Google shipped MCP's first consumer surface — and the news is the two things it refuses to do

What Google shipped

Home MCP is exactly what its name says and no more: a Model Context Protocol server that sits in front of the Google Home ecosystem and exposes it to any agent able to call MCP tools.

The surface area is five tools. list_homes returns the homes and structures an account can reach. list_home_resources enumerates devices, areas, traits, attributes and command schemas — the map. list_home_states reads live connectivity and trait states — the present. list_home_history queries past state changes and events over a time range — the past. run_home_actions executes parameterised commands — the verb. Everything the marketing describes is a composition of those five: summarise what the cameras saw today, turn the upstairs lights down, build a dashboard out of your own device history, ask why the thermostat is fighting you.

Device coverage is the full ecosystem — Nest doorbells and thermostats, Works with Google Home devices, Matter bulbs. Familiar-faces data is available only where compatible Nest cameras or doorbells have familiar face detection enabled on each individual device, which is a per-device opt-in rather than an account setting.

Google’s documentation gives setup paths for three clients: Google Antigravity, Claude Cowork through Claude Connectors, and OpenClaw over SSE transport with OAuth. TechCrunch’s report additionally names Hermes and ChatGPT, with ChatGPT gated to US subscribers initially. Since this is a standard MCP server authenticating against a Cloud project you own, the documented list is a convenience rather than a boundary.

Early access is rolling out in English, in the US, to Google Home Premium Advanced subscribers at $20 a month.

The onboarding is the real gate, not the subscription

Read the setup sequence as a product decision rather than a chore. Create a Google Cloud project. Enable the Home API. Configure an OAuth consent screen for an External audience. Create an OAuth client ID of the Web application type. Add the redirect URI matching your chosen agent. Publish the application through Google Auth Platform. Then configure credentials in the client.

That is a developer flow bolted to a consumer subscription, and it will stop the overwhelming majority of Home Premium Advanced households well before the $20 does. Which is almost certainly the intent: an early-access release that self-selects for people who can reason about OAuth scopes is a safer population to hand a physical-world API to than everyone who owns a Nest thermostat.

The corollary is that the eventual consumer version of this — a toggle in the Google Home app, no Cloud project — is a materially different product with a materially different risk profile, and none of today’s launch tells you when or whether that arrives.

The two refusals

The most quotable line in the documentation is a negative. Home MCP “enforces rate limits and safety protections, such as prohibiting sensitive actions like unlocking doors.” Alongside it, agents cannot create automations.

Both of those deserve more attention than the tool list, because of where they live. This is not an approval prompt, not a default a user can flip, not a setting buried in a preferences pane. It is a server-side floor. An agent connected to Home MCP cannot unlock your door because the API will not do it, regardless of what the agent decides, what the model was persuaded of, or what a prompt-injected calendar entry told it to try.

That is a meaningfully different safety posture from the one the rest of the agent market has settled into. The dominant pattern — visible in Anthropic’s move this week to make agentic behaviour the default surface of ordinary Claude — is ask before acting: the capability exists, and a human approves each use. That design is fine for a file write and increasingly shaky for anything irreversible, because approval fatigue is real and prompt injection targets exactly the judgement the prompt is asking you to exercise. The sandbox-escape research from earlier this month made the same point in a coding context: boundaries that depend on the agent behaving are not boundaries.

Blocking the door at the API is the other approach. It is less flexible and it is not defeatable by a clever prompt.

The automations exclusion is the subtler of the two and arguably the more important. A one-off action is bounded — the agent turns a light on, you see a light on. An automation is persistence: a rule that keeps running after the conversation ends, invisible to the person who did not write it. An agent that can create automations can leave behind behaviour nobody remembers authorising. Withholding it means everything Home MCP does today is traceable to a conversation you had. That is the constraint most likely to be relaxed first, and it is the one worth watching.

This is the MCP playbook, aimed at a house

Strategically this is the same move the industry has been running all year, and it is getting monotonous in a way that is itself the signal.

Google owns the data and the hardware relationships. Rather than requiring its own assistant as the only way in, it publishes an interface and lets Claude, OpenClaw, Antigravity and anything else MCP-capable connect. The subscription still accrues to Google; the assistant layer becomes contestable. Anthropic ran the identical structure at the industrial end in August with the Model Hardware Standard for lab and manufacturing equipment — model-agnostic, riding on MCP, no robot of its own. Google has now done the consumer version, and the two announcements bracket the same idea: MCP is becoming the way software talks to things that move.

There is a small piece of comedy in the timing. Google’s client documentation names Claude Cowork — a product Anthropic dissolved into ordinary Claude on the very same day. Nobody did anything wrong; product names now expire faster than the documentation that references them, which is a running theme and a reason to write internal runbooks against capabilities rather than surfaces.

What to do

If you already run an MCP agent and pay for Home Premium Advanced. Connect it and pick the client deliberately, because the client is where the real decision sits. Home MCP hands whichever agent you choose the ability to read your event history and, with familiar faces enabled, who was at your door. Google’s retention terms stop at the API boundary; after that it is your client vendor’s terms. OpenClaw and Hermes Agent are self-hostable, which is the strongest answer for camera data; Claude and Antigravity are commercial clients with published terms worth actually reading first. Our AI agent rankings and harness comparison cover the trade-offs between those two shapes.

If you were waiting for Gemini to do this natively. You are still waiting, and that is the interesting part. Google built the open door before the proprietary one, which fits the pattern from Antigravity shipping with a rival’s model inside it — Google is increasingly willing to let the model layer be contested while it keeps the harness and the data. The Gemini review covers what the assistant does today; none of it changed on 16 September.

If you design agent permissions for a living. Take the template, not the smart home. Three properties are worth copying: the irreversible physical action is refused at the server rather than gated by a prompt; persistent behaviour is withheld entirely while one-off actions are allowed; and revocation lives in the consumer app the user already opens, not in a developer console. Most agent integrations shipping today get at most one of those three right.

If you are a non-US reader. Nothing to do. English, US, early access. The version that reaches you will likely have automations and a simpler onboarding, and it is worth watching whether it keeps the door locked.

The headline everyone wrote was that AI agents can now run your house. The more accurate one is that Google published a careful, deliberately small list of what an agent may do inside a home, put a hard floor under it that no prompt can talk its way through, and charged $20 a month for the privilege. The list will grow. Whether the floor survives the growth is the only question that matters here.

Questions or corrections? Email Pick Right. Want the full list? See all news.