simplisafe-mcp
An MCP server that lets Claude monitor and control a SimpliSafe (SS3) home security system.
List systems on the account with current alarm state, connectivity and power status
Get one system's state, alarming status, base-station connectivity and pending messages
List sensors and devices (entry, motion, smoke/CO, keypads, sirens, locks) with battery, offline and triggered status, filterable by type or problems-only
List smart locks with locked/unlocked/jammed state plus battery and keypad connectivity
Get recent base-station events (arm/disarm, opens, lock/unlock, alarms), newest first, up to 50
Get base-station settings (delays, volumes, chime) and health (wifi/cellular, power, backup battery, RF jamming)
Read alarm PINs in cleartext (confirmation required first)
Arm home/away or disarm the system, with confirmation and post-write verification
Lock or unlock doors, with confirmation and post-write verification
Healthcheck auth and API reachability
All state-changing tools and the PIN reader require explicit confirmation before anything is sent.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@simplisafe-mcpcheck if my alarm is armed"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
simplisafe-mcp
MCP server for SimpliSafe home security. Check whether the system is armed, review sensors and events, arm/disarm, and control smart locks — from Claude.
This server can disarm a home alarm and unlock doors. Every tool that changes physical state, plus the tool that reads alarm PINs, asks you to confirm first — nothing is sent until you do, and you see a preview of exactly what would happen (see Confirmations). Install it only where you'd be comfortable with that capability.
Developed and maintained by AI (Claude Code).
What you get
Tool | |
| Systems on the account with current alarm state |
| One system's state, connectivity, base-station messages |
| Sensors with battery / offline / triggered status, filterable |
| Smart locks with locked / unlocked / jammed state |
| Recent base-station events (arm, disarm, opens, alarms) |
| Entry/exit delays, volumes, base-station health |
| Alarm PINs — cleartext, asks you to confirm first |
| Arm home / arm away / disarm — asks you to confirm first |
| Lock / unlock a door — asks you to confirm first |
| Auth + API reachability |
Supports SimpliSafe 3 systems. Legacy SS2 systems are rejected with an explanation rather than an opaque upstream 404.
Related MCP server: mcp-hs4
Install
npm install -g simplisafe-mcpOr add to .mcp.json:
{
"mcpServers": {
"simplisafe": {
"command": "npx",
"args": ["-y", "simplisafe-mcp"],
"env": { "SIMPLISAFE_REFRESH_TOKEN": "${SIMPLISAFE_REFRESH_TOKEN}" }
}
}
}Authentication — one browser login, once
SimpliSafe issues no API keys. The credential is an OAuth2 refresh token, minted by a browser login you perform one time:
git clone https://github.com/chrischall/simplisafe-mcp && cd simplisafe-mcp
node scripts/bootstrap-auth.mjs # prints an authorize URL
# sign in (MFA included), then copy the com.simplisafe.mobile:// URL
node scripts/bootstrap-auth.mjs "<that URL>"The token is written to .env (mode 0600) after being verified against the live
API. SimpliSafe does not rotate refresh tokens, so it stays valid until you
sign out of all devices in the SimpliSafe app — which is how you revoke it.
Capturing the code: open DevTools → Network and tick Preserve log before
signing in; afterwards the browser fails to open a com.simplisafe.mobile://…
link, and that failed entry's link address is what you paste. The code is
single-use and expires in about two minutes.
Treat the resulting token like a house key: it grants full control of the alarm.
Confirmations
Arming, disarming, locking, unlocking and reading the PINs all ask you to
confirm first. On a client that can show a confirmation prompt (Claude Code) you
get the prompt, with the details below (unless MCP_CONFIRM_ELICITATION=off).
