Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Picodev Lab

REMOTE · LAB.PICODEV.FR

Arduino benches simulated in the browser: sessions, sketch push, simulation, tests, challenges.

Available components

63 Trust /100

Last scanned (23 hours ago)

Scores higher than 47% of remote servers

Reachable. Last reached 22 Oct 2026.

Category IoT and Hardware

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security66
Transport & Reachability100
Schema Quality & AI Usability56
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 2975 tokens (~141/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
  • Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 0% of tool parameters carry a description.Fail
  • Structured output schemas are declared (19% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 22 Oct 26 +1
    • Stability: unverified → 0.03 ▲ functional
  • 21 Oct 26 62

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 22 Oct 2026 · Probed https://lab.picodev.fr/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=lab.picodev.fr CN=YE2,O=Let's Encrypt,C=US 14 Oct 2026 12 Jan 2027 ECDSA 256 ECDSA-SHA384 64a20f823daca4d4426754ef86b979c2de3
SANs: lab.picodev.fr
CN=YE2,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 4df3b15dd6c0784c507cd37b58e6f115
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC secure

Validation of lab.picodev.fr. — Secure

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
fr. present 65381 13 Verified
picodev.fr. present 15679 8 Verified
lab.picodev.fr. Verified address RRset verified with the apex keys
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains
x-content-type-options nosniff
referrer-policy strict-origin-when-cross-origin

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://lab.picodev.fr/mcp Verified 200
http (plaintext) http://lab.picodev.fr/mcp HTTPS enforced 308 https://lab.picodev.fr/mcp
MCP tools · 21 exposed · ~2,906 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
bench_snapshot ~73

During the session's turn on a real bench: a photo of the bench, as an image, and t_ms, the instant of the photo in ms since the start of the turn (null when unknown). One every 2 seconds.

NameTypeReqDescription
agent_tokenstringyes–
sessionstringyes–

No output schema declared.

No examples provided.

brief_submit ~475

Send Picodev the specification of the visitor's project, as a PDF, or only return its preview (send=false). sections: {id: text in simple Markdown}, ids envelope, fonctionPrincipale, fonctions, alimentation, format, environnement, production, preferences (the 8 sections of a product specification), 4000 characters at most each; a missing section reads "À préciser" (to be specified). send=false: preview, nothing is sent, contact and consent are not required. send=true: requires contact {name, email, company?, phone?} and consent=true. nda=true: the visitor wants a non-disclosure agreement first; without sections, only contact and title are sent, without PDF. session and agent_token, optional: the mail also says what the visitor did in the lab. language: fr or en, the PDF's headings. sections.contact and figures: as for spec_draft (refused with nda=true, as sections). Write the sections with spec_draft first. Before passing consent=true, show the visitor the consent text in the visitor's language, and wait until they accept it. In French: "J'accepte que mes coordonnées et la description de mon projet soient envoyées à Picodev par courriel, pour qu'ils me répondent. Picodev les garde 3 ans après le dernier échange et ne les utilise pour rien d'autre. Détails : lab.picodev.fr/confidentialite" In English: "I agree that my contact details and the description of my project are sent to Picodev by e-mail, so that they can answer me. Picodev keeps them for 3 years after our last exchange and uses them for nothing else. Details: lab.picodev.fr/en/privacy" Returns {sent, filename, pdf (base 64, absent with nda), missing (empty or too short sections), next (a sentence for the visitor, to say in their language)}}: write the PDF on the visitor's machine.

NameTypeReqDescription
agent_token–––
consentboolean––
contact–––
figures–––
languagestring––
ndaboolean––
sections–––
sendboolean––
session–––
titlestringyes–

No output schema declared.

No examples provided.

capture_analog ~177

Sample the voltage of 1 to 4 board pins (0-13 digital, 14-21 = A0-A7; by default the setup's scope probes) at rate_hz (100 to 10 000) for duration_ms (1 to 10 000 simulated ms), 200 000 samples at most in all. An ADC input reads the voltage the circuit applies; any other pin, its logic level times the supply (PWM shows as a square wave). Simulation only: refused during a turn on a real bench, whose analyser has no analog channel. Read the result with read_capture.

NameTypeReqDescription
agent_tokenstringyes–
duration_msinteger––
pins–––
rate_hzinteger––
sessionstringyes–

No output schema declared.

No examples provided.

capture_logic ~119

Record every edge of the requested pins (probes of the setup sheet; by default the logic ones) for duration_ms (1 to 10 000 ms). In the browser's simulation, in simulated time; during the session's turn on a real bench, at the bench's logic analyser, in real time (no browser or running simulation needed then). Read the result with read_capture.

