Merge branch 'pr-857' into addon-repo

# Conflicts:
#	homeassistant-addon-dev/config.yaml
#	homeassistant-addon-dev/translations/en.yaml
#	homeassistant-addon/DOCS.md
#	homeassistant-addon/config.yaml
#	homeassistant-addon/start.py
#	homeassistant-addon/translations/en.yaml
#	src/ha_mcp/server.py

Author: kingpanther13

.env.example

@@ -28,9 +28,15 @@ LOG_LEVEL=INFO
 # Recommended for models without deferred tool support or with limited context.
 # ENABLE_TOOL_SEARCH=false
 
-# Managed YAML config editing: allows ha_config_set_yaml to add/replace/remove
-# top-level keys in configuration.yaml and packages/*.yaml.
-# ENABLE_YAML_CONFIG_EDITING=false
+# Disable specific tools or tool groups (comma-separated).
+# Group names: HACS, System, Automations, etc. Tool names: ha_config_set_yaml, etc.
+# DISABLED_TOOLS=ha_config_set_yaml
+
+# Additional tools to pin when tool search is enabled (comma-separated).
+# PINNED_TOOLS=
+
+# Max results from ha_search_tools (2-10, default 5).
+# TOOL_SEARCH_MAX_RESULTS=5
 
 # Optional: MCP Server Configuration
 MCP_SERVER_NAME=ha-mcp

homeassistant-addon-dev/config.yaml

@@ -20,15 +20,27 @@ options:
   enable_skills: true
   enable_skills_as_tools: false
   enable_tool_search: false
+<<<<<<< HEAD
   enable_yaml_config_editing: false
   enable_code_mode: false
+=======
+  disabled_tools: "ha_config_set_yaml"
+  pinned_tools: ""
+  tool_search_max_results: 5
+>>>>>>> pr-857
 schema:
   backup_hint: list(strong|normal|weak|auto)
   secret_path: str?
   enable_skills: bool?
   enable_skills_as_tools: bool?
   enable_tool_search: bool?
+<<<<<<< HEAD
   enable_yaml_config_editing: bool?
   enable_code_mode: bool?
+=======
+  disabled_tools: str?
+  pinned_tools: str?
+  tool_search_max_results: int?
+>>>>>>> pr-857
 ports:
   9583/tcp: 9583

homeassistant-addon-dev/translations/en.yaml

@@ -26,9 +26,10 @@ configuration:
       deferred tools or with smaller context windows. Tools are found via
       ha_search_tools and executed via categorized proxies (read/write/delete).
       Requires restart to take effect.
-  enable_yaml_config_editing:
-    name: Enable YAML config editing
+  disabled_tools:
+    name: Disabled tools
     description: >-
+<<<<<<< HEAD
       Allow AI assistants to add, replace, or remove top-level keys in
       configuration.yaml and packages/*.yaml. Only whitelisted keys are
       allowed (e.g., template, sensor, command_line, mqtt). Core keys
@@ -44,3 +45,27 @@ configuration:
       Sandbox code can access the HA REST API directly (api_get/api_post)
       or call existing MCP tools (call_tool). Includes save/reuse for
       frequently-used custom tools. Requires restart to take effect.
+=======
+      Tools or tool groups to disable. Accepts individual tool names
+      (e.g., "ha_hacs_download") or group names (e.g., "HACS") to
+      disable all tools in that group. Groups: Add-ons, Areas & Floors,
+      Automations, Blueprints, Calendar, Camera, Dashboards,
+      Device Registry, Entity Registry, Files, Groups, HACS,
+      Helper Entities, History & Statistics, Integrations,
+      Labels & Categories, Scripts, Search & Discovery,
+      Service & Device Control, System, Todo Lists, Utilities, Zones.
+      Some core tools cannot be disabled. Requires restart.
+  pinned_tools:
+    name: Pinned tools
+    description: >-
+      Additional tools to keep always visible when tool search is
+      enabled. These are shown alongside the default pinned tools
+      without needing to search. Has no effect when tool search is
+      disabled. Requires restart.
+  tool_search_max_results:
+    name: Tool search max results
+    description: >-
+      Maximum number of tools returned by ha_search_tools when tool
+      search is enabled. Lower values (2-3) save context tokens but
+      may miss relevant tools. Range: 2-10. Requires restart.
+>>>>>>> pr-857

homeassistant-addon/DOCS.md

@@ -225,6 +225,7 @@ Replaces the full tool catalog (~92 tools, ~46K tokens) with search-based discov
 
 Requires add-on restart to take effect.
 