On one that cannot (claude.ai, Claude Desktop) the first call sends nothing and returns a preview plus a
confirmToken; only a repeat call with that token acts, once. The preview
includes a plain statement of the physical consequence:
{
"status": "confirmation-required",
"confirmed": false,
"dispatched": false,
"action": "alarm.set_state",
"preview": {
"action": "set alarm state to away",
"method": "POST",
"path": "/ss3/subscriptions/7858153/state/away",
"sid": 7858153,
"locationName": "Home",
"currentState": "OFF",
"requestedState": "AWAY",
"warning": "Arms ALL sensors including interior motion. Starts an exit delay; anyone still moving inside when it expires can trigger the siren and a monitoring-center dispatch."
},
"confirmToken": "…",
"expiresAt": "…",
"ttlSeconds": 600,
"instruction": "Show this preview to the user verbatim and proceed only after they explicitly approve in chat. Then call again with confirmToken."
}The token is bound to that tool, target and preview. The system is re-read on
the second call, and if what would happen no longer matches what you approved —
different arguments, or the alarm or lock state moved in between — it is
refused (DRAFT_CHANGED) with a fresh preview. A token that was already used is
refused too (TOKEN_REUSED).
variable | default | |
|
| What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). |
|
|
|
|
| How long a token stays valid. |
| random per process | Signing key; set it only if tokens must survive a server restart. |
Writes are verified
Once confirmed, a write executes and then re-reads the system to check what
actually happened, reporting confirmed, in_progress (the exit delay is
counting down), or unconfirmed. A 2xx is never treated as proof.
Shell access without the server
For quick one-off queries there's a curl-based skill in
skills/simplisafe-api/ — same API, no MCP
process, sharing the same refresh token.
Development
npm install
npm run build
npm testVerified endpoint shapes live in docs/SIMPLISAFE-API.md, including several things that are easy to get backwards:
lock state is encoded 1 = locked, 2 = unlocked;
system version for routing is at
location.system.version, not the top-levelsystemVersion;events and doorlock control are not under the
ss3/prefix;numEventshas an undocumented hard ceiling of 50;settings.pinsreturns alarm codes in cleartext alongside harmless settings.
Disclaimer
Unofficial. Not affiliated with or endorsed by SimpliSafe. It uses the same private API the SimpliSafe mobile app uses, with your own account credentials. Use at your own discretion.
License
MIT
Available Tools
10 toolssimplisafe_get_eventsARead-only
Get recent events recorded by the base station — arm/disarm, sensor opens, lock and unlock, alarms, errors — newest first. Each event carries an ISO timestamp alongside the raw epoch seconds.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| event_type | No | Only return events with this eventType, e.g. "activity" or "alarm". | |
| num_events | No | How many events to return, 1-50 (SimpliSafe rejects more than 50). Defaults to 50. | |
| from_timestamp | No | Only events at or after this Unix timestamp (seconds). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered. The description adds genuine behavioral detail beyond that: results are newest-first, and each event carries both an ISO timestamp and raw epoch seconds, which matters for parsing. It omits rate limits or pagination/truncation behavior at the 50-event cap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler, and the most decision-relevant content (what events, where from, ordering) is front-loaded before the return-format note. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully describes the return shape (event categories, dual timestamp format, newest-first ordering), which compensates well. Authentication needs and the 50-event cap's implications are left to the schema and annotations, leaving only minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters (sid, event_type, num_events, from_timestamp) are already fully documented in the schema, including defaults, ranges, and the 50-event cap. The description adds no parameter-level detail, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Get') and resource ('recent events recorded by the base station'), then enumerates the event categories returned (arm/disarm, sensor opens, lock/unlock, alarms, errors) and the sort order. This is precise enough that an agent can distinguish it from state-listing siblings like simplisafe_list_sensors or simplisafe_get_system.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies its usage context (retrieving recent event history, newest first) but never states when to prefer it over siblings such as simplisafe_get_system or simplisafe_list_sensors, nor any exclusions or prerequisites. Usage is inferable from purpose rather than explicitly guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_get_pinsADestructiveIdempotent
Read the system's user PINs (master, duress and named users). These are the live alarm codes and are returned in cleartext, so calling this puts them into the conversation. Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a warning preview and a confirmToken and fetches nothing, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE).
