Recommended Free Tools
The safest pattern is to expose only the Home Assistant configuration directory through a read-only filesystem boundary. Confirm the real path for your installation, map only that directory, keep the mapping read-only, and do not provide a Home Assistant API token unless the assistant must make API calls. Read-only access prevents edits through that mount, but it does not hide passwords or tokens contained in files, so remove or exclude secrets before sharing configuration.
What “read-only access” should mean
For this task, read-only access means the coding assistant can open and search the files needed to understand your Home Assistant setup, but cannot create, delete, rename or modify files in the exposed location. The restriction must be enforced by the filesystem, container runtime or Home Assistant app configuration—not merely by telling the assistant in a prompt to avoid writes.
As an Amazon Associate I earn from qualifying purchases.
A narrow filesystem view is usually better than granting access to the whole Home Assistant host. The assistant may need configuration.yaml, packages, automations, scripts, dashboards or custom-component code, but it generally does not need backups, media, host operating-system files or every app’s private data.
- Filesystem access lets the assistant inspect files. A read-only mount blocks writes through that mount.
- Home Assistant API access is a separate capability authenticated with a bearer token and controlled by API permissions.
- Read-only is not confidential. Anyone who can read a file can disclose its contents, including plaintext secrets.
Home Assistant Developers’ app-security guidance states: “Map folders read only if you don’t need write access.” Treat that as a permission boundary, not as a guarantee that the exposed data is harmless.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Find the correct configuration directory first
Do not assume that a path shown in an online example matches your installation. Home Assistant identifies the active configuration location in Settings > System > Repairs > System information. Check that screen before configuring the assistant.
| Installation | Where the configuration normally appears | What to verify |
|---|---|---|
| Home Assistant OS | /config inside Home Assistant |
Confirm that the system information page reports the expected configuration location and that the files you want are actually there. |
| Home Assistant Container | The host folder mounted into the container as the Home Assistant config folder | Identify the host-side source directory. The assistant needs a read-only view of that host folder, not an unrestricted view of the host. |
On a Container installation, /config is a path inside the Home Assistant container. Your coding assistant may run on the host or in another container and therefore require the host-side directory instead. Mapping the wrong path can expose nothing, expose a stale copy or tempt you to grant a much broader host mount to make the problem appear solved.
Choose an exposure pattern
There are three practical patterns. Select the smallest one that supports the work you actually want the assistant to do.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Pattern | Best for | Advantages | Trade-offs |
|---|---|---|---|
| Home Assistant app or add-on mapping | An assistant or tool running as a Home Assistant app/add-on | Uses Home Assistant’s directory-mapping controls and keeps the scope visible in the app configuration. | You must select only the needed folders and retain the read-only default. A broad mapping can expose much more than the assistant requires. |
| External read-only mount | An assistant running on another host or container | Current files are visible without making a second copy; the host or container boundary can enforce read-only mode. | Exact mount syntax and enforcement depend on the assistant runtime. The mapped source must be narrowly scoped. |
| Sanitized copy | Code review, troubleshooting or one-time analysis | You can remove secrets, private keys and unrelated files before exposure. | The copy can become stale and must be regenerated when configuration changes. |
Do not combine all three automatically. Filesystem access and API access solve different problems, and giving both increases the number of places where credentials and control paths must be protected.
Method 1: map a folder for a Home Assistant app or add-on
Use this method when the coding assistant runs inside Home Assistant’s app/add-on environment and that app supports directory mappings.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
- List the files the task needs. For a YAML review, this might be the configuration directory and selected subdirectories. For a custom integration review, it may be the custom-component directory plus the relevant YAML. Do not start by mapping every Home Assistant directory.
- Open the app’s configuration. Find its directory or folder-mapping section, commonly represented by a
maplist. The available mapping targets are selected Home Assistant directories; use the narrowest target that contains the required files. - Leave the mapping read-only. Home Assistant documentation says mappings default to read-only. Do not add or change a setting that makes the mapping writable. In configurations that expose a
read_onlyoption, settingread_only: falseexplicitly changes the mapping to writable and should not be used for this purpose. - Do not map unrelated areas. Avoid broad access to all app configurations, backups, media or host-level locations unless the specific task genuinely requires one of them. A request to “let the assistant see Home Assistant” is not a reason to expose the entire host.
