Google Home MCP Hands Agents the Cameras and History

Google opened Home MCP to early access on 16 September, letting any Model Context Protocol agent read and control a Google Home. The named clients are Google Antigravity, Claude, Hermes and OpenClaw, and a connected agent reaches Nest doorbells, thermostats, Matter bulbs and the event history behind them.

The agent, not Gemini for Home, now sits on that camera log. Google kept a few hard blocks. The person who clicks through OAuth is the only one who has to see them.

Five Tools Reach Every Device on the Graph

Home MCP is a remote server at home.googleapis.com/mcp. It speaks Anthropic’s open standard for wiring models to tools, so a client that already knows MCP does not need a Google-only plugin. Taylor Lehman, group product manager for Google Home and Nest, wrote that the hookup gives a favourite agent real-world physical context.

The protocol already reaches live ad accounts through franchise chatbots that launch Meta ad spend. Home MCP points the same kind of socket at doorbells. Google’s own reference lists five executable tools on the Home graph, and that is the whole control plane.

THE FIVE HOME MCP TOOLS

Observation and action are split on paper. The agent still decides when to cross from one to the other, and a wasted chat turn is no longer the worst outcome of a bad call. A wrong run_home_actions request can kill the lights during a call or nudge a thermostat while nobody is home.

A Cloud Project Sits Between You and Claude

The audience is a household. The install is a developer console. Early access is rolling out in English to Google Home Premium Advanced subscribers in the United States, the Advanced plan at $20 a month or $200 a year. The cheaper Standard plan, $10 a month, does not get this socket.

Advanced is also the camera plan. It keeps 60 days of event video, 10 days of 24/7 video, searchable history and daily summaries. Those are the clips an agent is being invited to summarise.

THE CLOUD PROJECT CHECKLIST

• A Cloud project: Open Google Cloud and create a project if you do not already have one.
• Home API: Enable the Home API on that project before any agent can talk to the house.
• OAuth client: Set a web-application client ID and secret, then add the redirect URI your agent expects.
• Publish the app: Move the consent screen from testing to published so the agent can finish sign-in.
• Paste the prompt: Google’s own helper prompt still names the preprod sandbox at preprod-home.sandbox.googleapis.com/mcp, while live traffic is meant to hit home.googleapis.com/mcp.

Redirect examples in the docs are antigravity.google/oauth-callback for Antigravity, claude.ai/api/mcp/auth_callback for Claude Cowork, and whatever local URI an OpenClaw install prints. OpenClaw is patched with a JSON block, then the gateway restarts. The OAuth scope is https://www.googleapis.com/auth/home.platform.v2. Google suggests asking the agent to do the wiring. That is how early this still is.

What the Agent Can Read From Nest Cameras

Google listed four things early testers actually built. An agent can summarise footage across cameras, so a parent can ask what the children did after school and get clips back. It can read device history, including how many laundry loads ran in a week or how long lights stayed on. It can speak through a Google Home speaker when a long task finishes. It can also build a custom dashboard and put that in front of the Google Home app’s own layout.

Speakers themselves still run Gemini for Home. The outside agent is allowed to push an audio message through them, not to replace the voice stack. Sample prompts in the docs are ordinary on purpose: how many lights are in the house, whether the home is secured, turn off the outside lights, what happened while I was out.

Anish Kattukaran, chief product officer for Gemini for Home, pitched the release at people who have spent the year building agents, and said those personal agents can now plug into devices and event history.

If you’re anything like me and have spent the entire year building and playing with agents, this is going to be a fun release for you!

Google is rolling out early access to our new @GoogleHome MCP.

Your personal agents (like @antigravity or OpenClaw) can now plug directly into…

— Anish Kattukaran (@AnishKattukaran) September 16, 2026

That is the product pitch. The second effect is quieter. Once an agent can draw its own dashboard, Google is no longer the only interface on the graph it still hosts.

What Home MCP Still Refuses to Do

Home MCP enforces rate limits and a ban on unlocking doors, which is Google’s own example of a sensitive action. Access can be pulled at any time from the Google Home app or from the My Accounts page. Creating and managing automations through Home MCP is not supported yet, and Google says that work is planned for a later release.

