Picodev Lab
REMOTE · LAB.PICODEV.FR
Arduino benches simulated in the browser: sessions, sketch push, simulation, tests, challenges.
Available components
Last scanned (23 hours ago)
Scores higher than 47% of remote servers
Reachable. Last reached 22 Oct 2026.
Category IoT and Hardware
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security66
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (close_session). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability56
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2975 tokens (~141/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
- Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (19% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 22 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
- 21 Oct 26 62
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 22 Oct 2026 · Probed https://lab.picodev.fr/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=lab.picodev.fr | CN=YE2,O=Let's Encrypt,C=US | 14 Oct 2026 | 12 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 64a20f823daca4d4426754ef86b979c2de3 |
| SANs: lab.picodev.fr | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of lab.picodev.fr. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| fr. | present | 65381 | 13 | Verified |
| picodev.fr. | present | 15679 | 8 | Verified |
| lab.picodev.fr. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
| referrer-policy | strict-origin-when-cross-origin |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://lab.picodev.fr/mcp | Verified | 200 | |
| http (plaintext) | http://lab.picodev.fr/mcp | HTTPS enforced | 308 | https://lab.picodev.fr/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
bench_snapshot Bench photo ~73
During the session's turn on a real bench: a photo of the bench, as an image, and t_ms, the instant of the photo in ms since the start of the turn (null when unknown). One every 2 seconds.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| session | string | yes | – |
No output schema declared.
No examples provided.
brief_submit Send the spec to Picodev ~475
Send Picodev the specification of the visitor's project, as a PDF, or only return its preview (send=false). sections: {id: text in simple Markdown}, ids envelope, fonctionPrincipale, fonctions, alimentation, format, environnement, production, preferences (the 8 sections of a product specification), 4000 characters at most each; a missing section reads "À préciser" (to be specified). send=false: preview, nothing is sent, contact and consent are not required. send=true: requires contact {name, email, company?, phone?} and consent=true. nda=true: the visitor wants a non-disclosure agreement first; without sections, only contact and title are sent, without PDF. session and agent_token, optional: the mail also says what the visitor did in the lab. language: fr or en, the PDF's headings. sections.contact and figures: as for spec_draft (refused with nda=true, as sections). Write the sections with spec_draft first. Before passing consent=true, show the visitor the consent text in the visitor's language, and wait until they accept it. In French: "J'accepte que mes coordonnées et la description de mon projet soient envoyées à Picodev par courriel, pour qu'ils me répondent. Picodev les garde 3 ans après le dernier échange et ne les utilise pour rien d'autre. Détails : lab.picodev.fr/confidentialite" In English: "I agree that my contact details and the description of my project are sent to Picodev by e-mail, so that they can answer me. Picodev keeps them for 3 years after our last exchange and uses them for nothing else. Details: lab.picodev.fr/en/privacy" Returns {sent, filename, pdf (base 64, absent with nda), missing (empty or too short sections), next (a sentence for the visitor, to say in their language)}}: write the PDF on the visitor's machine.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | – | – | – |
| consent | boolean | – | – |
| contact | – | – | – |
| figures | – | – | – |
| language | string | – | – |
| nda | boolean | – | – |
| sections | – | – | – |
| send | boolean | – | – |
| session | – | – | – |
| title | string | yes | – |
No output schema declared.
No examples provided.
capture_analog Capture analog signals ~177
Sample the voltage of 1 to 4 board pins (0-13 digital, 14-21 = A0-A7; by default the setup's scope probes) at rate_hz (100 to 10 000) for duration_ms (1 to 10 000 simulated ms), 200 000 samples at most in all. An ADC input reads the voltage the circuit applies; any other pin, its logic level times the supply (PWM shows as a square wave). Simulation only: refused during a turn on a real bench, whose analyser has no analog channel. Read the result with read_capture.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| duration_ms | integer | – | – |
| pins | – | – | – |
| rate_hz | integer | – | – |
| session | string | yes | – |
No output schema declared.
No examples provided.
capture_logic Capture logic signals ~119
Record every edge of the requested pins (probes of the setup sheet; by default the logic ones) for duration_ms (1 to 10 000 ms). In the browser's simulation, in simulated time; during the session's turn on a real bench, at the bench's logic analyser, in real time (no browser or running simulation needed then). Read the result with read_capture.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| duration_ms | integer | – | – |
| pins | – | – | – |
| session | string | yes | – |
No output schema declared.
