simplisafe-mcp
The server lets Claude monitor and control a SimpliSafe home security system (and its smart locks), with built-in confirmations for any action that changes physical state or reads alarm PINs.
List/get systems – account systems, alarm state, connectivity, power, base-station messages
List sensors & locks – battery/offline/triggered status, lock positions (locked/unlocked/jammed)
Get events – recent base-station events (arm/disarm, opens, lock/unlock, alarms), newest first
Get settings – entry/exit delays, volumes, chime, voice prompts, base-station health
Read alarm PINs – cleartext user PINs (master, duress, named users), with confirmation required
Arm/disarm alarm – off/home/away, verified by re-reading system after execution
Lock/unlock doors – smart lock control, verified after execution
Healthcheck – verify auth and API reachability
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@simplisafe-mcpcheck if my alarm is armed"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
simplisafe-mcp
MCP server for SimpliSafe home security. Check whether the system is armed, review sensors and events, arm/disarm, and control smart locks — from Claude.
This server can disarm a home alarm and unlock doors. Every tool that changes physical state, plus the tool that reads alarm PINs, asks you to confirm first — nothing is sent until you do, and you see a preview of exactly what would happen (see Confirmations). Install it only where you'd be comfortable with that capability.
Developed and maintained by AI (Claude Code).
What you get
Tool | |
| Systems on the account with current alarm state |
| One system's state, connectivity, base-station messages |
| Sensors with battery / offline / triggered status, filterable |
| Smart locks with locked / unlocked / jammed state |
| Recent base-station events (arm, disarm, opens, alarms) |
| Entry/exit delays, volumes, base-station health |
| Alarm PINs — cleartext, asks you to confirm first |
| Arm home / arm away / disarm — asks you to confirm first |
| Lock / unlock a door — asks you to confirm first |
| Auth + API reachability |
Supports SimpliSafe 3 systems. Legacy SS2 systems are rejected with an explanation rather than an opaque upstream 404.
Related MCP server: mcp-hs4
Install
npm install -g simplisafe-mcpOr add to .mcp.json:
{
"mcpServers": {
"simplisafe": {
"command": "npx",
"args": ["-y", "simplisafe-mcp"],
"env": { "SIMPLISAFE_REFRESH_TOKEN": "${SIMPLISAFE_REFRESH_TOKEN}" }
}
}
}Authentication — one browser login, once
SimpliSafe issues no API keys. The credential is an OAuth2 refresh token, minted by a browser login you perform one time:
git clone https://github.com/chrischall/simplisafe-mcp && cd simplisafe-mcp
node scripts/bootstrap-auth.mjs # prints an authorize URL
# sign in (MFA included), then copy the com.simplisafe.mobile:// URL
node scripts/bootstrap-auth.mjs "<that URL>"The token is written to .env (mode 0600) after being verified against the live
API. SimpliSafe does not rotate refresh tokens, so it stays valid until you
sign out of all devices in the SimpliSafe app — which is how you revoke it.
Capturing the code: open DevTools → Network and tick Preserve log before
signing in; afterwards the browser fails to open a com.simplisafe.mobile://…
link, and that failed entry's link address is what you paste. The code is
single-use and expires in about two minutes.
Treat the resulting token like a house key: it grants full control of the alarm.
Confirmations
Arming, disarming, locking, unlocking and reading the PINs all ask you to
confirm first. On a client that can show a confirmation prompt (Claude Code) you
get the prompt, with the details below. On one that cannot (claude.ai, Claude
Desktop) the first call sends nothing and returns a preview plus a
confirmToken; only a repeat call with that token acts, once. The preview
includes a plain statement of the physical consequence:
{
"status": "confirmation-required",
"confirmed": false,
"dispatched": false,
"action": "alarm.set_state",
"preview": {
"action": "set alarm state to away",
"method": "POST",
"path": "/ss3/subscriptions/7858153/state/away",
"sid": 7858153,
"locationName": "Home",
"currentState": "OFF",
"requestedState": "AWAY",
"warning": "Arms ALL sensors including interior motion. Starts an exit delay; anyone still moving inside when it expires can trigger the siren and a monitoring-center dispatch."
