Generic SCPI Instrument
PYPI · LABMCP-SCPI · SCANNED SEP 30
Generic MCP server for any SCPI instrument over VISA, TCP or serial, with command allow/deny lists.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 2 of 17 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to K-Dense-AI/lab-instrument-mcps). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 3 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1871 tokens (~133/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 96% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety88
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 1 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "scpi_query" implies "send" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
- An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the Generic SCPI Instrument MCP server?
Generic SCPI Instrument runs locally as a PyPI package, launched with uvx labmcp-scpi. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · labmcp-scpi
claude mcp add k-dense-ai-labmcp-scpi -- uvx labmcp-scpi
{
"mcpServers": {
"k-dense-ai-labmcp-scpi": {
"command": "uvx",
"args": [
"labmcp-scpi"
]
}
}
} {
"servers": {
"k-dense-ai-labmcp-scpi": {
"command": "uvx",
"args": [
"labmcp-scpi"
]
}
}
} codex mcp add k-dense-ai-labmcp-scpi -- uvx labmcp-scpi
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"k-dense-ai-labmcp-scpi": {
"type": "local",
"command": [
"uvx",
"labmcp-scpi"
],
"enabled": true
}
}
} openclaw mcp add k-dense-ai-labmcp-scpi --command uvx --arg labmcp-scpi
mcp_servers:
k-dense-ai-labmcp-scpi:
command: "uvx"
args: ["labmcp-scpi"] {
"McpServers": {
"k-dense-ai-labmcp-scpi": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"labmcp-scpi"
]
}
}
} assistant mcp add k-dense-ai-labmcp-scpi -t stdio -c uvx -a labmcp-scpi
{
"mcpServers": {
"k-dense-ai-labmcp-scpi": {
"command": "uvx",
"args": [
"labmcp-scpi"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 29 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Sept 26 +42
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Sept 26 −31
- Tool safety: pass → unverified ▼ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.1.2 → 0.1.3 functional
- 26 Sept 26 70
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 30 Sept 2026 · Analysed pypi/labmcp-scpi@0.1.3
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | K-Dense-AI/lab-instrument-mcps |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/K-Dense-AI/lab-instrument-mcps/.github/workflows/release.yml@refs/tags/labmcp-scpi-v0.1.3 |
| Rekor log index | 2969518382 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:833b7d53f5cb6274723447d2e2cfb22c930977ea2c8deab2796794dc20461a46 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 17 packages
| Packages resolved | 17 |
|---|---|
| Stale | 2 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
device_clear Device Clear ~99
Recover a stuck or confused instrument: VISA device clear (or discard unread input on socket/serial links), report the error queue, optionally ABORt, then *CLS. This does NOT make an arbitrary instrument safe (outputs stay as they are): use `apply_safe_state` if the lab configured one, or the instrument's own controls.
| Name | Type | Req | Description |
|---|---|---|---|
| send_abort | boolean | – | Also send ABORt (stop sweeps / measurements) |
Structured output declared, but exposes no named fields.
No examples provided.
get_command_log Get Command Log ~46
Return the most recent raw commands sent to / replies received from the instrument (newest last). Useful for debugging and for recording what was done.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | array | yes | – |
No examples provided.
get_connection_info Get Connection Info ~40
Report which instrument is connected (identity, address, simulated or real), whether the server is read-only, and the active safety limits. Call this first.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
get_errors Get Errors ~66
Read and clear the instrument's error/event queue (SYSTem:ERRor? until 0,"No error"). Entries are returned oldest first; each can only be read once. An empty list means no errors.
| Name | Type | Req | Description |
|---|---|---|---|
| max_errors | integer | – | Stop after this many entries |
| Name | Type | Req | Description |
|---|---|---|---|
| result | array | yes | – |
No examples provided.
identify Identify ~26
Ask the instrument who it is (*IDN?): manufacturer, model, serial number, firmware.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| firmware | string | yes | – |
| manufacturer | string | yes | – |
| model | string | yes | – |
| raw | string | yes | Raw *IDN? reply |
| serial | string | yes | – |
| timestamp | string | yes | – |
No examples provided.
list_visa_resources List Visa Resources ~98
List GPIB / USBTMC / LAN (VXI-11, HiSLIP) instruments visible to VISA on this computer. Works without --address. Raw-socket instruments (tcp://host:5025) are not discoverable.
| Name | Type | Req | Description |
|---|---|---|---|
| backend | string | – | @py = pyvisa-py, @ivi = NI-VISA / Keysight / R&S VISA |
| query | string | – | VISA resource filter |
| Name | Type | Req | Description |
|---|---|---|---|
| available | boolean | yes | False if PyVISA or a VISA backend is not usable |
| backend | string | yes | – |
| note | string | yes | – |
| resources | array | yes | – |
| simulated | boolean | yes | – |
No examples provided.
query_binary_block Query Binary Block ~284
Read an IEEE 488.2 definite-length binary block (waveforms, trace data, screenshots, FORMat REAL/INTeger readings). The query must pass the same read-only checks as `scpi_query`. Returns length, SHA-256 and (optionally) decoded values with summary statistics, downsampled to max_points; use save_path for the full data. Blocks larger than the `max_block_bytes` limit are discarded.
| Name | Type | Req | Description |
|---|---|---|---|
| byte_order | string | – | big = SCPI FORMat:BORDer NORMal, little = SWAPped |
| command | string | yes | One SCPI query answering with #<n><len><data> |
| decode_as | string | – | Interpret the payload as an array of this type (see the instrument's FORMat) |
| max_inline_bytes | integer | – | Return the raw payload as base64 only up to this size |
| max_points | integer | – | Max decoded values returned inline |
| overwrite | boolean | – | Allow replacing an existing save_path |
| save_path | – | – | Write the full data here: .csv with decode_as writes index,value rows; .bin/.dat/.raw/.txt/.png/.bmp/.jpg/.gif/.tif (or .csv with decode_as none) get the raw payload |
| timeout_s | number | – | Timeout for the whole transfer |
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | yes | – |
| data_base64 | – | yes | Whole payload, only if <= max_inline_bytes |
| decoded | – | yes | – |
| length_bytes | integer | yes | – |
| preview_hex | string | yes | First 32 bytes as hex |
| saved_to | – | yes | – |
| sha256 | string | yes | – |
| timestamp | string | yes | – |
No examples provided.
reconnect Reconnect ~35
Close and re-open the connection to the instrument (e.g. after it was power cycled or a cable was re-plugged).
