embedded-mcp
Compiles and flashes firmware for Arduino-compatible boards such as RP2040, SAMD, and AVR using arduino-cli, with serial reading and board profile support.
Supports Espressif ESP32-family boards such as the ESP32-S3, including automatic download-mode reset during flashing, serial reading, and flash/erase operations.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@embedded-mcpcompile and flash my current sketch to the board"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
embedded-mcp
给 AI agent 用的嵌入式开发板 MCP server:编译、烧录、读串口、擦除,带护栏。
为什么分层
protocol.py JSON-RPC / 工具分派 ← 完全不知道硬件存在
tools.py 工具实现 + 所有护栏
backends/ 工具链适配(怎么编译、怎么烧)
boards.py 板型档案(纯数据)
state.py 锁 / 预算 / 模式标记变的是工具链,不是板。 RP2040、SAMD、AVR 全都走 arduino-cli,加它们
一行代码都不用写,只在 boards.py 里加一条数据。真正需要新 Backend 的是
换了构建体系的:ESP-IDF 的 idf.py、PlatformIO 的 pio、STM32 的 openocd。
护栏全在工具层,Backend 只管执行——新增工具链不需要重新实现任何一道闸。
Related MCP server: Arduino MCP Server (Simple)
三类状态的边界不同
这是 state.py 存在的唯一理由:
状态 | 边界 | 放哪 |
串口锁 | 物理硬件 |
|
下载模式标记 | 物理硬件 |
|
烧录预算 | 项目 / 会话 |
|
把它们堆在一个项目目录下看着像一类东西,插上第二块板就露馅:两个项目各锁 各的文件,等于没锁。
烧录预算不是 flash 寿命保护(ESP32 flash 有 10 万次擦写寿命,5 次这个 量级显然不是为寿命设的),它是熔断器,防 agent 陷入「改一点→烧→还不对」 的失控循环。所以边界是项目,不是硬件。
安装
python3 -m pip install pyserial # read_serial 需要
brew install arduino-cli # 或按官方文档安装
arduino-cli core install esp32:esp32 # 按你的板子装 core用法
python3 -m embedded_mcp doctor # 检查环境、串口、项目
python3 -m embedded_mcp boards # 列出已知板型
python3 -m embedded_mcp confirm /dev/cu.usbmodem101 # 人工确认已进下载模式
python3 -m embedded_mcp serve --project ~/code/my-sketch接进 Claude Code,在项目里放 .mcp.json:
{
"mcpServers": {
"embedded": {
"type": "stdio",
"command": "python3",
"args": ["-m", "embedded_mcp", "serve", "--project", "."],
"env": {"PYTHONPATH": "/Users/you/code/embedded-mcp"}
}
}
}工具
工具 | 级别 | 护栏 |
| 只读 | 无 |
| 只读 | 无 |
| 只读 | 串口互斥 |
| 写硬件 | 预算上限 + 串口互斥 + 条件性人工确认 |
| 危险 | 强制 human-in-the-loop(MRTR 两程确认) |
flash 的人工确认由板型决定:auto_download_mode=True 的板(实测
ESP32-S3 的 esptool 能自己触发下载模式复位)直接烧;False 的板
(RP2040 要按 BOOTSEL)才要求先跑 confirm。
加一块新板
多数情况只改数据:
BoardProfile(
id="my_board",
display_name="My Board",
fqbn="vendor:arch:board",
usb_vids=(0x1234,),
auto_download_mode=True,
reenumerates_after_flash=False,
crash_markers=("PANIC",),
)字段大多是踩出来的:reenumerates_after_flash 来自「ESP32-S3 烧完从
Espressif VID 变成 Adafruit VID」;boot_log_window_s 来自「setup() 的输出
会在主机连上串口之前就打完」。
加一种工具链
继承 Backend,实现 detect / compile / flash,用 @register 注册。
不用碰协议层,也不用重新实现护栏。
已知限制
erase_flash走 MRTR(2026-07-28),legacy 客户端不认识resultType: "input_required",在它们那里只能走降级路径(告知用户手工执行)。本 server 只能保证经由它的调用守规矩。Host 给模型的 Bash 工具它管不了—— 要拦住那条路得靠 hooks,两者互补而非替代。
测试
python3 tests/smoke.py # 19 项,不碰硬件Available Tools
5 toolscompileA
编译项目并返回固件占用。只读,不碰硬件,可自由调用、无次数限制。
| Name | Required | Description | Default |
|---|---|---|---|
| board | No | 板型 id。省略则由 sketch.yaml 的 FQBN 推断或用默认。 | |
| project_dir | No | 项目目录。省略则用 server 启动时的默认项目。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses meaningful behavioral traits: no hardware interaction, read-only semantics, free invocation, and no call limits. It could add more detail about build artifacts or failure behavior, but the core safety-relevant behavior is well covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence conveys the action, the return value, the safety profile, and usage freedom. There is no redundant content, and the core facts are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, optional-parameter compile operation, the description plus schema is largely sufficient. It communicates the output concept ('firmware occupancy') even without an output schema. Minor missing details like output format or compile duration prevent a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters clearly. The description adds no parameter-level meaning beyond what the schema provides, which matches the baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('compiles') and resource ('project'), plus the distinct return value ('firmware occupancy'). It also signals that the tool does not touch hardware, which clearly separates it from sibling tools like flash and erase_flash.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: it is safe, read-only, free to call, and has no rate limits, so an agent knows when it is appropriate to invoke. It does not explicitly name alternatives for hardware-affecting operations, but the safety framing makes the boundary clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
erase_flashA
🔴 危险:擦除整块 flash,不可恢复。只在怀疑 flash 内容损坏或要彻底重置时用。调用后不会立即执行——服务端会先要求用户输入确认词。
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | 串口设备路径。省略则自动检测(推荐:烧录后端口可能变)。 | |
| board | No | 板型 id。省略则由 sketch.yaml 的 FQBN 推断或用默认。 | |
| reason | Yes | 为什么需要擦除整块 flash。 | |