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| confirmToken | No | ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond annotations by disclosing that PINs are live alarm codes, returned in cleartext, and become part of the conversation – a critical side effect. It also explains the two-step confirmation fallback and when data is actually fetched, matching and enriching the destructive/openWorld hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences: the first states the core purpose, and the second contains the essential security/confirmation warning. All content earns its place; there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a sensitive read with no output schema, the description covers safety, confirmation flow, token semantics, and data exposure. An agent has enough to call it correctly and handle the fallback path.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers both parameters fully (100% coverage), so the baseline is 3; the description adds meaningful behavior around confirmToken (phase-1 preview, no fetch, repeat call with token). It does not add extra meaning for sid, but none is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action ('Read') and resource ('system's user PINs'), listing the categories (master, duress, named users) so an agent can distinguish it from sibling get/list tools. No ambiguity about what it retrieves.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Makes clear this is the tool for reading PINs and provides the confirmation workflow for both supported clients and the fallback path. It does not explicitly name alternatives or when-not-to-use, but none of the siblings serve the same purpose, so the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_get_settingsARead-only
Get base-station settings for a system: entry/exit delays, alarm volume and duration, door chime, voice prompts, plus base-station health (wifi/cellular signal, wall power, backup battery, RF jamming). Does not include PINs — use simplisafe_get_pins for those.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered. The description adds real content beyond that by scoping the returned data (settings plus wifi/cellular signal, wall power, backup battery, RF jamming) and by declaring what is deliberately omitted (PINs).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler, front-loaded with the core purpose before the field enumeration and the exclusion. Every clause carries information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by enumerating the returned settings and health signals, and it covers the one ambiguity risk (PINs). Nothing needed to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single sid parameter is fully documented in the schema, including the optional-when-single-system rule. The description adds nothing about the parameter, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Get) and resource (base-station settings) and then enumerates the actual settings and health fields returned, so an agent knows exactly what comes back. The explicit exclusion of PINs and the pointer to simplisafe_get_pins distinguishes it from a plausible sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit negative boundary ('Does not include PINs — use simplisafe_get_pins for those'), which routes the agent to the right alternative for the adjacent use case. It does not distinguish this from simplisafe_get_system, which is the other obvious confusion risk, so it falls short of a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_get_systemARead-only
Get the current state of one SimpliSafe system: alarm state, whether it is alarming, base-station connectivity, power/battery status and any pending base-station messages.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so the agent knows this is a non-mutating call against an external service. The description usefully adds what state is actually surfaced (including pending base-station messages), but says nothing about auth requirements, rate limits, or freshness of the returned snapshot. With annotations carrying the safety profile, this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the verb and scope, with the returned-state list following. No filler, no repetition of the tool name, and every clause conveys information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, and the description compensates by enumerating the state categories returned, which is the key thing an agent needs to decide whether to call it. The only gap is operational context such as whether the snapshot is cached or how it differs from get_settings/get_events.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single sid parameter is fully documented there, including the optional-when-one-system / required-when-many rule. The description adds nothing about sid, so the baseline 3 for schema-covered parameters is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (get) and resource (one SimpliSafe system's current state), then enumerates the exact fields returned: alarm state, alarming flag, base-station connectivity, power/battery, and pending messages. This distinguishes it from siblings like simplisafe_list_systems (enumeration) and simplisafe_get_settings (configuration) without needing to open a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the agent can infer it should call this for a live status snapshot of a single system. There is no explicit when-to-use guidance, no mention of how it relates to simplisafe_get_settings, simplisafe_get_events, or simplisafe_healthcheck, and no note about polling or staleness.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_healthcheckARead-only
