usb-rea
Generates Wireshark Lua dissectors from an inferred USB protocol, so captured traffic is displayed as named commands with decoded values, counters, lookup labels, and checksum checks (filterable via tshark/Wireshark), and parses Wireshark/USBPcap pcapng captures as input for protocol inference.
usb-rea — Reverse Engineer any USB gadget

Got a USB device that only ships a Windows vendor app (case LCD, RGB controller, mouse, "smart" lamp)? Click around in the vendor app while usb-rea captures the USB traffic (usbmon on Linux, USBPcap on Windows), diffs the packets per action, infers the protocol, and writes an open-source Python/libusb driver — with every conclusion linked to the exact packets that prove it.
Status: alpha (v0.2.0). Validated on synthetic devices, on protocols documented by liquidctl and rivalcfg, and on public Wireshark captures — see docs/VALIDATION.md. Not yet tested on a physical gadget: your captures are welcome.
Try it in 10 seconds (no hardware needed)
pip install git+https://github.com/emirmrkaljevic/usb-rea
usb-rea demo --device fanfan 100% 0x5a | counter (+1 per message) | 0x10 | u16be round(value * 1 + 0) | 0x00 | u16le crc16_modbus(bytes[0:6])
color 100% 0x5a | counter (+1 per message) | 0x20 | round(value * 1 + 0) | round(value[1] * 1 + 0) | round(value[2] * 1 + 0) | u16le crc16_modbus(bytes[0:6])
mode 100% 0x5a | counter (+1 per message) | 0x30 | lookup 1→0x11, 2→0x22, 3→0x47 | 0x00 | 0x00 | u16le crc16_modbus(bytes[0:6])It writes a synthetic capture of a fan controller, recovers the protocol, and writes report.md (every claim linked to Wireshark frame numbers) and a working pyusb driver that encodes values it never saw.
--device lamp (default) is a simple 8-bit device; --device dial shows 32-bit values and packed bitfields:
position 100% 0xa5 | 0x01 | u32le round(value * 1 + 0) | sum8(bytes[0:6])
level 100% 0xa5 | 0x02 | bits[0:4] = round(value * 1 + 0) | 0x00 | sum8(bytes[0:4])Related MCP server: cynthion-mcp
What it can infer
Role | Example |
constant header / command id |
|
linear values, 8-, 16- or 32-bit LE/BE, several per action |
|
packed bitfields (bits beside constant flag bits, incl. 12-bit spans over two bytes) |
|
lookup tables (non-linear choices) | DPI 250→ |
rolling counters | sequence byte +1 per message |
checksums | sum8, xor8, neg/inv sum8, sum16, CRC8, CRC8/MAXIM, CRC16 CCITT-FALSE/XMODEM/MODBUS/KERMIT |
Linear fits must survive leave-one-out cross-checks; otherwise usb-rea falls back to an honest lookup table and says so.
Real device workflow (Linux)
sudo modprobe usbmon
usb-rea capture start -o lamp.pcapng
usb-rea mark -m lamp.pcapng.actions.json "brightness 0%" # then click it in the vendor app
usb-rea mark -m lamp.pcapng.actions.json "brightness 50%" # ...repeat for 3+ values per setting
usb-rea capture stop
usb-rea report lamp.pcapng -o report.md
usb-rea scaffold lamp.pcapng -o lamp_driver.py
usb-rea dissector lamp.pcapng -o lamp.lua # Wireshark dissector for the same protocolCaptured on Windows with USBPcap/Wireshark and no markers? Click each action with a short pause in between, then just list them in order — usb-rea splits the traffic at the pauses:
usb-rea report lamp.pcapng --labels "brightness 0%; brightness 50%; brightness 100%; power off; power on"
usb-rea scaffold lamp.pcapng --labels labels.txt -o lamp_driver.py # one label per line(Markers, if you have them, are a JSON list of {"label", "start", "end"} epoch timestamps.)
MCP server
pip install "usb-rea[mcp] @ git+https://github.com/emirmrkaljevic/usb-rea" then add usb-rea mcp as a stdio server. Tools: capture_start, capture_stop, mark_action, diff_actions, report, scaffold_driver, hid_descriptor (decode a HID report descriptor / report payloads), wireshark_dissector, replay_packet (refuses unless the human confirmed).