NameTypeReqDescription
agent_tokenstringyes–
duration_msinteger––
pins–––
sessionstringyes–

No output schema declared.

No examples provided.

close_session ~50

End the session now, as when it expires: the place or turn ends, viewers and the browser are disconnected, everything is forgotten.

NameTypeReqDescription
agent_tokenstringyes–
sessionstringyes–

No output schema declared.

No examples provided.

list_setups ~24

The available setups, their modes (free, challenge) and their benches.

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultarrayyes–

No examples provided.

next_level ~93

Challenge mode: move to the next level, as the bench's "Next level" button, and only when it would be offered: every test of the current level passed and a next level exists. Returns {level, levels}, the new level (index); session_status's level changes with the bench's next state. No level skipping.

NameTypeReqDescription
agent_tokenstringyes–
sessionstringyes–

No output schema declared.

No examples provided.

open_session ~50

Create a session (mode: free or challenge). Give open_url to the human: nothing simulates until they open it in their browser.

NameTypeReqDescription
modestringyes–
setupstringyes–

No output schema declared.

No examples provided.

push_circuit ~151

Free mode only: replace the circuit in the human's browser (the simulation stops). components: [{type, id, properties, x?, y?}] (the board is not a component), wires: [{id, start: {componentId, pinName}, end: {...}, color?}], in the shape of the setup sheet's circuit; 40 components, 120 wires, 48 KiB. The editor checks types and pins: read the outcome with read_simulation (circuit, circuit_error). 6 per minute.

NameTypeReqDescription
agent_tokenstringyes–
componentsarrayyes–
sessionstringyes–
wiresarrayyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

push_program ~152

Send a program compiled on the visitor's machine (Intel HEX text, 48 KiB at most, e.g. arduino-cli's <sketch>.ino.hex) to the human's browser, which loads it in the simulator without compiling and, if run, starts it. files: the sources, shown read-only in the editor, never compiled. During a turn on a real bench, the bench gets it too. Prefer it to push_to_editor, which is the fallback when the local toolchain is missing.

NameTypeReqDescription
agent_tokenstringyes–
files–––
hexstringyes–
runboolean––
sessionstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

push_to_editor ~92

Replace the code in the human's browser and, if run, compile it in the lab's cloud and start it. The fallback of push_program: use it only when the toolchain to compile locally is missing (no arduino-cli, core or library).

NameTypeReqDescription
agent_tokenstringyes–
filesarrayyes–
runboolean––
sessionstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

queue_join ~54

Take a place in the queue for benches of this kind (for example real or sim). The browser must be connected.

NameTypeReqDescription
agent_tokenstringyes–
kindstringyes–
sessionstringyes–

No output schema declared.

No examples provided.

queue_leave ~39

Give back the place in the queue, or the turn if it has started.

NameTypeReqDescription
agent_tokenstringyes–
sessionstringyes–

No output schema declared.

No examples provided.

queue_status ~55

The session's place: state none, waiting (position, estimated wait eta_s) or turn (bench, end of the turn ends_at, Unix seconds).

NameTypeReqDescription
agent_tokenstringyes–
sessionstringyes–

No output schema declared.

No examples provided.

read_capture ~255

State of a capture (recording, ready, failed) and its kind (logic, analog). Once ready, the measures per pin and, for a logic capture, the edges [t_us, pin, v], 2000 from offset; for an analog one, rate_hz and the samples, rows [mv_1, ...] in the order of pins (row k at k / rate_hz), 2000 rows from offset. next: the following offset, or null. t0_ms: the first sample on the session's clock (ms since the simulation's launch, or since the start of the turn on a real bench), null when unknown; t_us and rows count from the capture's start. format="png": the same without edges or samples, plus a chart of the signals as an image (from_ms and to_ms, from the capture's start, to zoom; 4 per minute).

NameTypeReqDescription
agent_tokenstringyes–
capturestringyes–
formatstring––
from_ms–––
offsetinteger––
sessionstringyes–
to_ms–––

No output schema declared.

No examples provided.

read_setup ~66

A served setup sheet (setup.json, files included; never a solution): board, components and wires (circuit), probes, levels. Plus, when it exists, schema.png, the starting circuit as the editor draws it, as an image.

NameTypeReqDescription
idstringyes–

No output schema declared.

No examples provided.

read_simulation ~122

Last state (with circuit, the browser's components and wires), last compilation and the events after since_ms (2000 at most). In challenge mode: the level's brief and its results. circuit_modified: the circuit differs from the setup sheet's (types, ids, properties, wires; not positions or colours), null when unknown. circuit_error: the editor's last refusal of a pushed circuit, returned once.

