opendevicedb
OfficialThis MCP server helps humans and AI agents avoid duplicated reverse-engineering work by querying, claiming, and publishing device knowledge in OpenDeviceDB.
Look up a device first (
lookup_device): check whether a protocol/open firmware already exists, see live claims, and get a recommendation plus install routes using identifiers like FCC ID, USB vid:pid, BLE name, or Zigbee model.Search the directory (
search_devices): run ranked full-text searches across curated and imported databases, with filters for status and device category.Claim a device (
claim_device): record that you are working on a device, with scope, contact, and expiry, so other agents do not duplicate work; creates a stub if unknown and writes to a local repo checkout for a PR.Publish findings (
publish_findings): merge partial or complete results into a record — summary/status, interfaces, projects, install routes, identifiers, aliases, verification, and provenance — then open a PR.Request a device (
request_device): when your user wants a device supported but will not reverse engineer it, return an existing request to 👍 or a pre-filled public GitHub issue link; never posts anything.List sources (
list_sources): inspect aggregated databases with name, URL, license, snapshot date, and record counts to judge coverage and freshness.
Aggregates ESPHome device definitions and firmware information into OpenDeviceDB, allowing agents to query existing reverse-engineered device knowledge and publish findings.
Aggregates LineageOS device support data into OpenDeviceDB, enabling agents to look up reverse-engineered device details and contribute new findings.
Aggregates OpenWrt device database records into OpenDeviceDB, providing queryable reverse-engineering information for supported routers and devices.
Aggregates Tasmota device templates and firmware data into OpenDeviceDB, allowing agents to query existing device knowledge and publish updates.
Aggregates Zigbee2MQTT device support data into OpenDeviceDB, enabling agents to query reverse-engineered Zigbee device information and avoid duplicate work.
OpenDeviceDB
English | 简体中文
An open directory of devices whose protocols or firmware have been reverse engineered, so that nobody — human or AI agent — redoes work that already exists.
Humans: browse the directory, device pages and news on the website (
site/).Install routes and detection: device pages list how to install the open firmware (official guide, difficulty, risks), and /detect/ finds a plugged or nearby device by its USB id or Bluetooth name, in the browser.
Freedom: each project says what stays non-free (vendor blobs, modem, Wi-Fi…) and whether the vendor cloud is still needed; the directory filters devices that work with no cloud.
Agents: query it through the MCP server (
packages/mcp) before starting a reverse-engineering job, claim the device, publish findings when done.Existing databases (25 today: OpenWrt, Zigbee2MQTT, Z-Wave JS, Tasmota, ESPHome, tuya-local, OpenRGB, libgphoto2, LineageOS, postmarketOS/Nura, coreboot, rtl_433, Gadgetbridge, Klipper, Marlin, Rockbox, Valetudo, thingino, tuya-cloudcutter, QMK, SANE, OpenPrinting, libwacom, Betaflight, EdgeTX…) are aggregated by importers (
packages/importers), with a link back to each source.
If it is useful to you, a ⭐ helps people with the same devices find it.
Contributions don't have to be complete: a single verified fact about a protocol (a BLE characteristic, a checksum, UART pins) helps the next person or agent go faster. See Contribute.
See SPEC.md for the design and POLICY.md for what we accept.
npm install
npm run validate # check every record against schema/device.schema.json
npm run import -- all # refresh data/imported/ snapshots
npm run dev # website on localhost
npm run mcp # MCP server on stdioCode: AGPL-3.0-or-later (see LICENSE). Data: CC BY-SA 4.0 (see LICENSE-DATA.md).