With uv no install step is needed:
{"mcpServers": {"usb-rea": {"command": "uvx", "args": ["--from", "usb-rea[mcp] @ git+https://github.com/emirmrkaljevic/usb-rea", "usb-rea", "mcp"]}}}Once usb-rea is on PyPI, --from "usb-rea[mcp]" is enough. The server is also listed on Glama, which builds it from the repo's Dockerfile and checks that it starts and lists its tools.
How it works
usb-rea capture start— record traffic (usbmon / USBPcap)usb-rea mark "brightness 50%"— label each action you take in the vendor appusb-rea diff— which bytes change per action, value correlation, checksums, countersusb-rea infer— message templates + evidence reportusb-rea scaffold— generate a pyusb driver and replay testsusb-rea dissector— write a Wireshark Lua dissector for the inferred protocolusb-rea replay— send packets to the device (only with explicit confirmation)usb-rea hid— decode a HID report descriptor from a capture (GET_DESCRIPTOR 0x22) or from hex, and decode report payloadsusb-rea mcp— the same tools as an MCP server for AI agents
Wireshark dissector
usb-rea dissector capture.pcapng -o lamp.lua turns the inferred protocol into a Wireshark Lua plugin, so you can keep
capturing and read the traffic as commands instead of hex:
wireshark -X lua_script:lamp.lua capture.pcapng
tshark -X lua_script:lamp.lua -r capture.pcapng -Y 'usbrea.command == "brightness"'Each matching packet gets a usbrea tree with the command name, decoded values (usbrea.brightness.value), counters,
lookup labels, and a checksum check (usbrea.checksum_ok, with an expert warning on mismatch); the Info column reads
brightness 50. It works for bulk, interrupt and control/HID SET_REPORT transfers, from usbmon or USBPcap, and needs no
bit library (Wireshark 3.x and 4.x). -n NAME changes the filter prefix. CI runs every generated dissector through tshark.
HID devices
Most RGB keyboards, mice, headsets and LCD gadgets are HID with a vendor-defined page. If the capture includes the report descriptor (start capturing, then replug the device), the report gets a section with every report's ID, size and fields, and each inferred command is tagged with the HID report it travels in. Without a capture:
usb-rea hid /sys/class/hidraw/hidraw0/device/report_descriptor --items
usb-rea hid capture.pcapng --decode "10ff0d1d000000" --type OutputRoadmap
pcap/pcapng parser (usbmon + USBPcap)
action markers and per-action diffing
checksum detection (sum8, xor8, neg/inv sum8, CRC8, CRC16 variants)
evidence-backed protocol report
driver scaffolding (pyusb, bulk/interrupt + control/HID SET_REPORT)
confirmed replay
MCP server
rolling counters, multi-byte (16/32-bit LE/BE) values, lookup tables, multi-value actions
packed bitfields
validation against documented protocols (liquidctl, rivalcfg)
HID report descriptor decoding (
usb-rea hid), with captured commands mapped to their HID reportsemulated-device CI (dummy_hcd + configfs HID; script in
scripts/gadget_e2e.sh)real-hardware case studies
state machines / multi-packet transactions
Legal
Reverse engineering for interoperability is permitted (EU Directive 2009/24/EC Art. 6, US DMCA §1201(f)). usb-rea only analyzes traffic of devices you own and never redistributes vendor code.
License
MIT
Available Tools
9 toolscapture_startC
Start capturing USB traffic (usbmon on Linux, USBPcap on Windows) into out.