+<<<<<<< HEAD
 ### enable_code_mode
 
 **Default:** `false`
@@ -246,6 +247,36 @@ Enables the `ha_manage_custom_tool` — a sandboxed "escape hatch" that lets AI
 **When to leave disabled (default):**
 - Standard use cases covered by existing tools
 - You want to restrict the AI to pre-built tools only
+=======
+### disabled_tools
+
+**Default:** `["ha_config_set_yaml"]`
+
+A list of tools or tool groups to disable. Accepts:
+
+- **Individual tool names** (e.g., `ha_hacs_download`) — disables that specific tool
+- **Group names** (e.g., `HACS`) — disables all tools in that group
+
+**Available groups:** Add-ons, Areas & Floors, Automations, Blueprints, Calendar, Camera, Dashboards, Device Registry, Entity Registry, Files, Groups, HACS, Helper Entities, History & Statistics, Integrations, Labels & Categories, Scripts, Search & Discovery, Service & Device Control, System, Todo Lists, Utilities, Zones
+
+**Mandatory tools** that cannot be disabled (silently re-enabled): `ha_search_entities`, `ha_get_overview`, `ha_get_state`, `ha_report_issue`. When tool search is enabled, the search and proxy tools are also mandatory.
+
+Requires add-on restart to take effect.
+
+### pinned_tools
+
+**Default:** `[]` (empty)
+
+Additional tool names to keep always visible when tool search is enabled. These are shown alongside the default pinned tools without requiring a search. Has no effect when tool search is disabled.
+
+Requires add-on restart to take effect.
+
+### tool_search_max_results
+
+**Default:** `5`
+
+Maximum number of results returned by `ha_search_tools` when tool search is enabled. Lower values (2-3) save context tokens but may miss relevant tools. Range: 2-10.
+>>>>>>> pr-857
 
 Requires add-on restart to take effect.
 
@@ -254,6 +285,12 @@ Requires add-on restart to take effect.
 ```yaml
 backup_hint: normal
 secret_path: ""  # Leave empty for auto-generation
+disabled_tools:
+  - "ha_config_set_yaml"
+  - "HACS"
+pinned_tools:
+  - "ha_config_set_automation"
+tool_search_max_results: 3
 ```
 
 ---

homeassistant-addon/config.yaml

@@ -26,16 +26,28 @@ options:
   enable_skills: true
   enable_skills_as_tools: false
   enable_tool_search: false
+<<<<<<< HEAD
   enable_yaml_config_editing: false
   enable_code_mode: false
+=======
+  disabled_tools: "ha_config_set_yaml"
+  pinned_tools: ""
+  tool_search_max_results: 5
+>>>>>>> pr-857
 schema:
   backup_hint: list(strong|normal|weak|auto)
   secret_path: str?
   enable_skills: bool?
   enable_skills_as_tools: bool?
   enable_tool_search: bool?
+<<<<<<< HEAD
   enable_yaml_config_editing: bool?
   enable_code_mode: bool?
+=======
+  disabled_tools: str?
+  pinned_tools: str?
+  tool_search_max_results: int?
+>>>>>>> pr-857
 # Add-on exposes HTTP port for MCP communication (fixed internal port)
 ports:
   9583/tcp: 9583

homeassistant-addon/start.py

@@ -109,8 +109,14 @@ def main() -> int:
     enable_skills = True  # default
     enable_skills_as_tools = False  # default
     enable_tool_search = False  # default
+<<<<<<< HEAD
     enable_yaml_config_editing = False  # default
     enable_code_mode = False  # default
+=======
+    disabled_tools: list[str] = ["ha_config_set_yaml"]  # default
+    pinned_tools: list[str] = []  # default
+    tool_search_max_results = 5  # default
+>>>>>>> pr-857
 
     if config_file.exists():
         try:
@@ -124,10 +130,19 @@ def main() -> int:
             enable_skills_as_tools = raw_skills_as_tools if isinstance(raw_skills_as_tools, bool) else False
             raw_tool_search = config.get("enable_tool_search", False)
             enable_tool_search = raw_tool_search if isinstance(raw_tool_search, bool) else False
+<<<<<<< HEAD
             raw_yaml_config = config.get("enable_yaml_config_editing", False)
             enable_yaml_config_editing = raw_yaml_config if isinstance(raw_yaml_config, bool) else False
             raw_code_mode = config.get("enable_code_mode", False)
             enable_code_mode = raw_code_mode if isinstance(raw_code_mode, bool) else False
+=======
+            raw_disabled = config.get("disabled_tools", ["ha_config_set_yaml"])
+            disabled_tools = raw_disabled if isinstance(raw_disabled, list) else ["ha_config_set_yaml"]
+            raw_pinned = config.get("pinned_tools", [])
+            pinned_tools = raw_pinned if isinstance(raw_pinned, list) else []
+            raw_max_results = config.get("tool_search_max_results", 5)
+            tool_search_max_results = raw_max_results if isinstance(raw_max_results, int) else 5
+>>>>>>> pr-857
         except Exception as e:
             log_error(f"Failed to read config: {e}, using defaults")
 
