homebutler

homebutler is a single Go binary that inspects and manages a homelab: server status, Docker containers, open ports, backups, and an optional Proxmox VE cluster the operator already runs, exposed to AI agents through an MCP server. It ships 37 tools, including system_status, docker_restart, backup_create, backup_restore, and a family of proxmox_* tools for VM and container operations. The npm package (homebutler) is a thin installer around the Go binary; the MCP interface runs over stdio only, with no network port opened, so the README states that only the parent AI process can reach it.

The project is maintained by a single individual, SangheeSon (GitHub account Higangssh), whose ownership is confirmed by the GitHub API (account type User), the npm package's sole maintainer email, and the project's own site at homebutler.dev, which links back to the same GitHub account. homebutler does not front any named third-party home-automation vendor; it talks directly to infrastructure the operator already controls (Docker, SSH, Proxmox) and bundles install recipes for third-party self-hosted apps without wrapping any one of them as a product. That makes it a self-contained tool published by its own maker, so authority is first_party.

Vendor documentation (docs/mcp-server.md, "Protocol versions") states: "homebutler implements the MCP revisions 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05." That names the current spec revision plus four legacy ones, grounding spec_status as current. The repository has published two security advisories, both rated high: GHSA-v8mc-vpp8-jr4p (unauthenticated arbitrary file overwrite via a crafted manifest.json in restore, published 2026-08-26) and GHSA-9x86-gvgx-3cfh (symlink escape in restore --allow-bind, published 2026-08-30). Both concern the backup_restore tool exposed over MCP.