| Name | Required | Description | Default |
|---|---|---|---|
| bus | No | ||
| out | No | capture.pcapng |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, and it discloses very little: it doesn't say the capture runs until capture_stop, whether `out` is overwritten or appended, or what privileges are needed. The platform backend note is the only added behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler; the action and destination are stated immediately. Nothing could be trimmed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be described, but for a stateful capture-start operation with no annotations and 0% parameter coverage, the definition omits essentials such as capture duration/lifecycle, privilege requirements, and the meaning of `bus`.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so both parameters rely on the description. It references `out` as the destination file (adding some meaning), but `bus` is never mentioned at all, leaving its default of 0 and its selection semantics entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ("Start capturing USB traffic") and even names the platform backends (usbmon/USBPcap), which is genuinely informative. It doesn't explicitly contrast with its obvious sibling capture_stop, but the verb makes the distinction self-evident.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to call this versus alternatives, nor any prerequisites. For a capture tool that typically requires elevated privileges (usbmon needs root, USBPcap needs a driver install), the absence of any setup condition is a real gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
capture_stopB
Stop the running capture.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does not state what happens to captured data on stop, whether the operation errors if no capture is running, or whether it blocks — all relevant for a stop command.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no waste. It is appropriately terse for a zero-parameter control command, though it is arguably under-specified rather than truly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and there are no parameters to document. Still, the description omits the fate of the captured data and the no-active-capture case, which are the main unknowns for a stop tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline of 4 applies; there is nothing for the description to clarify beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Stop') and resource ('the running capture'), which clearly pairs with the sibling capture_start. However, it offers no explicit differentiation from siblings beyond the obvious stop/start pairing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'the running capture' weakly implies a capture must be active, but there is no explicit when-to-use guidance, no conditions, and no mention of alternatives such as capture_start.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
diff_actionsC
Diff packets per action and infer the protocol. Returns JSON with byte roles and evidence frames.
| Name | Required | Description | Default |
|---|---|---|---|
| device | No | ||
| capture | Yes | ||
| markers | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It hints at an analysis/inference operation and mentions 'byte roles and evidence frames', but says nothing about whether it is read-only, what it requires as input state, whether it is expensive, or how failures are reported.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the core action front-loaded and zero filler. It is arguably too terse for a tool with three undocumented parameters, but there is no wasted prose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described. However, for a tool with an unfamiliar domain, zero parameter documentation, and no annotations, the description omits prerequisites, input meaning, and behavioral traits an agent needs to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across all three parameters (device, capture, markers), and the description never mentions any of them. 'Per action' loosely gestures at the action/marker concept, but no format, default, or selection semantics are conveyed, so it fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Diff packets per action') plus a secondary outcome ('infer the protocol'), which is distinguishable from siblings like mark_action or replay_packet. It stops short of naming a sibling or stating scope limits, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites (e.g. that a capture must exist and actions must have been marked via mark_action), and no mention of alternatives. The agent must infer the workflow position from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hid_descriptorB
Decode a HID report descriptor: source is a capture path (finds GET_DESCRIPTOR 0x22) or descriptor hex.
Optionally decode one report payload (decode_hex) of report_type Input/Output/Feature.
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | ||
| decode_hex | No | ||
| report_type | No | Input |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does add real value by explaining that a capture-path `source` is resolved by locating GET_DESCRIPTOR 0x22, but it omits error behavior, output format, and any constraints, leaving meaningful gaps for a no-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight, front-loaded sentences with no filler; the primary source parameter is explained first and the optional decode secondary. Slightly dense inline formatting but nothing wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described. All three parameters are addressed and the source-resolution behavior is covered, leaving only error/edge-case behavior unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it largely does: it defines `source` as either a capture path or descriptor hex, `decode_hex` as a single report payload, and constrains `report_type` to Input/Output/Feature beyond the schema's bare 'Input' default. Only minor detail (e.g. hex string format) is missing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (Decode) and resource (HID report descriptor), plus the optional secondary capability of decoding a report payload. It doesn't differentiate itself from siblings like wireshark_dissector or replay_packet, leaving the agent to infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance and no mention of alternatives among the sibling tools. Usage is only implied by the resource being decoded, so an agent gets no routing help.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mark_actionC
Mark the action the user is about to perform in the vendor app, e.g. 'brightness 50%'.
| Name | Required | Description | Default |
|---|---|---|---|
| label | Yes | ||
| capture | No | capture.pcapng |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden, yet it says nothing about side effects, whether the mark is written into a capture file, whether a session must be running, or whether marks can be removed. Only the label semantics are conveyed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with an inline example and no filler. Every element earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be explained, but with zero annotation coverage and an unexplained second parameter, the definition is too thin for a tool that mutates a capture artifact and interlocks with capture_start/capture_stop/diff_actions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. The example 'brightness 50%' does clarify what the required label should contain, but the 'capture' parameter (default capture.pcapng) is never mentioned, leaving half the parameters undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('Mark') and resource ('the action the user is about to perform in the vendor app') plus a concrete example label. It is more specific than a tautology, but it never explains what a 'mark' actually is or where it lands, and it does not distinguish itself from siblings like diff_actions or capture_start/stop.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to call this versus alternatives, no prerequisite (e.g. an active capture), and no exclusion. The user must infer from the sibling set that this annotates a capture for later diff_actions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
replay_packetB
Send one packet to real hardware. Only set user_confirmed=True after the human approved this exact packet.