- Restart or reload the app only as required by its interface. A mapping change may not apply to an already-running process. Use the app’s normal restart control and check its log for a mount or permission error.
- Test from inside the app. Confirm that the assistant can list and read an intended file, then attempt a harmless write test in a disposable location or use the runtime’s permission inspection. The expected result is a permission-denied error for writes, not a successful file change.
The mapping protects only the paths covered by it. If the app also has a shell, network or additional host mapping, review those separately. A read-only config folder does not stop a process from accessing another writable mount.
Method 2: expose a narrow read-only mount to an external assistant
Use this pattern when the assistant runs on another computer, virtual machine or container. Home Assistant’s app documentation establishes the read-only mapping principle, but the exact mount syntax and security behavior belong to your assistant and host runtime.
- Identify the host-side source directory. For Home Assistant Container, use the host folder that is mounted into Home Assistant as its configuration directory. Do not use a broad parent such as the entire data disk simply because it is easier to locate.
- Create a dedicated target path for the assistant. Give the assistant a path such as a configuration-only directory inside its own environment. Keep the source and target names clear so a later administrator can audit the boundary.
- Declare the source as read-only at the runtime boundary. Use the read-only or readonly option provided by your container, VM or sandbox runtime. A prompt instruction is not a substitute for this setting.
- Keep other host resources out of the environment. Do not add the host root, Docker socket, backup volume, SSH directory or a general-purpose project mount as a shortcut. Review whether the assistant has shell commands, network access or credential stores that could reach data outside the mapped directory.
- Start the assistant and inspect its visible filesystem. It should see only the intended configuration view and any files deliberately included by the assistant environment. Check that a path outside the mapping is unavailable or denied.
- Verify write enforcement. Ask the runtime or assistant process to create a temporary file in the mapped directory. The operation should fail with a permission error. Remove any test file if the test was performed on a writable staging area rather than the real configuration.
- Record the mapping in your deployment notes. Note the host source, assistant target, read-only flag and date. This makes it easier to detect a later change that silently broadens access.
Do not assume that a container labeled “AI,” “coding assistant” or “MCP” has a safe default. Inspect the actual mounts and process permissions exposed by that implementation.
Method 3: provide a sanitized configuration copy
A copy is often the safest choice when the assistant needs context but does not need live files. It lets you remove sensitive material before the assistant can read anything.
- Create a separate staging directory outside the live configuration path.
- Copy only the files required for the question. Include related package, automation, script, dashboard or custom-component files only when they are necessary to understand the behavior under review.
- Remove credentials and identifying data. Check YAML secrets, certificates, private keys, tokens, webhook URLs, local usernames, addresses and any file containing personal information. Replace values with obvious non-secret markers inside the copy, while preserving the data type and surrounding structure needed for analysis.
- Review hidden and generated files. Directory listings can contain backups, editor swap files or exports that were not part of your intended review.
- Expose the staging directory read-only. A sanitized copy still benefits from a filesystem read-only boundary so the assistant cannot alter the material you are reviewing.
- Delete or rotate the copy after the task. Treat the staging directory as another sensitive data store. If it becomes stale, regenerate it rather than synchronizing the live directory wholesale.
A sanitized copy is not automatically complete. If you remove a value that determines behavior, explain its type and constraints without revealing the real value; otherwise the assistant may produce an invalid recommendation.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Keep Home Assistant API access separate
An assistant that can read configuration files does not need API access merely to inspect YAML. Home Assistant’s REST API uses an Authorization: Bearer TOKEN header. That token authenticates API requests; it does not prove that the assistant has read-only filesystem permissions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Grant an API token only when the task requires live entity state, service calls or other API operations.
- Store the token in the assistant’s protected credential mechanism rather than in a general prompt, repository, YAML file or chat transcript.
- Review the API permissions and endpoints available to the integration. A filesystem mount cannot restrict an API token that has broader privileges.
- Revoke or rotate the token when the task or assistant environment is no longer trusted.
If the job is “explain why this automation does not trigger,” a sanitized file set may be sufficient. If the job is “inspect the current state of a sensor,” API access may be necessary, but it should be approved and configured as a separate capability.
Protect secrets before granting read access
Home Assistant documents YAML secrets as plain text. Read-only access prevents an edit; it does not prevent the assistant, its logs, extensions or operators with access to the assistant environment from reading and copying those values.