},
"confirmToken": "…",
"expiresAt": "…",
"ttlSeconds": 600,
"instruction": "Show this preview to the user verbatim and proceed only after they explicitly approve in chat. Then call again with confirmToken."
}The token is bound to that tool, target and preview. The system is re-read on
the second call, and if what would happen no longer matches what you approved —
different arguments, or the alarm or lock state moved in between — it is
refused (DRAFT_CHANGED) with a fresh preview. A token that was already used is
refused too (TOKEN_REUSED).
variable | default | |
|
| What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). |
|
| How long a token stays valid. |
| random per process | Signing key; set it only if tokens must survive a server restart. |
Writes are verified
Once confirmed, a write executes and then re-reads the system to check what
actually happened, reporting confirmed, in_progress (the exit delay is
counting down), or unconfirmed. A 2xx is never treated as proof.
Shell access without the server
For quick one-off queries there's a curl-based skill in
skills/simplisafe-api/ — same API, no MCP
process, sharing the same refresh token.
Development
npm install
npm run build
npm testVerified endpoint shapes live in docs/SIMPLISAFE-API.md, including several things that are easy to get backwards:
lock state is encoded 1 = locked, 2 = unlocked;
system version for routing is at
location.system.version, not the top-levelsystemVersion;events and doorlock control are not under the
ss3/prefix;numEventshas an undocumented hard ceiling of 50;settings.pinsreturns alarm codes in cleartext alongside harmless settings.
Disclaimer
Unofficial. Not affiliated with or endorsed by SimpliSafe. It uses the same private API the SimpliSafe mobile app uses, with your own account credentials. Use at your own discretion.
License
MIT
Available Tools
10 toolssimplisafe_get_eventsARead-only
Get recent events recorded by the base station — arm/disarm, sensor opens, lock and unlock, alarms, errors — newest first. Each event carries an ISO timestamp alongside the raw epoch seconds.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| event_type | No | Only return events with this eventType, e.g. "activity" or "alarm". | |
| num_events | No | How many events to return, 1-50 (SimpliSafe rejects more than 50). Defaults to 50. | |
| from_timestamp | No | Only events at or after this Unix timestamp (seconds). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation readOnlyHint=true covers the safety profile. The description adds meaningful behavioral details beyond the annotation: events are returned newest first, and each event includes both an ISO timestamp and raw epoch seconds. This helps the agent understand the ordering and timestamp format. It does not mention pagination limits or filtering, but those are captured in the input schema, so the description need not repeat them. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action and key behaviors (ordering, content) and provides useful detail about timestamps. Every clause earns its place, and there is no verbosity or redundant information. This is a model of conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description does the work of explaining the return format — at least the timestamp aspect. It also lists event types and order. The input schema covers parameters thoroughly, and the annotation covers safety. What is missing is a fuller description of the event object's fields (beyond timestamps) and any behavior around the num_events default or from_timestamp filtering, but those are partially in schema. Overall, it is reasonably complete for a read-only listing tool, though it could be slightly richer on the response structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and all four parameters (sid, event_type, num_events, from_timestamp) are already documented with descriptions in the schema. The tool description adds no parameter-specific meaning beyond what the schema provides. Per the rubric, when schema coverage is high, the baseline is 3. No additional context is offered, so a 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get recent events'), the resource ('recorded by the base station'), and specifies the content (arm/disarm, sensor opens, locks, alarms, errors) plus ordering (newest first). This distinguishes it from sibling tools like simplisafe_list_sensors and simplisafe_list_locks, which target different resources. The verb is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly defines when to use this tool — when you need recent event history from the base station — and lists the event categories. It does not explicitly state exclusions or alternatives, but the clear resource focus makes it obvious that this is for events rather than sensors/locks. The context from sibling names reinforces this. Slightly lacking explicit 'when not to use' guidance, but adequate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_get_pinsADestructiveIdempotent
Read the system's user PINs (master, duress and named users). These are the live alarm codes and are returned in cleartext, so calling this puts them into the conversation. Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a warning preview and a confirmToken and fetches nothing, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| confirmToken | No | ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond annotations by disclosing that PINs are live alarm codes, returned in cleartext, and become part of the conversation – a critical side effect. It also explains the two-step confirmation fallback and when data is actually fetched, matching and enriching the destructive/openWorld hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences: the first states the core purpose, and the second contains the essential security/confirmation warning. All content earns its place; there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a sensitive read with no output schema, the description covers safety, confirmation flow, token semantics, and data exposure. An agent has enough to call it correctly and handle the fallback path.