| Name | Required | Description | Default |
|---|---|---|---|
| pid | Yes | ||
| vid | Yes | ||
| endpoint | Yes | ||
| hex_data | Yes | ||
| setup_hex | No | ||
| user_confirmed | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden. It does add important behavioral context that this touches real hardware and gates the write behind human approval via user_confirmed. But it omits whether the call is irreversible, what auth/permissions are needed, what happens on device errors, or whether it opens the device itself.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with zero filler; the action is front-loaded and the safety constraint follows immediately. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described, but with 6 parameters at 0% schema coverage and no annotations, key invocation details are missing: the meaning of setup_hex, hex_data format, and any device-session preconditions. For a real-hardware write tool this leaves too much to guesswork.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 6 parameters, so the description must compensate and largely does not. It explains only user_confirmed's intended value (approval gate), leaving vid, pid, endpoint, hex_data, and setup_hex entirely undefined in both schema and prose (e.g., hex encoding format, whether setup_hex indicates a control transfer).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Send one packet to real hardware') and even bounds the scope to a single packet, which is more precise than the bare name. It does not name any sibling, but the send-a-packet action is clearly distinct from the capture/diff/report siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence implies when the tool is safe to invoke ('Only set user_confirmed=True after the human approved this exact packet'), which is genuinely actionable usage guidance. However, it gives no prerequisites such as needing an active device/capture session, and no guidance on when to prefer this over other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reportC
Markdown evidence report: every claim links to frame numbers in the capture.
| Name | Required | Description | Default |
|---|---|---|---|
| device | No | ||
| capture | Yes | ||
| markers | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, and it does not say whether this is a read-only generation, whether it writes a file, what permissions the capture requires, or whether the capture must be stopped first. It only describes output content ('claims link to frame numbers'), which is already covered by the output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with no wasted words, and the artifact type is front-loaded. But the brevity comes from under-specification rather than disciplined editing, which caps the score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be explained, but a tool taking three undocumented parameters with zero annotation coverage and no stated side effects or workflow position is not described completely enough for reliable invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for all three parameters (device, capture, markers), so the description must compensate. It obliquely references the capture ('frame numbers in the capture') but says nothing about what device, capture identifiers, or markers mean or accept, leaving most parameters undocumented in both places.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The fragment names the artifact produced (a Markdown evidence report) and its key property (claims linked to frame numbers), which distinguishes it from siblings like diff_actions or replay_packet. However it never states the action verb or scope, so the agent must infer that this generates a report rather than, say, retrieving one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of any sibling tool. The agent is left to guess where report fits relative to capture_stop, diff_actions, or mark_action in a workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scaffold_driverC
Generate a standalone Python/pyusb driver for the inferred protocol.