Before exposing a directory, search for and exclude:
secrets.yamland files imported by it;- long-lived access tokens and API keys;
- TLS certificates, private keys and credential bundles;
- webhook URLs, cloud account details and device passwords;
- network shares, private hostnames and personally identifying location data;
- backups or exports that may contain older copies of credentials.
When the assistant needs the structure of a secret, replace the value in a sanitized copy while retaining whether it is a string, number, list or mapping. Do not paste a live token into a prompt to compensate for a missing file.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Verify the boundary instead of trusting the label
Perform these checks after every mapping or assistant update:
- Path check: the assistant can read an intended configuration file and cannot see an unrelated host directory.
- Write check: creating, editing, deleting and renaming a file under the mapped path all fail, or the runtime reports the mount as read-only.
- Scope check: backups, media, app data and host operating-system paths are not visible unless explicitly required.
- Credential check: no API token, private key or plaintext secret is present in the exposed view.
- Tool check: inspect enabled shell, filesystem, network and API tools. A read-only mount does not neutralize a separate writable path or a privileged host tool.
- Persistence check: restart the assistant and confirm the same restrictions remain in force; a temporary development launch may omit production safeguards.
- Logging check: review whether prompts, tool calls or error logs capture file contents or credentials.
Run the checks using a test account or disposable staging copy when possible. Do not “test” by editing a live automation and hoping the write fails.
Be especially careful with MCP and AI integrations
The name of an integration is not a security guarantee. One community Home Assistant MCP project documents both read and write filesystem tools. That example is implementation-specific and does not describe every MCP server, but it demonstrates why you must inspect the precise tools and paths enabled in your deployment.
Before connecting an MCP or similar integration, answer these questions:
- Which filesystem tools are enabled—read, write, delete, shell or directory discovery?
- Which root paths are enforced, and are symlinks prevented from escaping them?
- Does the server run with the same user and permissions as Home Assistant, or with broader host privileges?
- Can it make network requests or call Home Assistant services in addition to reading files?
- Are tool arguments and returned file contents recorded in logs?
Disable unused tools, enforce the narrowest root and verify the effective permissions from the running process. If those controls cannot be demonstrated, use a sanitized copy instead.
Common failure modes and fixes
The assistant cannot find configuration.yaml
Check the installation type and the path shown under Settings > System > Repairs > System information. A Container installation may expose the file at a host path different from the in-container /config. Correct the source mapping rather than mounting the entire host.
The assistant can read but also modify files
The mapping is writable, a second writable mount is visible, or a privileged tool is bypassing the intended boundary. Remove any explicit writable setting, recreate the runtime with its read-only option, and inspect all mounts and tools—not just the path used for the first successful read.
Secrets appear even though the mount is read-only
Read-only controls modification, not disclosure. Remove secrets.yaml and related credential files, or switch to a sanitized copy. Rotate a credential if it was exposed in an assistant prompt, log or transcript.
A mapping change has no effect
The app or assistant process may need a restart, or the configuration may have been edited in a different environment than the one that is running. Apply the change through the supported interface, restart as required, then repeat the path and write checks.
The assistant asks for an API token to review YAML
File review and API calls are separate. Decline the token request unless live Home Assistant state or service access is part of the task. Provide only the minimum API permissions when an API call is genuinely required.
A third-party integration offers “full access” as its only option
Do not compensate by exposing the host. Look for a narrower tool configuration or use a sanitized, read-only copy with no API credential. If the integration cannot state which paths and tools it controls, it is not suitable for sensitive configuration.
A repeatable least-privilege checklist
- Write down the exact question the assistant must answer.
- Identify the smallest set of configuration files needed.
- Confirm the real configuration path for your Home Assistant installation.
- Choose an app mapping, external read-only mount or sanitized copy.
- Exclude secrets, certificates, tokens, backups and unrelated personal data.
- Keep the filesystem mapping read-only; never set
read_only: falsefor this use case. - Do not add an API token unless the task requires API operations.
- Inspect shell, network, filesystem and MCP tools for additional access paths.
- Test intended reads, denied writes and denied out-of-scope paths.
- Recheck the boundary after updates, restarts or changes to the assistant integration.
This process gives the assistant useful configuration context while keeping the permission decision explicit and reversible. If a live mount is unnecessary, a sanitized copy remains the safer default because it limits disclosure as well as preventing edits.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