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers both parameters fully (100% coverage), so the baseline is 3; the description adds meaningful behavior around confirmToken (phase-1 preview, no fetch, repeat call with token). It does not add extra meaning for sid, but none is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action ('Read') and resource ('system's user PINs'), listing the categories (master, duress, named users) so an agent can distinguish it from sibling get/list tools. No ambiguity about what it retrieves.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Makes clear this is the tool for reading PINs and provides the confirmation workflow for both supported clients and the fallback path. It does not explicitly name alternatives or when-not-to-use, but none of the siblings serve the same purpose, so the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_get_settingsARead-only
Get base-station settings for a system: entry/exit delays, alarm volume and duration, door chime, voice prompts, plus base-station health (wifi/cellular signal, wall power, backup battery, RF jamming). Does not include PINs — use simplisafe_get_pins for those.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already covers the read-only nature. The description adds value by listing the exact scope of returned data (settings and health) and explicitly stating what is excluded (PINs). This goes beyond annotations without contradicting them, though it doesn't discuss other behavioral aspects like error conditions or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no fluff. The core purpose and content are front-loaded, and the exclusion/alternative is stated efficiently at the end. Every phrase contributes value, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Since there is no output schema, the description carries the burden of explaining what is returned, which it does thoroughly by listing the settings and health items. It also clarifies the scope (not PINs). The only minor gap is not addressing the relationship with simplisafe_healthcheck, but for a simple read tool, this is largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides full coverage of the single parameter 'sid' with a clear description, so the baseline is 3. The tool description does not add any additional meaning or context about the parameter, leaving it entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get base-station settings for a system' and enumerates the specific items included (entry/exit delays, alarm volume, etc.). It also explicitly differentiates from simplisafe_get_pins by noting what it does not include, giving strong sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit exclusion and alternative for PINs ('Does not include PINs — use simplisafe_get_pins for those'). However, it does not address potential overlap with simplisafe_healthcheck (which may also cover health status) or when to prefer this over simplisafe_get_system. So guidance is present but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_get_systemARead-only
Get the current state of one SimpliSafe system: alarm state, whether it is alarming, base-station connectivity, power/battery status and any pending base-station messages.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already establishes that this is a safe read, and the description adds the specific categories of state the agent can expect. It does not add details about auth, failure behavior, polling, or response format, but for an annotated read-only tool the main behavioral disclosure is covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that names the operation and lists exactly what state is included, with no filler or repetition. Every listed item—alarm state, alarming, connectivity, power/battery, base-station messages—earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-optional-parameter, read-only tool, the description plus schema is nearly complete: the description identifies the returned state categories and the schema resolves the sid optionality. A small gap is the absence of any hint about the response structure, but the listed fields compensate because there is no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents the single sid parameter at 100% coverage, including the optional-when-one-system / required-when-multiple rule. The description only reinforces 'one system' and adds no new parameter-level meaning, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the specific operation (get current state) and the resource (one SimpliSafe system) and enumerates the state components: alarm state, alarming, connectivity, power/battery, and base-station messages. This clearly differentiates it from siblings like simplisafe_list_systems or simplisafe_get_settings, even without naming them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The wording implies this is for fetching a live snapshot of a single system rather than listing systems or changing settings, so the intended use is inferable. However, the description never states when to prefer this over siblings or when not to use it, leaving routing to the agent's inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_healthcheckARead-only
