheard it.

Full access after PIN

A separate checkbox in the same place. With it, a task after the PIN is run by Claude Code on the speaker computer with all its tools and no confirmations: it starts programs (“Homer, open the calculator”), opens websites, works with files and the shell. Each such task is marked “⚠️ full access” in the log.

Without the checkbox, tasks after the PIN do only what the tools can do.