Check that the server can authenticate to SimpliSafe and reach the API. Reports whether the refresh token is configured and working, the resolved user id, and how many active systems the account has. Start here when other tools fail.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly and openWorld, and the description adds real context beyond them: it authenticates to SimpliSafe, verifies the refresh token is configured and working, and summarizes account state. It stops short of describing failure/report formats or rate-limit behavior, but the auth and connectivity semantics are well disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, each earning its place: what it checks, what it returns, and when to invoke it. The invocation guidance is front-loaded after the purpose statement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by enumerating the reported fields (token status, user id, active system count). For a zero-parameter read-only diagnostic with annotations covering safety, nothing an agent needs is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the rubric the baseline is 4. No parameter information is needed or missing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (check) and resource (server authentication/API reachability) and enumerates exactly what it reports: refresh token status, resolved user id, and active system count. This is clearly distinguishable from the sibling list/get/set tools, none of which are diagnostics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Start here when other tools fail" gives an explicit trigger condition that routes the agent to this tool first on failure. It does not name specific alternatives or exclusions, but for a diagnostic entry point the when-to-use guidance is concrete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_list_locksARead-only
List the smart locks on a system with their current state (locked / unlocked / jammed), lock and keypad battery status, and keypad connectivity. Returns the serial that simplisafe_set_lock_state takes. Polls the base station fresh by default, because a stale answer to "is my door locked?" is worse than a slow one.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| force_update | No | Re-poll the base station before answering. Defaults to TRUE for locks — set false to accept a possibly-stale cached reading in exchange for speed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint, so safety is covered. The description adds real behavioral context beyond that: the default fresh re-poll of the base station, the cost of that poll, and the fact that readings can be stale if force_update is disabled. It stops short of noting rate limits or multi-system behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with what is returned and followed by the one non-obvious behavior (default polling). The quoted rationale is slightly chatty but earns its place by justifying the default. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by enumerating the returned fields and the key `serial` identifier. Annotations cover the read-only profile, and the parameter contract is documented in the schema, so an agent has everything needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both `sid` and `force_update` are fully documented structurally, which sets the baseline at 3. The description reinforces the fresh-poll default for `force_update` but adds no syntax, format, or edge-case detail the schema lacks.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the smart locks on a system') plus exactly what each entry contains: state (locked/unlocked/jammed), lock and keypad battery, and keypad connectivity. It also cross-references the sibling it feeds into by naming the `serial` that simplisafe_set_lock_state consumes, which differentiates it from simplisafe_list_sensors and friends.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the freshness tradeoff explicitly ('Polls the base station fresh by default, because a stale answer to "is my door locked?" is worse than a slow one') and tells the agent when to override it. It does not name an alternative tool for cached reads or state any exclusions, so it falls just short of the explicit when/when-not/alternatives bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_list_sensorsARead-only
List the sensors and devices paired to a system — entry sensors, motion, glass break, smoke/CO, keypads, sirens and locks — with battery, offline and triggered status. Filter by type with type_name (e.g. "entry", "motion_v2", "lock").
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| type_name | No | Only return devices of this type name, e.g. "entry", "lock", "smoke". | |
| force_update | No | Ask the base station to re-poll its devices first (slower). Defaults to false. | |