No examples provided.
close_session Close the session ~50
End the session now, as when it expires: the place or turn ends, viewers and the browser are disconnected, everything is forgotten.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| session | string | yes | – |
No output schema declared.
No examples provided.
list_setups List setups ~24
The available setups, their modes (free, challenge) and their benches.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | array | yes | – |
No examples provided.
next_level Next level ~93
Challenge mode: move to the next level, as the bench's "Next level" button, and only when it would be offered: every test of the current level passed and a next level exists. Returns {level, levels}, the new level (index); session_status's level changes with the bench's next state. No level skipping.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| session | string | yes | – |
No output schema declared.
No examples provided.
open_session Open a session ~50
Create a session (mode: free or challenge). Give open_url to the human: nothing simulates until they open it in their browser.
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | yes | – |
| setup | string | yes | – |
No output schema declared.
No examples provided.
push_circuit Push a circuit ~151
Free mode only: replace the circuit in the human's browser (the simulation stops). components: [{type, id, properties, x?, y?}] (the board is not a component), wires: [{id, start: {componentId, pinName}, end: {...}, color?}], in the shape of the setup sheet's circuit; 40 components, 120 wires, 48 KiB. The editor checks types and pins: read the outcome with read_simulation (circuit, circuit_error). 6 per minute.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| components | array | yes | – |
| session | string | yes | – |
| wires | array | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
push_program Push a compiled program ~152
Send a program compiled on the visitor's machine (Intel HEX text, 48 KiB at most, e.g. arduino-cli's <sketch>.ino.hex) to the human's browser, which loads it in the simulator without compiling and, if run, starts it. files: the sources, shown read-only in the editor, never compiled. During a turn on a real bench, the bench gets it too. Prefer it to push_to_editor, which is the fallback when the local toolchain is missing.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| files | – | – | – |
| hex | string | yes | – |
| run | boolean | – | – |
| session | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
push_to_editor Push sources to the editor ~92
Replace the code in the human's browser and, if run, compile it in the lab's cloud and start it. The fallback of push_program: use it only when the toolchain to compile locally is missing (no arduino-cli, core or library).
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| files | array | yes | – |
| run | boolean | – | – |
| session | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
queue_join Join the bench queue ~54
Take a place in the queue for benches of this kind (for example real or sim). The browser must be connected.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| kind | string | yes | – |
| session | string | yes | – |
No output schema declared.
No examples provided.
queue_leave Leave the bench queue ~39
Give back the place in the queue, or the turn if it has started.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| session | string | yes | – |
No output schema declared.
No examples provided.
queue_status Queue status ~55
The session's place: state none, waiting (position, estimated wait eta_s) or turn (bench, end of the turn ends_at, Unix seconds).
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| session | string | yes | – |
No output schema declared.
No examples provided.
read_capture Read a capture ~255
State of a capture (recording, ready, failed) and its kind (logic, analog). Once ready, the measures per pin and, for a logic capture, the edges [t_us, pin, v], 2000 from offset; for an analog one, rate_hz and the samples, rows [mv_1, ...] in the order of pins (row k at k / rate_hz), 2000 rows from offset. next: the following offset, or null. t0_ms: the first sample on the session's clock (ms since the simulation's launch, or since the start of the turn on a real bench), null when unknown; t_us and rows count from the capture's start. format="png": the same without edges or samples, plus a chart of the signals as an image (from_ms and to_ms, from the capture's start, to zoom; 4 per minute).
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| capture | string | yes | – |
| format | string | – | – |
| from_ms | – | – | – |
| offset | integer | – | – |
| session | string | yes | – |
| to_ms | – | – | – |
No output schema declared.
No examples provided.
read_setup Read a setup ~66
A served setup sheet (setup.json, files included; never a solution): board, components and wires (circuit), probes, levels. Plus, when it exists, schema.png, the starting circuit as the editor draws it, as an image.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
read_simulation Read the simulation ~122
Last state (with circuit, the browser's components and wires), last compilation and the events after since_ms (2000 at most). In challenge mode: the level's brief and its results. circuit_modified: the circuit differs from the setup sheet's (types, ids, properties, wires; not positions or colours), null when unknown. circuit_error: the editor's last refusal of a pushed circuit, returned once.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| session | string | yes | – |
| since_ms | number | – | – |
No output schema declared.
