I'm concerned about privacy also, especially with Home Assistant integrations that "dial home" to vendor's clouds. Your data is not private. Check out my project that puts privacy as a main feature: https://merliot.io.
Ya, sounds like a good idea to let the LLM do all the calculations and send simple instructions to boat. MCP tells it what data is available from the device.
This seems like a residential address. Irrespective of whether the creator deliberately exposed it, I would be a little bit cautious about sharing it further.
Good question. Short answer is MQTT wasn't needed. Merle uses JSON message over websockets sent on a broadcast message bus. The Thing or its UI subscribes to these JSON messages, similar to MQTT topics.