Available Tools
6 toolsclaim_deviceClaim a device you are about to reverse engineerA
Record that you (your human) are working on a device, with a scope, contact and expiry (default 30 days, max 90), so other agents do not duplicate the work. Creates a stub record if the device is unknown (then give vendor, model, category). Writes data/devices/.yaml in the local repository checkout (needs ODB_REPO); you then open a pull request — the result gives the exact commands.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | Device id if it already exists (from lookup_device/search_devices). Otherwise give vendor + model. | |
| who | Yes | Who is working on it: your human's name or handle (and project). | |
| days | No | Claim duration in days (default 30, max 90). Expired claims are ignored. | |
| agent | No | Agent/tooling used, e.g. "claude-code + rea 6.5.0". | |
| model | No | Model name, used to build the id when the device is new. | |
| scope | Yes | What you will reverse engineer, e.g. "BLE pairing + telemetry", "full Wi-Fi control". | |
| vendor | No | Manufacturer, used to build the id when the device is new. | |
| contact | Yes | How others can reach the claimant: email, GitHub handle, URL of a tracking issue. | |
| category | No | Required only when the device is not in OpenDeviceDB yet. | |
| force_new | No | Create a new record even though a similar device exists (only if you are sure it is a different device). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it as a non-read-only, non-destructive, closed-world write. The description adds substantial context beyond annotations: writes data/devices/<id>.yaml, requires ODB_REPO, creates a stub for unknown devices, and instructs the agent to open a PR using commands in the result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three front-loaded sentences cover the action, stub behavior, and write/PR workflow. Parentheticals are dense but every clause contributes operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
It covers the critical write target, ODB_REPO dependency, stub creation path, PR follow-up, and expiry behavior. It leaves unstated what happens when an active claim already exists or how conflicts and force_new are handled, which is a meaningful omission for a claim operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameter meanings are fully documented in the schema; the description repeats key fields like scope/contact/expiry and unknown-device vendor/model/category. It adds some workflow context but no semantic detail beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: recording a claim on a device for reverse engineering, including scope, contact, and expiry. It is clearly distinct from lookup/search/publish in practice, but it does not explicitly name or contrast sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear context: use it when about to reverse engineer a device and to avoid duplicate work, and it explains stub creation for unknown devices. It stops short of explicit when-not guidance or naming alternatives such as lookup_device/search_devices/request_device.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_sourcesList the databases OpenDeviceDB aggregatesARead-only
Imported source databases with name, url, license, snapshot date and record count, plus the number of curated records. Use it to judge coverage and freshness: a device absent here may still be covered by a source that was not imported.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, non-destructive, closed-world behavior. The description adds meaningful behavioral context beyond that: it covers only imported sources and warns that absence from this list does not imply absence from all possible sources.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both front-loaded and purposeful: the first lists the returned fields, the second states usage and the key coverage caveat. There is no redundant restatement of the title or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no input parameters and no output schema, the description carries the burden of explaining the return shape, and it does so by enumerating the source fields and curated-record count. It also supplies the main interpretive caveat an agent needs to use the output correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so parameter semantics are not a source of ambiguity. The schema is empty and the description does not need to explain input values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource as imported source databases and enumerates the metadata returned (name, url, license, snapshot date, record count, curated count). It distinguishes this source-catalog listing from the device-centric sibling tools, though it does not explicitly contrast with a named alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says to use the tool to judge coverage and freshness, and adds a useful caveat that a missing device may still be covered by a non-imported source. No competing sibling performs the same listing function, so omitting named alternatives is acceptable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
lookup_deviceLook up a device before reverse engineering itARead-only
CALL THIS FIRST, before you start reverse engineering any device (drone, camera, router, plug, robot, wearable...). It tells you whether the protocol or a free firmware already exists, whether someone is working on it right now (live claims), and gives a one-line recommendation (e.g. "open firmware exists: use X", "claimed by Y until Z: contact them"). Give identifiers when you have them (FCC id, USB vid:pid, BLE name, Zigbee model): they match better than names. The record's install routes (when present) say how to put the open firmware on the device: official guide, installer, difficulty, safety flags. If it answers found: false, nothing is known: call claim_device before starting.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | OpenDeviceDB id (<vendor-slug>/<model-slug>) if you already have it, e.g. from search_devices. | |
| usb | No | USB vendor:product id in lowercase hex, e.g. "2ca3:001f" (from lsusb). | |
| model | No | Model name as printed on the device or box, e.g. "Neo 2". | |
| fcc_id | No | FCC ID from the label, e.g. "SS3-NEO2". Identifiers are the most reliable match. | |
| vendor | No | Manufacturer or brand, e.g. "DJI". | |
| ble_name | No | Bluetooth LE advertised name. | |