Check that the server can authenticate to SimpliSafe and reach the API. Reports whether the refresh token is configured and working, the resolved user id, and how many active systems the account has. Start here when other tools fail.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already marks this as safe, and the description adds useful behavioral context beyond that: it reports whether the refresh token is configured/working, the resolved user ID, and the number of active systems. This tells the agent what diagnostic information it will receive without promising any mutations or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: the first defines the operation, the second enumerates the outputs, and the final usage cue 'Start here when other tools fail' earns its place. It is front-loaded with action and purpose, with no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description adequately covers the return contract by listing the three key pieces of information the health check produces. It also provides a usage trigger. It could theoretically detail error behavior, but for a zero-parameter read-only healthcheck this is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, and the empty schema is fully covered. The description need not add parameter-level detail because there is nothing to configure; the baseline of 4 for parameterless tools is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Check that the server can authenticate to SimpliSafe and reach the API') and resource, clearly distinguishing it from sibling tools that list systems, get sensor data, or change alarm state. It also specifies the outputs the agent can expect, making the tool's role unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Start here when other tools fail' gives an explicit when-to-use instruction, positioning this as a diagnostic entry point. It does not explicitly list exclusions or alternatives, but the context is clear enough for an agent to know this should precede troubleshooting on other SimpliSafe tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_list_locksARead-only
List the smart locks on a system with their current state (locked / unlocked / jammed), lock and keypad battery status, and keypad connectivity. Returns the serial that simplisafe_set_lock_state takes. Polls the base station fresh by default, because a stale answer to "is my door locked?" is worse than a slow one.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| force_update | No | Re-poll the base station before answering. Defaults to TRUE for locks — set false to accept a possibly-stale cached reading in exchange for speed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With `readOnlyHint: true` already present, the description adds valuable behavioral detail beyond the annotation: it discloses that the tool polls the base station fresh by default and explains the rationale that stale lock status is worse than a slower response. This gives the agent important expectations about latency and data freshness without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The first sentence states the tool's core output, the second explains a key behavioral default and its rationale. Every clause earns its place, and the most decision-relevant information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although there is no output schema, the description enumerates the important return contents: lock state, battery status, keypad connectivity, and the serial for `simplisafe_set_lock_state`. Combined with full parameter schema coverage and the readOnly annotation, an agent has enough information to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds extra meaning for `force_update` by explaining why fresh polling is the default and why an agent may accept stale data for speed. That is meaningful semantic value beyond the schema, though `sid` remains adequately documented only in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List'), the resource ('smart locks on a system'), and the exact information returned: current lock state, battery status, keypad connectivity, and the serial for `simplisafe_set_lock_state`. This makes the tool's purpose unambiguous and distinguishes it from related siblings like `simplisafe_list_sensors` and `simplisafe_set_lock_state`.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use this tool: to inspect lock states and obtain the serial needed by `simplisafe_set_lock_state`. It also explains the default polling behavior and the tradeoff between freshness and speed. It does not explicitly name alternatives or state when not to use it, but the intended use is well implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_list_sensorsARead-only
List the sensors and devices paired to a system — entry sensors, motion, glass break, smoke/CO, keypads, sirens and locks — with battery, offline and triggered status. Filter by type with type_name (e.g. "entry", "motion_v2", "lock").
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| type_name | No | Only return devices of this type name, e.g. "entry", "lock", "smoke". | |
| force_update | No | Ask the base station to re-poll its devices first (slower). Defaults to false. | |
| problems_only | No | Only return devices that are offline, low battery, or triggered. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations declare readOnlyHint=true, and the description is consistent with that by describing a read-only listing operation. It adds useful contextual detail about the returned statuses and filtering behavior, but it does not disclose response shape, pagination, or side effects of force_update. No contradiction with annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words: the verb and resource come first, followed by device categories, statuses, and filter syntax. It avoids repeating schema boilerplate and delivers the most important information in a compact, well-ordered format.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only listing tool with zero required parameters and full schema coverage, the description is nearly complete: it names relevant device categories and statuses, and the schema fills in the remaining parameter details. The main gap is that it does not steer an agent away from the overlapping simplisafe_list_locks sibling, but this is not critical for actually invoking the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, but the description adds genuine value by explaining the type_name filter with concrete examples such as 'entry', 'motion_v2', and 'lock'. It also clarifies that the result includes battery, offline, and triggered status, which informs how problems_only is meant to be used. The force_update and problems_only parameters are not described in the main text, but the schema already documents them adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and object, 'List the sensors and devices paired to a system', and enumerates concrete device categories such as entry sensors, motion, glass break, smoke/CO, and locks. It clearly identifies what the tool returns, but it does not explicitly differentiate itself from the sibling simplisafe_list_locks, which overlaps with the locks category.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives actionable filter guidance for type_name with concrete examples like 'entry' and 'motion_v2', which helps an agent narrow results. However, it never states when to prefer this tool over simplisafe_list_locks or simplisafe_get_system, nor does it provide any exclusions or alternative routing. Usage context is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_list_systemsARead-only