NameTypeReqDescription
agent_tokenstringyes–
sessionstringyes–
since_msnumber––

No output schema declared.

No examples provided.

request_meeting ~334

Send Picodev a meeting request. contact: {name, email, company?, phone?}. context: the project in a few sentences (2000 characters at most): what the visitor wants to do, where they stand, what they did in the lab. availabilities: 1 to 10 slots {from, to}, ISO 8601 dates with a time zone, within the next 60 days; or {text}, one sentence ("Tuesday mornings"). Requires consent=true. session and agent_token, optional: the mail also says what the visitor did in the lab. Before passing consent=true, show the visitor the consent text in the visitor's language, and wait until they accept it. In French: "J'accepte que mes coordonnées et la description de mon projet soient envoyées à Picodev par courriel, pour qu'ils me répondent. Picodev les garde 3 ans après le dernier échange et ne les utilise pour rien d'autre. Détails : lab.picodev.fr/confidentialite" In English: "I agree that my contact details and the description of my project are sent to Picodev by e-mail, so that they can answer me. Picodev keeps them for 3 years after our last exchange and uses them for nothing else. Details: lab.picodev.fr/en/privacy" Returns {sent, next}: Picodev answers by e-mail to confirm a slot.

NameTypeReqDescription
agent_token–––
availabilities–yes–
consentbooleanyes–
contact–yes–
contextstringyes–
session–––

No output schema declared.

No examples provided.

session_status ~113

The session's state without its events, cheap enough to poll: browser connected (owner), visibility, current viewer link (not renewed), viewers, created_at and expires_at (Unix seconds), run (compilations so far: event times restart at each), level and levels (null in free mode), capture ({id, kind, state} of the session's capture, logic or analog, or null). Not reported to the human's journal.

NameTypeReqDescription
agent_tokenstringyes–
sessionstringyes–

No output schema declared.

No examples provided.

set_visibility ~50

Change the visibility (private, link, public). Returns the viewer link; current viewers are disconnected.

NameTypeReqDescription
agent_tokenstringyes–
sessionstringyes–
visibilitystringyes–

No output schema declared.

No examples provided.

spec_draft ~362

Draft the specification of the visitor's own project with Picodev's interview: you ask the visitor, this tool says what to ask next and makes the PDF. Nothing is sent and nothing is kept. Call it with the sections written so far (none at first). sections: {id: text in simple Markdown}, ids envelope, fonctionPrincipale, fonctions, alimentation, format, environnement, production, preferences, 4000 characters at most each. sections.contact, optional: the contact details the visitor wants printed at the end of the document (1000 characters at most; not part of the interview's progress). language: fr or en, the one the visitor answers in (headings, look_for and questions, the PDF). pdf=true: also the PDF, with Picodev Lab's template; requires title (one line). figures, with pdf=true, optional: the drawings the visitor approved, 3 at most, each {section (a section id), caption (one line), type (png or svg), data (base 64, 200 KiB at most decoded)}, placed after their section's text; an SVG loads nothing (no script, no DTD, href # or data:image/ only). Returns {rules (how to run the interview: follow them), sections [{id, heading, required, state (empty, thin, filled), look_for and questions while not filled}], next (the section to ask about, or null), ready (the four required sections filled: enough for Picodev to start), filename and pdf (base 64) with pdf=true}.

NameTypeReqDescription
figures–––
languagestring––
pdfboolean––
sections–––
title–––

No output schema declared.

No examples provided.

Install

How do I install the Picodev Lab MCP server?

Picodev Lab is a hosted endpoint at https://lab.picodev.fr/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · lab.picodev.fr

# add to Claude Code
claude mcp add --transport http picodev-sas-picodev-lab 'https://lab.picodev.fr/mcp'
Common questions

What is the Picodev Lab MCP server?

Picodev Lab is an MCP server listed in the public MCP registry as io.github.PICODEV-SAS/picodev-lab. Arduino benches simulated in the browser: sessions, sketch push, simulation, tests, challenges. This page covers its hosted endpoint (https://lab.picodev.fr/mcp).

Is the Picodev Lab MCP server safe to use?

Picodev Lab scores 63 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Picodev Lab MCP server expose?

Picodev Lab exposes 21 tools: list_setups, open_session, push_to_editor, push_program, read_simulation, and 16 more. Their descriptions and schemas cost roughly 2,906 tokens of context every time the server is loaded.

Does the Picodev Lab MCP server require authentication?

No. We connected to Picodev Lab without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Picodev Lab MCP server still maintained?

Picodev Lab is still listed as active in the MCP registry. We last reached this channel on 22 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.