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
reset_instrument Reset Instrument ~94
Reset the instrument to its default settings (*RST, then *CLS), wait for completion and check errors. SCPI requires outputs OFF after *RST, but every other setting (levels, ranges, triggers, limits) returns to its default and some instruments differ: check the manual before resetting anything connected to a device under test.
| Name | Type | Req | Description |
|---|---|---|---|
| clear_status | boolean | – | Also send *CLS (clear status and error queue) |
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | yes | – |
| elapsed_ms | number | yes | – |
| error_check | string | yes | 'ok', 'errors', or 'unavailable: ...' if the queue could not be read |
| errors | array | yes | Error-queue entries read after the command |
| ok | boolean | yes | True if the error queue was read and empty |
| response | – | yes | Reply, if the message contained a query |
| timestamp | string | yes | – |
No examples provided.
scpi_batch Scpi Batch ~132
Run a short sequence of SCPI commands and queries in order, checking the error queue after every step. Every step is checked against the command policy BEFORE the first one is sent, so a refused step means nothing was sent. Returns per-step replies and errors. Steps not started within ~14 minutes are not sent (status not_run).
| Name | Type | Req | Description |
|---|---|---|---|
| delay_between_s | number | – | Pause between steps |
| steps | array | yes | Commands/queries to send in order |
| stop_on_error | boolean | – | Stop at the first step that reports an error |
| timeout_s | – | – | Reply timeout per query |
| Name | Type | Req | Description |
|---|---|---|---|
| completed | integer | yes | Number of steps sent to the instrument |
| steps | array | yes | – |
| stopped_early | boolean | yes | – |
| timestamp | string | yes | – |
No examples provided.
scpi_primer Scpi Primer ~51
Concise SCPI syntax guide (long/short forms, queries, compound commands, common commands, error queue, binary blocks) plus this server's active command policy. Works without a connection.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
scpi_query Scpi Query ~175
Send ONE read-only SCPI query and return the instrument's text reply. Only single queries are accepted: the header must end with '?' (parameters such as 'VOLT? MAX' are allowed), with no ';' and no line breaks. Queries with known side effects (*TST?, *CAL?, CALibration, DIAGnostic) and anything in the lab's query denylist are refused - use `scpi_write` for those. An unknown query gets no reply (timeout); the error queue is then reported.
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | yes | One SCPI query, e.g. '*IDN?', 'MEAS:VOLT:DC?', 'VOLT? MAX' |
| max_chars | integer | – | Truncate longer replies |
| timeout_s | – | – | Reply timeout (default: server's) |
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | yes | – |
| elapsed_ms | number | yes | – |
| length | integer | yes | Length of the full response in characters |
| response | string | yes | – |
| timestamp | string | yes | – |
| truncated | boolean | yes | True if the response was cut to max_chars |
No examples provided.
scpi_write Scpi Write ~142
Send any SCPI program message (settings, compound 'A;B' messages, queries with side effects) and then read the error queue. If the message contains a query, its reply is returned. This can change the instrument's state, including switching outputs on; say what the command does before calling it. Commands in the lab's denylist, or outside its allowlist, are refused before anything is sent.
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | yes | SCPI program message, e.g. 'VOLT 5;CURR 0.1' or 'OUTP ON' |
| timeout_s | – | – | Reply timeout if it contains a query |
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | yes | – |
| elapsed_ms | number | yes | – |
| error_check | string | yes | 'ok', 'errors', or 'unavailable: ...' if the queue could not be read |
| errors | array | yes | Error-queue entries read after the command |
| ok | boolean | yes | True if the error queue was read and empty |
| response | – | yes | Reply, if the message contained a query |
| timestamp | string | yes | – |
No examples provided.
wait_operation_complete Wait Operation Complete ~54
Wait until the instrument has finished all pending operations (*OPC? returns 1), e.g. after starting a sweep, an acquisition or a settling source.
| Name | Type | Req | Description |
|---|---|---|---|
| timeout_s | number | – | Longest time to wait |
Structured output declared, but exposes no named fields.
No examples provided.
What is the Generic SCPI Instrument MCP server?
Generic SCPI Instrument is an MCP server listed in the public MCP registry as io.github.K-Dense-AI/labmcp-scpi. Generic MCP server for any SCPI instrument over VISA, TCP or serial, with command allow/deny lists. This page covers its PyPI package (labmcp-scpi).
Is the Generic SCPI Instrument MCP server safe to use?
Generic SCPI Instrument scores 82 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 30 September 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Generic SCPI Instrument MCP server expose?
Generic SCPI Instrument exposes 14 tools: get_connection_info, get_command_log, reconnect, scpi_primer, identify, and 9 more. Their descriptions and schemas cost roughly 1,342 tokens of context every time the server is loaded.
Is the Generic SCPI Instrument MCP server still maintained?
Generic SCPI Instrument is still listed as active in the MCP registry. We last reached this channel on 30 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Generic SCPI Instrument MCP server under?
Generic SCPI Instrument declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.