As you have likely seen from the ninety-zillion comments online about connecting HA to an MCP server, more and more of us are wiring AI agents into Home Assistant over MCP. The problem nobody has really solved yet is the agent has no idea which devices are safe to touch. It'll happily unlock a door or disarm an alarm if the prompt nudges it that way.
mesa-core is a layer that decides what an agent is allowed to do. You give it an entity and an action, it tells you allowed, ask-the-user-first, or no, and why. It's a semantic enforcement engine. It is not an MCP server, and it is not a custom integration. It is a library which any MCP server can import and utilize today.
ATM 2.0 was the first MCP server to implement mesa-core, and recently ran a road-test. In that test ATM blocked 100% of actions on off-limits devices, versus 10-16% for MCP servers without MESA.
What it does:
- Four control modes per entity: act freely, ask first, read-only, or never.
- Safe defaults before you configure anything: lights act freely, locks and alarm panels are off-limits, everything else asks first.
- Profiles add semantic context (purpose, reversibility, sensitivity, automation side-effects) to any entity, script, or automation, scoped per entity, area, domain, or whole integration.
- Rules by entity, area, or whole domain. The most restrictive one wins, and anything it can't verify gets blocked rather than allowed.
- "Ask first" devices return a confirmation challenge instead of a yes, so the user approves the action before it runs.
- Finer limits and time rules, like capping speaker volume after 10pm or no blinds before sunrise.
- Optional MCP tools so the agent can look up an entity's rules itself before acting, instead of finding out by getting blocked.
Safety is just the enforcement side of it. The same profiles carry semantic context the agent can reason with, which is a whole topic on its own. Read the docs.
mesa-core has zero runtime dependencies and never talks to HA directly. You hand it device state through callbacks, it hands you a decision, so it drops into whatever MCP server you're already running.
The documentation goes a lot deeper than this post does. Worth a read if you want to know everything the profiles can actually express. Feedback welcome.
Install: pip install mesa-core
GitHub: https://github.com/sfox38/mesa-core
Road-test summary: https://sfox38.github.io/atm-roadtest/