How it works
An action.
An observation.
The assistant, connection point and device have separate jobs.
Requested → accepted → execution reported → physically observed
The gateway provides stdio MCP and authenticated HTTP MCP on loopback. Public access also needs operator HTTPS. A tunnel does not replace authentication. Home Assistant can use its own upstream MCP route. Local tests, Grok Bot invocation, remote security and physical effects need separate evidence.