| project_dir | No | 项目目录。省略则用 server 启动时的默认项目。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does so thoroughly: it warns the operation is dangerous and irreversible, clarifies it erases the entire flash, and reveals that execution is deferred until the server asks the user for a confirmation word. This goes beyond a basic 'erase flash' statement.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the critical warning and usage condition before the behavior detail. Every sentence adds value: danger, when to use, and the confirmation-step behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive operation with no output schema and no annotations, the description covers the essential safety context, usage trigger, and post-call confirmation requirement. It lacks only minor details such as potential side effects beyond data loss or expected output, but nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters. The description itself adds no parameter-level meaning, though the schema's port note about auto-detection after flashing provides useful context. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb and resource: '擦除整块 flash' (erase entire flash) and explicitly notes it is unrecoverable. This clearly distinguishes it from sibling tools such as flash, which writes firmware, and read_serial, which reads output.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states explicit conditions for use: '只在怀疑 flash 内容损坏或要彻底重置时用' (only when suspecting corruption or wanting a full reset). It does not name an alternative tool or provide a when-not-to-use, but the conditions are specific enough to guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
flashA
把项目烧录到开发板。⚠️ 有副作用,受烧录预算上限保护。调用前先用 status 确认还有额度、串口空闲。
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | 串口设备路径。省略则自动检测(推荐:烧录后端口可能变)。 | |
| board | No | 板型 id。省略则由 sketch.yaml 的 FQBN 推断或用默认。 | |
| reason | Yes | 写给人看的:这次改了什么、为什么值得再烧一次。 | |
| project_dir | No | 项目目录。省略则用 server 启动时的默认项目。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden and delivers: '⚠️ 有副作用' discloses that the tool mutates state, and '受烧录预算上限保护' reveals a budget-cap safeguard. The status-check precondition implies the call can fail due to quota/port contention. It does not mention that existing firmware gets overwritten or how exhaustion errors surface, but the core behavioral traits are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences with zero waste: purpose first, then side-effect warning, then the precondition. Each sentence earns its place and the structure is front-loaded with the core action. This is exemplary conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutating tool with no annotations and no output schema, the description covers the critical invocation context: side effects, budget protection, and the status-check prerequisite. The schema covers all four parameters, so nothing needed to invoke correctly is missing. The only gap is post-call behavior/return value, which is a minor omission given the strong schema coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3: every parameter (port, board, reason, project_dir) is already documented in the schema. The description adds only marginal context by tying reason to the budget concept (justifying another flash), but no essential parameter meaning is added beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('把项目烧录到开发板' — flash the project to the development board). This clearly distinguishes it from siblings: erase_flash (erasing), compile (building), read_serial (reading serial output), and status (checking state). An agent can select this tool without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit, actionable precondition: '调用前先用 status 确认还有额度、串口空闲' — check status first to confirm quota and serial port availability. This names the sibling status and the condition that gates usage. It does not explicitly state when not to use flash or mention alternatives like compile/erase_flash, so it stops short of full exclusion guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_serialA
读取串口输出,返回原始文本与客观统计(是否为空、崩溃关键字命中、复位次数)。只读,可自由调用。⚠️ 本工具不做 PASS/FAIL 判定,请对照项目的判定标准自行判断。⚠️ 要抓启动日志(初始化失败、panic backtrace),必须在 flash 成功后【立刻】调用。
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | 串口设备路径。省略则自动检测(推荐:烧录后端口可能变)。 | |
| board | No | 板型 id。省略则由 sketch.yaml 的 FQBN 推断或用默认。 | |
| duration | No | 采集秒数,默认 10。 | |
| project_dir | No | 项目目录。省略则用 server 启动时的默认项目。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It states the tool is read-only, does not make PASS/FAIL judgments, and has a critical timing constraint for boot log capture. It also explains the exact kind of output returned, which is strong, non-redundant behavioral disclosure beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with the core function and return type, then providing essential warnings and timing instructions. Every sentence earns its place; there is no filler or repetition of schema data.