| zigbee_model | No | Zigbee modelId reported by the device. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, non-destructive, closed-world behavior, and the description adds real substance on top: the meaning of a `found: false` result, what `install` routes contain (guide, installer, difficulty, safety flags), and that live claims have an expiry. It stops short of describing pagination, rate limits, or matching ambiguity between conflicting identifiers.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the imperative and the payoff, then the identifier-priority tip and the fallback branch. Dense but every sentence carries actionable information; the parenthetical device list and example recommendations add a little bulk without much cost.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description correctly takes on the burden of explaining what comes back (existence answer, live claims, recommendation string, install routes) and what to do on a negative result. For a zero-required-param, read-only lookup tool this is sufficient to call correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds non-obvious semantics the schema does not: identifiers (FCC id, USB vid:pid, BLE name, Zigbee model) match better than names, which tells the agent how to prioritize among the seven optional inputs. It doesn't explain precedence when multiple identifiers are supplied.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('look up a device') and enumerates exactly what the lookup returns: protocol/free-firmware existence, live claims, and a one-line recommendation with example values. It also implicitly separates itself from search_devices (identifier lookup, not browsing) and claim_device (the follow-up when nothing is found).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'CALL THIS FIRST' before reverse engineering, scoping the when-to-use condition. It also names the alternative path: 'If it answers found: false, nothing is known: call claim_device before starting,' giving a clear when-not/next-step rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
publish_findingsPublish what you foundA
CALL THIS WHEN YOU FINISH (or stop) a reverse-engineering job, even with partial results. Merges your findings into the record: summary and status replace (status only moves forward), interfaces merge by transport+name (yours replace), projects by url, install routes by method+guide, identifiers and aliases are unioned, verification is appended. The result is validated against the schema; nothing is written on error. Link to your protocol docs/code hosted elsewhere; never include firmware images, vendor code, keys, or anything defeating Remote ID, geofencing or other safety functions (POLICY.md). Set provenance.ai_assisted honestly. Then open a pull request — the result gives the commands.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Device id (from lookup_device or claim_device). | |
| patch | Yes | Findings to merge into the record. | |
| allow_downgrade | No | Allow lowering the status (only when the previous status was wrong; explain why in summary or verification notes). | |
| release_claim_of | No | Remove the live claims of this claimant (the `who` you used in claim_device) now that the work is published. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well past the annotations: it spells out the exact merge rules per field (status forward-only, interfaces by transport+name, projects by url, install routes by method+guide, union of identifiers/aliases, verification appended), guarantees atomicity ('nothing is written on error'), and states content-policy limits and provenance honesty requirements. This is exactly the behavioral context annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the call trigger, then merge semantics, then policy and next step — a rational order with no filler. It is dense and long-ish, but nearly every clause carries operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex nested-patch mutation with no output schema, the description covers the merge model, error atomicity, policy constraints, provenance obligations, and the post-call workflow. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description earns above that by explaining the merge/replace semantics that the schema only partially documents (which fields union vs. replace vs. append), which is the key thing an agent must reason about when composing a patch.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — merge published findings into the device record — and immediately frames the trigger condition ('when you finish or stop a reverse-engineering job'). The per-field merge semantics make it unmistakably distinct from lookup_device, search_devices, claim_device, and request_device.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to invoke it, including the edge case of stopping with partial results, and describes the follow-up step (open a pull request; the result gives the commands). It does not name sibling tools or state when NOT to use it, which keeps it short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
request_deviceRequest a device (say your user wants it)ARead-only
Use when your user wants a device to become usable with open code but will not reverse engineer it themselves (lookup_device found nothing usable). Returns the existing request to add a 👍 to, or a pre-filled link to a new public GitHub issue that the user reviews and submits. Read-only: this tool never posts anything.
| Name | Required | Description | Default |
|---|---|---|---|
| usb | No | USB vendor:product id (lsusb). | |
| goal | No | What your user wants to do with it, in their words (e.g. "fly it from Python now that the app is gone"). | |
| model | Yes | Exact model name, e.g. "Bebop 2". | |
| fcc_id | No | FCC ID from the label. | |
| vendor | Yes | Manufacturer or brand, e.g. "Parrot". | |
| ble_name | No | Bluetooth LE advertised name. | |
| zigbee_model | No | Zigbee modelId. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The name and title suggest a write/submission operation, but the description explicitly corrects this: it "never posts anything," only returns a link the user reviews and submits, which reinforces the readOnlyHint annotation with concrete detail. It also discloses the two possible return shapes (existing request vs. pre-filled link), which no annotation or schema conveys.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences: trigger condition first, then return behavior, then safety qualifier. Every sentence adds distinct information, with no repetition of the title or schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With seven parameters, a 100% described schema, and no output schema, the description supplies exactly what's missing: the result shape (upvote target vs. new-issue link) and who submits it. Nothing an agent needs in order to call this correctly is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all seven parameters, including vendor, model, usb, fcc_id, and goal, are already documented well enough in the schema. The description adds no parameter-specific guidance, such as what to do when the USB ID is unknown; a baseline 3 is appropriate when the schema does all the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Conveys a specific action (file a request for a device to be supported) and explains the mechanism clearly: it returns an existing GitHub request to upvote or a pre-filled link to a new one. It differentiates itself from lookup_device by naming it, but does not distinguish itself from claim_device or publish_findings, which an agent could plausibly confuse with this one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Use when your user wants a device to become usable with open code but will not reverse engineer it themselves (lookup_device found nothing usable)" states both the selecting condition and the precondition tied to a sibling tool. It effectively defines the when-not case (if lookup_device found something, this tool isn't appropriate).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_devicesSearch the device directoryARead-only
Ranked full-text search over vendor, model, aliases and identifiers across curated records and imported databases (OpenWrt, Zigbee2MQTT, Tasmota...). Use it to explore ("all DJI drones", "open-firmware cameras") or when lookup_device finds nothing and you suspect another name. Each result has an id to pass to lookup_device.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum results (default 20). | |
| query | Yes | Words to match: vendor, model, alias, or an identifier (FCC id, USB vid:pid, BLE name, chip, SKU). Empty string lists everything. | |
| status | No | Restrict to one effective status (unknown, in-progress, partial-protocol, controllable, open-firmware). | |
| category | No | Restrict to one device category. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=false and destructiveHint=false, so safety is covered. The description adds real behavioral context the annotations lack: what fields are matched, that results are ranked, which datasets are included, and that each result carries an id for chaining into lookup_device. Pagination/limits are left to the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: what it searches, when to use it, and what you do with the output. No filler, and the most decision-relevant information (scope plus sibling alternative) is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter read-only search with 100% schema coverage and no output schema, the description covers purpose, sourcing, and the key output affordance (id → lookup_device). Only minor gaps remain, such as mentioning the limit default or that an empty query lists everything, both of which the schema already carries.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline would be 3, but the description adds interpretive value by showing how query strings can combine vendor/category language across the indexed fields, which the per-parameter text does not illustrate. It does not, however, touch the status/category filters that constrain result shape.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ("Ranked full-text search over vendor, model, aliases and identifiers") and names the corpus it searches (curated records plus imported OpenWrt/Zigbee2MQTT/Tasmota databases). It is clearly separable from the sibling lookup_device, which it names directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit use cases with example queries ("all DJI drones", "open-firmware cameras") and a concrete fallback rule: use this when lookup_device finds nothing and another name is suspected. The boundary against the alternative tool is stated, not inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.3.0- First observed
claim_device - First observed
list_sources - First observed
lookup_device - First observed
publish_findings - First observed
request_device - First observed
search_devices
TDQS
Scored across 6 tools
Most tools have clearly distinct roles tied to the reverse-engineering workflow: lookup, search, claim, publish, request, and list sources. lookup_device and search_devices overlap somewhat since both find devices, but the descriptions provide a clear ordering heuristic (lookup first, search when lookup fails or for exploration).
All tool names follow a consistent snake_case verb_noun pattern: publish_findings, lookup_device, search_devices, claim_device, request_device, list_sources. No mixing of camelCase or inconsistent verb styles.
Six tools is well-scoped for a device reverse-engineering coordination server. Each tool supports a distinct step in the workflow, and none appears redundant or trivial.
The surface covers the core lifecycle: discover, claim, publish findings, request additions, and inspect sources. Minor gaps exist around claim lifecycle management, such as releasing or updating an existing claim, but agents can likely work around these via existing tools and pull requests.
Maintenance
Related MCP Connectors
Router default logins, compliance index, MAC/OUI lookup. Reads free; submit_correction is Pro.
Evidence-backed open-source project search, recommendations, alternatives, and comparisons.
Search and review real KiCad and Altium PCB designs: schematics, BOMs, netlists, DRC/ERC.
EOL dates, risk scores, CISA KEV exposure, SBOM audits and edge-device EOS for 500+ products.
Related MCP Servers
- AlicenseAqualityAmaintenanceMAC-address (OUI) vendor lookup and router default-login directory for AI agents, backed by ssid.ai. Identify a device manufacturer from its MAC address, detect randomized/private addresses instead of reporting unknown, or fetch a router's default login IP and admin credentials — every field cited to the manufacturer's own documentation452 npm1MIT
- AlicenseAqualityBmaintenanceEnables AI agents to check industrial and IT devices by vendor, product, and firmware version, returning affecting CVEs, fixes, vendor advisories, fix plans, and change tracking through read-only tools.4362 PyPIMIT
- AlicenseAqualityAmaintenanceReverse engineer Windows-only USB gadgets: capture vendor-app traffic, infer the protocol with frame-level evidence, and generate an open Python/pyusb driver. Replay needs human confirmation.91MIT
- AlicenseNot gradedqualityBmaintenanceEnables agents to take software apart over MCP — native binaries, Go/Rust/.NET assemblies, WASM and EVM bytecode, Android and Flutter apps, firmware, databases, crashes and network captures — returning findings backed by code, references and explicit unknowns. Drives deep-analysis engines such as Hopper, Ghidra, IDA, JADX and Frida entirely locally, letting agents explain behavior or rebuild a feature in your own project.553,305 npmMIT