List the SimpliSafe systems on this account with their current alarm state (off/home/away), alarming status, connectivity and power status. Start here to get the sid other tools take.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already communicates that this is a read-only operation, and the description is consistent with that. It adds useful behavioral context by describing what data is returned, including alarm state values and connectivity/power status, and it explains that the returned sid is needed by other tools. This goes beyond the annotation without contradicting it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. It front-loads the action and resource, then adds only essential guidance about the sid. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless list tool with no output schema, the description fully covers what the tool does, what fields are returned, and how the result is used by sibling tools. There is no critical missing context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema carries no parameter burden. The description correctly notes that the tool lists systems for the account and provides the sid for downstream tools, which is the only meaningful semantic context needed here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'List the SimpliSafe systems on this account.' It also names the key output fields (alarm state, alarming status, connectivity, power status), making the tool's purpose immediately clear. The closing 'Start here' helps distinguish it as the entry point from sibling tools that require an sid.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent to 'Start here to get the sid other tools take,' which is strong contextual guidance for when to call this tool before others. It does not provide explicit exclusions or alternatives, but the entry-point role is clearly communicated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_set_alarm_stateADestructiveIdempotent
Arm or disarm the alarm system: "off" (disarm), "home" (perimeter only) or "away" (all sensors). Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE). This physically changes a security system: disarming leaves the house unmonitored, and arming can trigger a siren and a monitoring-center dispatch. After executing, the new state is verified by re-reading the system.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| state | Yes | Target state: off (disarm), home, or away. | |
| confirmToken | No | ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond annotations by disclosing the two-phase confirmation flow, the confirmToken fallback, the physical consequences of disarming or arming, and the post-execution verification. This gives the agent critical risk awareness that readOnlyHint and destructiveHint alone would not provide. No contradiction with annotations was found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action and states, then adds necessary warnings and confirmation behavior. Every sentence carries meaning: what the states mean, how confirmation works, what consequences are, and what happens after execution. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, physically impactful tool with 3 parameters and no output schema, the description covers the essential context: target states, confirmation requirements, token fallback, real-world consequences, and verification after execution. An agent has enough to invoke it safely and correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by explaining 'home' as 'perimeter only' and 'away' as 'all sensors', and it reinforces the confirmToken lifecycle. These additions are useful but modest compared to the already-detailed schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb phrase, 'Arm or disarm the alarm system', and enumerates the three target states with their meanings. It is clearly distinct from siblings like simplisafe_set_lock_state and the read-only get/list tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes it clear this tool is for changing alarm state, and its confirmation and consequences imply it should be used deliberately rather than casually. It does not explicitly name alternatives or state when not to use it, but the purpose is unambiguous enough that an agent can select it correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_set_lock_stateADestructiveIdempotent
Lock or unlock a SimpliSafe smart lock. Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE). Unlocking physically opens a door lock, so it is gated even though it is technically reversible. After executing, the result is verified by re-reading the lock state.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| state | Yes | Target: lock or unlock. | |
| serial | Yes | Lock serial, from simplisafe_list_locks. | |