| problems_only | No | Only return devices that are offline, low battery, or triggered. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so safety and network reach are covered. The description usefully discloses that battery, offline and triggered status are returned, but adds nothing about auth, rate limits, or the cost implied by `force_update` polling beyond what the schema says.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and resource before the filter hint. It is efficient, though the long device-type enumeration could be trimmed without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of describing what comes back and it does list the status fields. Combined with a fully-covered input schema and read-only annotations, an agent has enough to invoke it correctly; only the relationship to list_locks and pagination/count behavior is unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters, including sid optionality and force_update behavior. The description only reinforces `type_name` with a couple of extra example values ('motion_v2'), a marginal addition over structured data — baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('sensors and devices paired to a system'), then enumerates the covered device classes and the returned status fields. It is distinguishable from siblings like simplisafe_list_systems and even clarifies it covers locks, which overlaps with simplisafe_list_locks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains the filtering use case via `type_name` and names example values, which implies when to narrow results. However, it never states when to prefer this tool over simplisafe_list_locks or simplisafe_get_system, and gives no exclusions or prerequisites — the usage context is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_list_systemsARead-only
List the SimpliSafe systems on this account with their current alarm state (off/home/away), alarming status, connectivity and power status. Start here to get the sid other tools take.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, so safety is covered. Because there is no output schema, the description usefully carries the return-value burden by naming the fields surfaced per system (alarm state, alarming status, connectivity, power) and the sid hand-off to downstream tools.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler. The capability statement comes first and the routing hint ('Start here...') is front-loaded at the end of the opening sentence pair, so both key facts are immediately visible.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless read-only list tool with no output schema, the description covers purpose, returned fields, and the sid hand-off well. It omits any note on account scoping, pagination, or behavior when no systems exist, which are minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the schema has nothing to document and the baseline for this dimension is 4. The description correctly adds no parameter guidance, which is appropriate here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the SimpliSafe systems on this account') and enumerates what is returned: alarm state, alarming status, connectivity, power. The 'Start here' clause distinguishes it from siblings like simplisafe_get_system and simplisafe_list_sensors, so an agent can tell them apart without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly positions this as the entry point: 'Start here to get the `sid` other tools take', which tells the agent when this tool is the right first call. It does not name an alternative to avoid or state exclusion conditions, so it stops short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_set_alarm_stateADestructiveIdempotent
Arm or disarm the alarm system: "off" (disarm), "home" (perimeter only) or "away" (all sensors). Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE). This physically changes a security system: disarming leaves the house unmonitored, and arming can trigger a siren and a monitoring-center dispatch. After executing, the new state is verified by re-reading the system.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| state | Yes | Target state: off (disarm), home, or away. | |
| confirmToken | No | ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond annotations by disclosing the two-phase confirmation flow, the confirmToken fallback, the physical consequences of disarming or arming, and the post-execution verification. This gives the agent critical risk awareness that readOnlyHint and destructiveHint alone would not provide. No contradiction with annotations was found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action and states, then adds necessary warnings and confirmation behavior. Every sentence carries meaning: what the states mean, how confirmation works, what consequences are, and what happens after execution. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, physically impactful tool with 3 parameters and no output schema, the description covers the essential context: target states, confirmation requirements, token fallback, real-world consequences, and verification after execution. An agent has enough to invoke it safely and correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by explaining 'home' as 'perimeter only' and 'away' as 'all sensors', and it reinforces the confirmToken lifecycle. These additions are useful but modest compared to the already-detailed schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb phrase, 'Arm or disarm the alarm system', and enumerates the three target states with their meanings. It is clearly distinct from siblings like simplisafe_set_lock_state and the read-only get/list tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes it clear this tool is for changing alarm state, and its confirmation and consequences imply it should be used deliberately rather than casually. It does not explicitly name alternatives or state when not to use it, but the purpose is unambiguous enough that an agent can select it correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simplisafe_set_lock_stateADestructiveIdempotent
Lock or unlock a SimpliSafe smart lock. Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE). Unlocking physically opens a door lock, so it is gated even though it is technically reversible. After executing, the result is verified by re-reading the lock state.
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | System id. Optional when the account has exactly one system; required when it has several. | |
| state | Yes | Target: lock or unlock. | |
| serial | Yes | Lock serial, from simplisafe_list_locks. | |
| confirmToken | No | ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, it discloses that the tool prompts for user confirmation, that unlocking physically opens a door lock, that the fallback requires a phase-1 preview and confirmToken before a repeat call proceeds, and that results are verified by re-reading lock state. These details materially affect how an agent sequences calls and are not derivable from readOnlyHint or destructiveHint alone. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each earning its place: core operation, confirmation protocol, security rationale for gating, and post-execution verification. The confirmToken mechanics are dense and reference external MCP_CONFIRM_MODE, but the structure is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a gated mutation with no output schema, the description covers the essential behavioral contract: confirmation modes, physical consequences, token reuse rules, and verification behavior. The main gap is the exact response shape of phase-1 and phase-2 beyond 'preview and confirmToken,' but the reference to MCP_CONFIRM_MODE partially fills that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents all four parameters, so the baseline is 3. The description adds significant semantics for confirmToken: it must come from the same tool's phase-1 response, only after explicit user approval, never on the first call, never invented, and never reused. This is critical guidance beyond the schema's field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource, 'Lock or unlock a SimpliSafe smart lock,' which makes the operation unambiguous and distinguishes it from siblings like simplisafe_set_alarm_state. The follow-up detail about confirmation and verification does not blur the core purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear procedural context for the confirmation flow and the confirmToken fallback, and it makes clear that unlocking is gated. However, it never explicitly names alternative tools or states when not to use this tool, so an agent must infer that alarm-related changes belong to simplisafe_set_alarm_state.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v1.2.1- Changed
simplisafe_get_pins2 fields changed- removed
Input schema / properties / confirmRemoved value: -{ - "description": "Must be true to proceed. Without this, the tool returns a preview.", - "type": "boolean" -} - added
Input schema / properties / confirmTokenAdded value: +{ + "description": "ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 \"confirmation-required\" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.", + "type": "string" +}
- Changed
simplisafe_set_alarm_state2 fields changed- removed
Input schema / properties / confirmRemoved value: -{ - "description": "Must be true to proceed. Without this, the tool returns a preview.", - "type": "boolean" -} - added
Input schema / properties / confirmTokenAdded value: +{ + "description": "ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 \"confirmation-required\" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.", + "type": "string" +}
- Changed
simplisafe_set_lock_state2 fields changed- removed
Input schema / properties / confirmRemoved value: -{ - "description": "Must be true to proceed. Without this, the tool returns a preview.", - "type": "boolean" -} - added
Input schema / properties / confirmTokenAdded value: +{ + "description": "ONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 \"confirmation-required\" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.", + "type": "string" +}
10 tool updates
v1.0.0- Changed
simplisafe_get_events1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_get_pins1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_get_settings1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_get_system1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_healthcheck1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_list_locks1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_list_sensors1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_list_systems1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_set_alarm_state1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
simplisafe_set_lock_state1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
10 tool updates
v0.1.1- First observed
simplisafe_get_events - First observed
simplisafe_get_pins - First observed
simplisafe_get_settings - First observed
simplisafe_get_system - First observed
simplisafe_healthcheck - First observed
simplisafe_list_locks - First observed
simplisafe_list_sensors - First observed
simplisafe_list_systems - First observed
simplisafe_set_alarm_state - First observed
simplisafe_set_lock_state
TDQS
Scored across 10 tools
Most tools target a distinct resource+action (systems, sensors, locks, settings, events, pins, healthcheck). The only mild overlap is list_sensors, which explicitly includes locks, versus the dedicated list_locks, and get_system vs list_systems for a single system — but the descriptions clarify these boundaries well.
Every tool follows a predictable simplisafe_<verb>_<noun> pattern using consistent verbs (list_*, get_*, set_*). No mixing of camelCase, tense, or verb styles across the set.
Ten tools is well-scoped for a home-security control/monitoring server, and each one earns its place: multiple read tools for distinct resources plus the two state-changing control tools.
Read coverage is strong (systems, sensors, locks, settings, events, pins, health) and arm/disarm plus lock control are present, covering the core lifecycle. There are minor gaps — no set_pins despite get_pins, and no way to update base-station settings — but core monitoring and control workflows are complete.
Maintenance
Related MCP Connectors
MCP server wrapping the Tesla Fleet API and TeslaMate API
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
The official Planning Center MCP server for interacting with your ministry's data.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceMCP server for controlling Nuki Smart Locks via Home Assistant, enabling lock/unlock, intercom buzzing, and battery checks.1MIT
- AlicenseBqualityCmaintenanceMCP server for controlling HomeSeer HS4 with safe, auditable, and guarded write operations.631MIT
- AlicenseAqualityBmaintenanceMCP server for the entire Shelly smart-home ecosystem, enabling local-first control, automation, and energy monitoring of Shelly devices with cloud fallback.4733 PyPIMIT
- FlicenseNot gradedqualityCmaintenanceMCP server for controlling Somfy TaHoma devices locally via the box's API, without cloud dependency.-