Astromech
Homelab automation where every script is approved by me and runs in a sandbox that holds no secrets and has no network.
Astromech runs the small automations around my house. A script is a bit of Python stored in the app, started by a webhook, a cron schedule, a Home Assistant event or an incoming email.
The interesting part: the sandbox
A script never holds a credential and never touches the network. It calls operations from a narrow SDK, and declares up front which ones it needs (its capabilities). The host checks those capabilities and performs the operation with the real credentials. Reaching a service goes through a connector, which is reviewed code of its own.
That makes it safe to let an AI help: through the MCP server, an assistant can propose a script, dry-run it against a real event (writes are only recorded as "would have"), and switch things off. It can never approve, enable or delete anything. That's my job, in the web app.
What runs on it today
- bark-alert: an ESP32 sound sensor and a Bluetooth presence beacon tell me, through a push notification, when the dog barks and nobody is home.
- quicknote: voice notes from a smart ring become inbox notes in my Knowledge vault.