No examples provided.
request_meeting Request a meeting with Picodev ~334
Send Picodev a meeting request. contact: {name, email, company?, phone?}. context: the project in a few sentences (2000 characters at most): what the visitor wants to do, where they stand, what they did in the lab. availabilities: 1 to 10 slots {from, to}, ISO 8601 dates with a time zone, within the next 60 days; or {text}, one sentence ("Tuesday mornings"). Requires consent=true. session and agent_token, optional: the mail also says what the visitor did in the lab. Before passing consent=true, show the visitor the consent text in the visitor's language, and wait until they accept it. In French: "J'accepte que mes coordonnées et la description de mon projet soient envoyées à Picodev par courriel, pour qu'ils me répondent. Picodev les garde 3 ans après le dernier échange et ne les utilise pour rien d'autre. Détails : lab.picodev.fr/confidentialite" In English: "I agree that my contact details and the description of my project are sent to Picodev by e-mail, so that they can answer me. Picodev keeps them for 3 years after our last exchange and uses them for nothing else. Details: lab.picodev.fr/en/privacy" Returns {sent, next}: Picodev answers by e-mail to confirm a slot.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | – | – | – |
| availabilities | – | yes | – |
| consent | boolean | yes | – |
| contact | – | yes | – |
| context | string | yes | – |
| session | – | – | – |
No output schema declared.
No examples provided.
session_status Session status ~113
The session's state without its events, cheap enough to poll: browser connected (owner), visibility, current viewer link (not renewed), viewers, created_at and expires_at (Unix seconds), run (compilations so far: event times restart at each), level and levels (null in free mode), capture ({id, kind, state} of the session's capture, logic or analog, or null). Not reported to the human's journal.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| session | string | yes | – |
No output schema declared.
No examples provided.
set_visibility Set visibility ~50
Change the visibility (private, link, public). Returns the viewer link; current viewers are disconnected.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| session | string | yes | – |
| visibility | string | yes | – |
No output schema declared.
No examples provided.
spec_draft Draft a project spec ~362
Draft the specification of the visitor's own project with Picodev's interview: you ask the visitor, this tool says what to ask next and makes the PDF. Nothing is sent and nothing is kept. Call it with the sections written so far (none at first). sections: {id: text in simple Markdown}, ids envelope, fonctionPrincipale, fonctions, alimentation, format, environnement, production, preferences, 4000 characters at most each. sections.contact, optional: the contact details the visitor wants printed at the end of the document (1000 characters at most; not part of the interview's progress). language: fr or en, the one the visitor answers in (headings, look_for and questions, the PDF). pdf=true: also the PDF, with Picodev Lab's template; requires title (one line). figures, with pdf=true, optional: the drawings the visitor approved, 3 at most, each {section (a section id), caption (one line), type (png or svg), data (base 64, 200 KiB at most decoded)}, placed after their section's text; an SVG loads nothing (no script, no DTD, href # or data:image/ only). Returns {rules (how to run the interview: follow them), sections [{id, heading, required, state (empty, thin, filled), look_for and questions while not filled}], next (the section to ask about, or null), ready (the four required sections filled: enough for Picodev to start), filename and pdf (base 64) with pdf=true}.
| Name | Type | Req | Description |
|---|---|---|---|
| figures | – | – | – |
| language | string | – | – |
| boolean | – | – | |
| sections | – | – | – |
| title | – | – | – |
No output schema declared.
No examples provided.
How do I install the Picodev Lab MCP server?
Picodev Lab is a hosted endpoint at https://lab.picodev.fr/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · lab.picodev.fr
claude mcp add --transport http picodev-sas-picodev-lab 'https://lab.picodev.fr/mcp'
What is the Picodev Lab MCP server?
Picodev Lab is an MCP server listed in the public MCP registry as io.github.PICODEV-SAS/picodev-lab. Arduino benches simulated in the browser: sessions, sketch push, simulation, tests, challenges. This page covers its hosted endpoint (https://lab.picodev.fr/mcp).
Is the Picodev Lab MCP server safe to use?
Picodev Lab scores 63 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Picodev Lab MCP server expose?
Picodev Lab exposes 21 tools: list_setups, open_session, push_to_editor, push_program, read_simulation, and 16 more. Their descriptions and schemas cost roughly 2,906 tokens of context every time the server is loaded.
Does the Picodev Lab MCP server require authentication?
No. We connected to Picodev Lab without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Picodev Lab MCP server still maintained?
Picodev Lab is still listed as active in the MCP registry. We last reached this channel on 22 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.