Two known issues are already on the setup page. Some device traits are marked experimental and may not behave. Latency can run longer than testers expect, with improvements promised in later builds. The docs were last updated on 15 September, the day before early access opened.

Those limits are real, and they are narrow. They stop a class of lock commands. They do not stop an agent from reading camera history, counting laundry, rewriting the dashboard, or issuing every other command the graph will accept. MCP standardises how the agent asks. It does not decide whether the agent should ask.

The Rest of the House Never Signs In

The OAuth screen belongs to one Google account. Shared homes do not get a matching screen. Google tells the person doing the setup to warn everyone else that the agent can control devices and read home data, and it offers a cleaner path: create a separate home and put test devices there.

Connecting a real-life home to an AI agent allows that agent to control devices on your behalf. Home MCP enforces rate limits and safety protections, such as prohibiting sensitive actions like unlocking doors. However, depending on your agent, connecting it to Home MCP can result in unexpected or even undesired behavior. If you choose to connect a Google Home used by other household members with Home MCP, you should inform them that your agent can control devices and access home data.

Google Home MCP Server setup guide

Facial recognition is a second, separate yes. The person granting it must be a manager of the home structure. The home needs a compatible Nest camera or doorbell with familiar face detection turned on for each unit, plus an active Google Home Premium plan. Consent is a link that already contains the OAuth client ID and the structure ID, and Google even tells you to ask the connected agent to mint that link. Children in the flagship demo never click it. Neither does a partner who only uses the hallway display.

Prompt Injection Already Has a Physical Address

Handing an agent the house does not invent a new bug class. It moves an old one into rooms with switches. Prompt injection hides instructions in ordinary content, then the agent follows them with the user’s own rights. Google says as much in the warning: behaviour depends on the agent you connect.

THE MONTHS AROUND THIS SOCKET

1. August 2025: Researchers showed Gemini following hidden commands in a calendar invite, then turning lights, blinds and a boiler in a test home. Google added filters and extra confirmations after that write-up.
2. June 2026: SafeBreach Labs published prompt injection through messaging notifications, using a trick it called Fake Context Alignment. The chain reached smart-home tools, including connected windows, a boiler and lights. Google shipped classifier updates after the disclosure.
3. August 2026: Zenity Labs told Black Hat USA that a typosquat skills campaign on Vercel’s skills.sh had reached 1.7 million aggregate installs, not unique users. The skills later told agents to steal SSH keys, cloud tokens and.env files. Zenity stressed that MCP servers sit on the same supply chain as those skills.
4. 14 September 2026: Francisco Pérez Bes, deputy director of Spain’s data protection agency, the AEPD, wrote that the agency had received its first notice of a personal-data breach carried out with an AI agent. The notice, which the AEPD said still needed analysis, described an agent that logged in, found a flaw, changed personal data and opened invoices. Home MCP opened two days later.

None of those incidents is a Home MCP breach. They are why the consent screen is a thin gate. The agent that passes OAuth is the same class of software that has already been tricked into following hidden text, installing a tainted skill, or chaining a login to a data change. Google’s remaining job is the lock on the door. The rest of the judgement now lives in Claude, OpenClaw, Hermes or Antigravity.

Europe Gets None of It Yet

Apple Home and Amazon Alexa have not announced a matching socket for outside agents. People who already run Home Assistant have been wiring models into lights for years, and they are the same people who can finish a Cloud project without a tutorial. Google is first among the large platforms, and it has done it as a US English preview on the $20 plan.

Europe is not in the early-access list. Google has not said when it will be. The flagship demo is still an agent walking through camera footage of children, and that is a sharper question under European data rules than it is in a California sandbox. Until that date exists, the house this socket can actually enter is an American one, on Advanced, with a Cloud project, and with one adult who remembered to tell the others.

Automations remain off the MCP path. Revocation remains a tap in the Google Home app. Anyone who does hook an agent in can pull it later. The clips, the history and the dashboard the agent already built do not rewind themselves when that tap happens.