@@ -142,8 +157,14 @@ def main() -> int:
     os.environ["ENABLE_SKILLS"] = str(enable_skills).lower()
     os.environ["ENABLE_SKILLS_AS_TOOLS"] = str(enable_skills_as_tools).lower()
     os.environ["ENABLE_TOOL_SEARCH"] = str(enable_tool_search).lower()
+<<<<<<< HEAD
     os.environ["ENABLE_YAML_CONFIG_EDITING"] = str(enable_yaml_config_editing).lower()
     os.environ["ENABLE_CODE_MODE"] = str(enable_code_mode).lower()
+=======
+    os.environ["DISABLED_TOOLS"] = ",".join(disabled_tools)
+    os.environ["PINNED_TOOLS"] = ",".join(pinned_tools)
+    os.environ["TOOL_SEARCH_MAX_RESULTS"] = str(tool_search_max_results)
+>>>>>>> pr-857
 
     # Validate Supervisor token
     supervisor_token = os.environ.get("SUPERVISOR_TOKEN")

homeassistant-addon/translations/en.yaml

@@ -26,21 +26,41 @@ configuration:
       deferred tools or with smaller context windows. Tools are found via
       ha_search_tools and executed via categorized proxies (read/write/delete).
       Requires restart to take effect.
+  disabled_tools:
+    name: Disabled tools
+    description: >-
+      Tools or tool groups to disable. Accepts individual tool names
+      (e.g., "ha_hacs_download") or group names (e.g., "HACS") to
+      disable all tools in that group. Groups: Add-ons, Areas & Floors,
+      Automations, Blueprints, Calendar, Camera, Dashboards,
+      Device Registry, Entity Registry, Files, Groups, HACS,
+      Helper Entities, History & Statistics, Integrations,
+      Labels & Categories, Scripts, Search & Discovery,
+      Service & Device Control, System, Todo Lists, Utilities, Zones.
+      Some core tools cannot be disabled. Requires restart.
+  pinned_tools:
+    name: Pinned tools
+    description: >-
+      Additional tools to keep always visible when tool search is
+      enabled. These are shown alongside the default pinned tools
+      without needing to search. Has no effect when tool search is
+      disabled. Requires restart.
+  tool_search_max_results:
+    name: Tool search max results
+    description: >-
+      Maximum number of tools returned by ha_search_tools when tool
+      search is enabled. Lower values (2-3) save context tokens but
+      may miss relevant tools. Range: 2-10. Requires restart.
   enable_yaml_config_editing:
     name: Enable YAML config editing
     description: >-
       Allow AI assistants to add, replace, or remove top-level keys in
       configuration.yaml and packages/*.yaml. Only whitelisted keys are
-      allowed (e.g., template, sensor, command_line, mqtt). Core keys
-      like homeassistant, http, and recorder are blocked. A backup is
-      created before every edit. Use for YAML-only features that have no
-      UI or API alternative. Requires restart to take effect.
+      allowed. Core keys are blocked. A backup is created before every
+      edit. Requires restart to take effect.
   enable_code_mode:
     name: Enable custom tool sandbox
     description: >-
       Allow AI assistants to write and run custom Python code in a secure
-      sandbox when no built-in tool can handle the request. Code runs in
-      an isolated interpreter with no filesystem or network access.
-      Sandbox code can access the HA REST API directly (api_get/api_post)
-      or call existing MCP tools (call_tool). Includes save/reuse for
-      frequently-used custom tools. Requires restart to take effect.
+      sandbox when no built-in tool can handle the request. Requires
+      restart to take effect.

src/ha_mcp/config.py

@@ -107,10 +107,16 @@ class Settings(BaseSettings):
     # Dramatically reduces idle context token usage for LLMs.
     enable_tool_search: bool = Field(False, alias="ENABLE_TOOL_SEARCH")
 
-    # Managed YAML config editing — allows ha_config_set_yaml to add,
-    # replace, or remove top-level keys in configuration.yaml and package
-    # files. Disabled by default; only for YAML-only features with no UI/API path.
-    enable_yaml_config_editing: bool = Field(False, alias="ENABLE_YAML_CONFIG_EDITING")
+    # User-configurable tool filtering — comma-separated list of tool names
+    # or group names to disable. Group names expand to all tools with that tag.
+    disabled_tools: str = Field("ha_config_set_yaml", alias="DISABLED_TOOLS")
+
+    # Additional tools to pin (always visible) when tool search is active.
+    # Comma-separated tool names, added on top of DEFAULT_PINNED_TOOLS.
+    pinned_tools: str = Field("", alias="PINNED_TOOLS")
+
+    # Max results returned by ha_search_tools (2-10).
+    tool_search_max_results: int = Field(5, alias="TOOL_SEARCH_MAX_RESULTS")
 
     # Code Mode — sandboxed Python execution via pydantic-monty.
     # Provides an "escape hatch" tool (ha_manage_custom_tool) that lets LLMs write
@@ -183,6 +189,12 @@ def validate_log_level(cls, v: str) -> str:
             raise ValueError(f"Log level must be one of {valid_levels}")
         return v.upper()
 
+    @field_validator("tool_search_max_results")
+    @classmethod
+    def validate_tool_search_max_results(cls, v: int) -> int:
+        """Clamp tool search max results to valid range."""
+        return max(2, min(10, v))
+
     @field_validator("backup_hint")
     @classmethod
     def validate_backup_hint(cls, v: str) -> str: