Iotaudit MCP server

iotaudit

<!-- mcp-name: io.github.emirmrkaljevic/iotaudit -->

If you find this useful, you can support me by getting a SkinToScan pack, my other project. It's a one-time purchase that directly funds my open-source work.

Is your smart pet feeder, camera or plug safe? iotaudit watches what your own IoT devices do on the network and gives each one an A-F grade, a one-line safety verdict, and a one-page HTML report. Everything runs locally: no account, no telemetry, no cloud.

It answers the questions you actually have about a cheap smart device:

TLS or plaintext, and destination countries are observed facts. Video, audio, and other traffic patterns stay indicators with a confidence.

• What is the short version? A one-line verdict next to the grade. Open ports, public DNS,

The report lists the destination countries for each device (observed fact).

• Who does it talk to? Domains (DNS + TLS SNI + HTTP Host), IPs, country, organisation.

telemetry, or unknown, each with a low, medium, or high confidence. It is a pattern match, not proof of what was sent.

• What does the traffic look like? A separate per-device indicator for video, audio,

and which device they point to (read-only, never changes the router).

• Is it encrypted? Plaintext HTTP, unencrypted TCP, old TLS, or "custom" high-entropy protocols.
• What ports are open? Optional nmap scan with risk notes (telnet, RTSP, UPnP, ADB, …).
• Is it reachable from the internet? Lists the port forwards your router opened via UPnP

when a stream was set up but never actually passed through your computer.

• Does it phone home while idle? Idle-upload check and a traffic timeline with bursts.
• Where did the video go? LAN peer (phone P2P) vs cloud vs STUN/TURN, and an honest note

Status: 0.1.8. Hotspot + ARP capture, pcap and PCAPdroid analysis, IPv6/NDP, device-type

identification, UPnP port-forward audit, an opt-in default-password check, grading with a

one-line safety verdict, HTML and PDF reports, a local web UI and the MCP server work. Offline CVE

hints are on the roadmap.

Sample report

A report for a Tuya-associated pet feeder (anonymized). The one-line verdict sits beside the grade: telnet open on the LAN, public DNS, TLS cloud traffic to the US, unverified custom encryption, and a P2P video setup whose stream was not observed on this run. The longer summary is still underneath. It also shows an odd special-use "LAN peer" that is not a real device:

Open docs/sample-report.html in a browser for the full version.

Demo

A short walk-through of a capture, the UPnP port-forward check and the opt-in default-password check (animated SVG, no audio, no tracking):

Shortened. The full README is on GitHub.