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description sufficiently explains what the agent can expect (raw text and objective stats) and the tool's limitations (no PASS/FAIL verdicts). It also provides critical workflow context — call immediately after flash for boot logs — making this complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are already documented with their meanings (port auto-detection, board enum, duration range with default, project_dir default). The description does not add extra parameter-specific detail beyond the schema, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear, specific action — read serial output — and describes the return content (raw text plus objective statistics: empty, crash keyword hits, reset count). It is clearly distinguishable from sibling tools like flash, erase_flash, compile, and status, since it is the only one focused on reading serial data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit context on when to use the tool: it is read-only and freely callable, and it emphasizes that boot logs must be captured immediately after a successful flash. It does not explicitly name sibling alternatives or state when not to use it, but the timing guidance and read-only note provide clear contextual usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
statusA
查看当前项目、板型、烧录预算、串口占用与下载模式状态。只读,调用前先看这个。
| Name | Required | Description | Default |
|---|---|---|---|
| board | No | 板型 id。省略则由 sketch.yaml 的 FQBN 推断或用默认。 | |
| project_dir | No | 项目目录。省略则用 server 启动时的默认项目。 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden. '只读' explicitly communicates that the tool has no side effects, and the list of status areas clarifies its scope. It does not discuss permissions or output details, but the read-only signal is the key behavioral trait for this type of tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences that deliver the operation, scope, read-only guarantee, and usage order without any filler. The core action is front-loaded and every clause adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only status tool with zero required parameters and no output schema, the description covers the tool's role and provides an ordering cue for use. It could mention the output format, but the enumerated status areas and the 'read first' instruction make it adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already self-documented. The description adds no parameter-specific meaning beyond what the schema provides, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the verb '查看' (view) and clearly enumerates the status resources: current project, board type, flashing budget, serial port occupation, and download mode status. It is clear and specific, but it does not explicitly differentiate from sibling tools such as read_serial.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase '调用前先看这个' explicitly directs the agent to check this tool before making other calls, which is actionable usage guidance. It also flags the tool as read-only, but it does not name alternatives or state exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
5 tool updates
v0.1.0- First observed
compile - First observed
erase_flash - First observed
flash - First observed
read_serial - First observed
status
TDQS
Each tool maps to a distinct operation: compile, flash, read serial, erase flash, and status. Although flash and erase_flash both touch the flash memory, their actions and safety levels are clearly separated. No tool appears to duplicate another's purpose.
Most tools use lowercase snake_case and a verb-like pattern: erase_flash, read_serial, compile, flash. 'status' is a noun-style exception, but it is still a common and predictable command name. Minor deviation does not cause confusion.
Five tools is a tight, well-scoped set for an embedded development workflow. Each tool serves a necessary step in the compile-flash-debug cycle. No redundant or filler tools are present.
The core workflow is covered: compile, flash, read_serial, erase_flash, and status provide a complete lifecycle for flashing and debugging a board. Minor gaps remain, such as no explicit reset/reboot tool or project selection command, but agents can work around these with status and serial output. Overall the surface is well matched to its declared purpose.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Run, build, and validate firmware on virtual hardware from your AI agent. Hardware knowledge corpus.
Production-readiness for your AI coding agents.
Runtime permission, approval, and audit layer for AI agent tool execution.
Build, validate, and deploy multi-agent AI solutions from any AI environment.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables AI tools like Claude Code and Codex CLI to read and write serial port data, facilitating embedded development workflows such as coding, flashing, and debugging.25MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to interact with Arduino boards for compiling, uploading sketches, and serial communication.6MIT
- AlicenseAqualityBmaintenanceEnables AI assistants to compile, upload, and monitor Arduino boards via natural language, with electrical safety checks and dependency management.2112217MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to build, flash, and monitor ESP-IDF projects on real hardware, including serial sessions and pytest-embedded hardware tests.1MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/SunstanYu/embedded-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server