How to persist security gated option in standalone mode?

[SuperSandro2000]

I am wondering myself how to persist the security gated option when starting the mcp in standlone mode. I've looked a bit at the code and only found a way to persist it when using the HASS addon, but since I am on NixOS that is not really an option for me. Could it be that that code is just missing?

[Patch76]

The persistence code isn't add-on-specific – standalone mode persists too, it just resolves a different directory. Nothing is missing here.

Two layers are involved:

1. The master toggle (ENABLE_TOOL_SECURITY_POLICIES) is a regular feature flag. In standalone mode I can persist it either way:

• Set the env var ENABLE_TOOL_SECURITY_POLICIES=true. An explicitly-set env var always wins, and this is the most declarative fit for a NixOS service.
• Or flip it in the web Settings UI, which writes feature_flags.json into the data directory (the stdio/standalone settings persistence landed in feat: persistent settings UI for stdio mode #1381).

2. The policy rules themselves are saved to tool_policy.json via save_policy(data_dir) / load_policy(data_dir) in src/ha_mcp/policy/persistence.py. The middleware re-reads that file from data_dir on every gated call – there is no add-on gating on that path.

Where data_dir resolves (src/ha_mcp/utils/data_paths.py, get_data_dir()):

1. HA_MCP_CONFIG_DIR – explicit override
2. /data – add-on (SUPERVISOR_TOKEN set)
3. ~/.ha-mcp – standard standalone install
4. <tmpdir>/ha-mcp – last-resort fallback that does not survive a restart

So in standalone mode the files land in ~/.ha-mcp by default. If you only spotted the /data branch in the code, that is the add-on path (step 2) – steps 1 and 3 are the standalone ones.

The likely NixOS catch: a hardened systemd unit (DynamicUser=, ProtectHome=, or simply no writable HOME) makes Path.home() / ".ha-mcp" unwritable, so get_data_dir() silently falls through to the tmpdir (step 4) and the settings vanish on restart. There is a warning logged when that happens, worth checking your logs for.

The fix is to point ha-mcp at a persistent writable directory explicitly:

# systemd service
StateDirectory=ha-mcp
Environment=HA_MCP_CONFIG_DIR=/var/lib/ha-mcp

With HA_MCP_CONFIG_DIR set, both feature_flags.json and tool_policy.json persist there across restarts, add-on or not.

[Patch76]

@SuperSandro2000 Is it working for you now?

[SuperSandro2000]

I did not find time to test this, yet 😅

[SuperSandro2000]

That seems to have done the trick. Would be nice if such settings would be easier to discover.

[kingpanther13]

What do you mean by standalone mode? Are you running via Claude Desktop or another client that connects via stdio, or are you using a docker or container version of ha-mcp? There's a bit of difference between them.