| Name | Required | Description | Default |
|---|---|---|---|
| device | No | ||
| capture | Yes | ||
| markers | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does not say where the generated driver goes (file path, working directory, or return value), whether it overwrites existing files, what runtime/permission requirements exist, or what state the tool depends on.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler or repetition. It is efficient, though arguably terse to the point of under-specification for a generation tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described, but for a code-generation tool with zero annotations and 0% parameter coverage the description omits prerequisites, output location, and parameter meaning. It is not complete enough to invoke confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description names none of the three parameters (device, capture, markers). 'Inferred protocol' vaguely hints that capture is the source of inference, but device selection and markers are entirely unexplained in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (generate) and resource (standalone Python/pyusb driver for the inferred protocol), which is clear enough to separate it from artifact-producing siblings like wireshark_dissector and hid_descriptor. It does not, however, explicitly name or contrast with any sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisite stated (e.g. that a capture must first be recorded and analyzed), and no contrast with the alternative artifacts (wireshark_dissector, hid_descriptor). The phrase 'inferred protocol' weakly implies prior capture analysis but that is inference, not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wireshark_dissectorC
Generate a Wireshark Lua dissector for the inferred protocol (labels fields, decodes values,
verifies checksums). Load it with wireshark -X lua_script:<file>.lua capture.pcapng.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | usbrea | |
| device | No | ||
| capture | Yes | ||
| markers | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses what the dissector does functionally, but not the tool's own behavior: whether it writes a file, where the generated script lands, what permissions or inputs (device/markers) it needs, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, purpose front-loaded, and the load command is practical. Every sentence carries information, though the loading instruction is arguably tangential to selecting the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. However, with zero annotations and 4 opaque, 0%-documented parameters, the definition leaves an agent without enough information to invoke it correctly beyond supplying a capture file.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% across 4 parameters. The only hint the description provides is 'capture.pcapng', weakly implying the required capture parameter is a capture file; name (default 'usbrea'), device, and markers remain entirely unexplained in both schema and description, so the description does not compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Generate) and resource (Wireshark Lua dissector) scoped to the inferred protocol, with useful detail on what it produces (field labels, value decoding, checksum verification). It is clearly distinguishable from siblings like scaffold_driver or hid_descriptor, though it never names or contrasts them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence explains how to load the generated artifact, not when to choose this tool over scaffold_driver, hid_descriptor, or replay_packet. There is no prerequisite context or exclusion guidance for an agent deciding between the protocol-tooling siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v0.2.0- First observed
capture_start - First observed
capture_stop - First observed
diff_actions - First observed
hid_descriptor - First observed
mark_action - First observed
replay_packet - First observed
report - First observed
scaffold_driver - First observed
wireshark_dissector
TDQS
Scored across 9 tools
Most tools target clearly distinct stages of a USB RE workflow: capture control, action marking, diffing, reporting, code generation, HID decoding, and replay. Minor overlap exists between scaffold_driver and wireshark_dissector (both generate artifacts from an inferred protocol) and between diff_actions and report (both analyze the capture), but descriptions make the boundaries clear enough to choose correctly.
Mixed conventions: capture_start/capture_stop use noun_verb, mark_action/diff_actions/replay_packet use verb_noun, and report/scaffold_driver/wireshark_dissector/hid_descriptor are bare noun phrases. Still readable and each name signals its purpose, but there is no single predictable pattern.
Nine tools is well-scoped for a USB reverse-engineering pipeline; each tool corresponds to a distinct pipeline step (capture, annotate, analyze, document, generate, decode, replay) with no filler.
The surface covers the full capture-to-driver lifecycle including replay with a safety confirmation flag, which is strong. Minor gaps: no way to query capture status or list/read individual frames/packets directly, and no capture pause or session management, though the core workflow is intact.
Maintenance
Related MCP Connectors
Hunt zero-days by talking to binaries. 40+ tools. Hosted, OAuth + SSO, invite: hi@byteray.ai
Captured web interfaces, screenshots, flows and structured evidence for AI coding agents.
Drive real devices from your AI Coding tool. Embed a client SDK (Unity, Godot, Flutter, iOS/macOS, Android, React Native, Web) in your app, then capture screenshots, traverse the UI tree, inject taps and key events, and run automated test tasks on the physical device over a secure relay.
Signed sandbox verdicts on any artifact, plus an agent marketplace. No key, no signup, no payment.
Related MCP Servers
- AlicenseAqualityDmaintenanceEnables reverse engineering of web applications and chat interfaces through browser automation, network traffic capture, and streaming API discovery. Provides comprehensive tools for analyzing network patterns, capturing streaming responses, and automating complex web interactions.1413 npm1ISC
- AlicenseNot gradedqualityDmaintenanceDrive a Cynthion USB test instrument from an LLM via the Model Context Protocol. Sniff, decode, and emulate USB devices over chat.5BSD 3-Clause
- AlicenseNot gradedqualityBmaintenanceAuthorized Android pentest lab, drivable by hand or by AI — Frida bypass chain, live traffic capture with automatic IDOR flagging, full MCP control plane, web dashboard.8MIT
- AlicenseAqualityAmaintenanceLocal serial and USB hardware access for coding agents, with typed YAML protocol commands, checksum validation, audited writes, lossless captures, hardware-free replay, and MCP App visualizations. Runs locally over stdio; live hardware use requires a serial device connected to the same machine.187MIT