| confirmToken | No | ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, it discloses that the tool prompts for user confirmation, that unlocking physically opens a door lock, that the fallback requires a phase-1 preview and confirmToken before a repeat call proceeds, and that results are verified by re-reading lock state. These details materially affect how an agent sequences calls and are not derivable from readOnlyHint or destructiveHint alone. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each earning its place: core operation, confirmation protocol, security rationale for gating, and post-execution verification. The confirmToken mechanics are dense and reference external MCP_CONFIRM_MODE, but the structure is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a gated mutation with no output schema, the description covers the essential behavioral contract: confirmation modes, physical consequences, token reuse rules, and verification behavior. The main gap is the exact response shape of phase-1 and phase-2 beyond 'preview and confirmToken,' but the reference to MCP_CONFIRM_MODE partially fills that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents all four parameters, so the baseline is 3. The description adds significant semantics for confirmToken: it must come from the same tool's phase-1 response, only after explicit user approval, never on the first call, never invented, and never reused. This is critical guidance beyond the schema's field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource, 'Lock or unlock a SimpliSafe smart lock,' which makes the operation unambiguous and distinguishes it from siblings like simplisafe_set_alarm_state. The follow-up detail about confirmation and verification does not blur the core purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear procedural context for the confirmation flow and the confirmToken fallback, and it makes clear that unlocking is gated. However, it never explicitly names alternative tools or states when not to use this tool, so an agent must infer that alarm-related changes belong to simplisafe_set_alarm_state.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v1.2.1- Changed
simplisafe_get_pins2 fields changed- removed
Input schema / properties / confirmRemoved value: -{ - "description": "Must be true to proceed. Without this, the tool returns a preview.", - "type": "boolean" -} - added
Input schema / properties / confirmTokenAdded value: +{ + "description": "ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 \"confirmation-required\" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.", + "type": "string" +}
- Changed
simplisafe_set_alarm_state2 fields changed- removed
Input schema / properties / confirmRemoved value: -{ - "description": "Must be true to proceed. Without this, the tool returns a preview.", - "type": "boolean" -} - added
Input schema / properties / confirmTokenAdded value: +{ + "description": "ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 \"confirmation-required\" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.", + "type": "string" +}
- Changed
simplisafe_set_lock_state2 fields changed- removed
Input schema / properties / confirmRemoved value: -{ - "description": "Must be true to proceed. Without this, the tool returns a preview.", - "type": "boolean" -} - added
Input schema / properties / confirmTokenAdded value: +{ + "description": "ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 \"confirmation-required\" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.", + "type": "string" +}
10 tool updates
v1.0.0- Changed
simplisafe_get_events1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_get_pins1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_get_settings1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_get_system1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_healthcheck1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_list_locks1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_list_sensors1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_list_systems1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_set_alarm_state1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_set_lock_state1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
10 tool updates
v0.1.1- First observed
simplisafe_get_events - First observed
simplisafe_get_pins - First observed
simplisafe_get_settings - First observed
simplisafe_get_system - First observed
simplisafe_healthcheck - First observed
simplisafe_list_locks - First observed
simplisafe_list_sensors - First observed
simplisafe_list_systems - First observed
simplisafe_set_alarm_state - First observed
simplisafe_set_lock_state
TDQS
Scored across 10 tools
Most tools target distinct resources and actions, and the descriptions clearly explain scope differences. Minor overlap exists between get_system/list_systems and list_locks/list_sensors, but the descriptions are specific enough to prevent serious confusion.
Tool names consistently use a simplisafe_ prefix and snake_case, with a predictable get_/set_/list_ verb pattern. simplisafe_healthcheck is the one deviation, but the overall naming convention is still coherent and easy to follow.
Ten tools is a well-scoped surface for a SimpliSafe integration, covering account/system lookup, alarm control, lock control, sensors, events, settings, PINs, and connection health. Each tool has a clear purpose and none feels redundant.
Core monitoring and control workflows are covered: listing systems, reading state, arming/disarming, listing sensors and locks, locking/unlocking, fetching events, viewing settings, and reading PINs. The main gaps are write operations for settings and PIN management, but common agent workflows should not hit dead ends.
Maintenance
Related MCP Connectors
MCP server wrapping the Tesla Fleet API and TeslaMate API
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
The official Planning Center MCP server for interacting with your ministry's data.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceMCP server for controlling Nuki Smart Locks via Home Assistant, enabling lock/unlock, intercom buzzing, and battery checks.1MIT
- AlicenseBqualityCmaintenanceMCP server for controlling HomeSeer HS4 with safe, auditable, and guarded write operations.631MIT
- AlicenseAqualityBmaintenanceMCP server for the entire Shelly smart-home ecosystem, enabling local-first control, automation, and energy monitoring of Shelly devices with cloud fallback.24725 PyPIMIT
- FlicenseNot gradedqualityCmaintenanceMCP server for controlling Somfy TaHoma devices locally via the box's API, without cloud dependency.-