MCP-CANBLOCK
Talk to Your Car Using AI
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
🔌 Virtual CAN + MCP Server
Peykan is a Model Context Protocol (MCP) server that exposes automotive CAN bus, OBD-II (SAE J1979), UDS, and SAE J1939 diagnostic data to LLMs and AI agents. It ships a built-in virtual CAN bus with an ECU simulator, decodes traffic via a DBC database (cantools), and serves MCP tools over SSE or streamable-HTTP. No CAN hardware, adapter, or vehicle is required by default; optional SocketCAN/vCAN on Linux.
Use it to let an LLM read live CAN frames, decode signals, run OBD-II PID and UDS diagnostic requests, inspect J1939 PGNs/SPNs and DM1 trouble codes, and drive fault-injection scenarios against a simulated vehicle, analyse recorded CAN logs, or work with real hardware behind a read-only-by-default safety policy.
Try it in your browser: peykan.ai gives you a private simulated car and an AI agent to talk to it, no install needed.
Keywords: MCP server, Model Context Protocol, CAN bus, CANbus, OBD-II, OBD2, on-board diagnostics, SAE J1939, UDS, ECU simulator, vehicle diagnostics, automotive, DBC, python-can, cantools, SocketCAN, LLM tools, AI agents.
✨ Highlights
- MCP server for CAN/OBD/UD
27edbba1add1OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add peykan-web -- npx -y [email protected]
{
"mcpServers": {
"peykan-web": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (22)
16 read · 4 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
activate_fault_scenario | destructive | Activate a fault-injection scenario in the simulator, or clear the |
analyze_can_log | read | Summarise a recorded CAN log (.asc, .blf, .trc, candump .log, .csv): |
decode_can_frame | read | Decode a single CAN frame |
decode_j1939_frame | read | Decode a 29-bit J1939 frame: split the extended ID (integer or hex |
filter_frames | read | Frames from the last `duration_s` seconds matching the given |
get_log_signal | read | One decoded signal |
get_transmit_log | read | The transmit policy (is sending allowed on this interface, are |
get_vehicle_snapshot | read | The last known value of every signal seen so far (one entry per |
list_can_logs | read | CAN log files available to analyze (in PEYKAN_LOG_DIR), plus the |
list_j1939_pgns | read | The catalog of J1939 Parameter Group Numbers this server can decode |
monitor_signal | read | Timestamped samples of one decoded signal over the last `duration_s` |
read_can_frames | read | Return every raw frame seen in the last `duration_s` seconds. |
read_j1939_dtcs | read | Read the most recent J1939 DM1 (active diagnostic trouble codes) |
read_vin | read | Read the Vehicle Identification Number via OBD-II Mode 09 PID 02 |
replay_can_log | read | Replay a recorded log onto the bus with its original timing |
request_j1939_pgn | write | Send a J1939 Request PGN (0xEA00) asking every ECU to transmit |
send_diagnostic_request | write | Send a UDS-style diagnostic request (see vehicle.dbc |
send_obd_request | write | Send a standard OBD-II (SAE J1979) request (e.g. service=1, pid= |
stop_log_replay | write | Stop the log replay started by replay_can_log (and report how far it got). |
uds_clear_dtcs | destructive | UDS ClearDiagnosticInformation (0x14) for all DTC groups. Changes |
uds_read_data | read | UDS ReadDataByIdentifier (0x22) over ISO-TP. `dids` are data |
uds_read_dtcs | read | UDS ReadDTCInformation (0x19, reportDTCByStatusMask): stored DTCs |
Trust audit
BLOCKgrade F · trust 58/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (17)
exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;
exec(cmd: string[], options?: ContainerExecOptions): Promise<ExecProcess>;
exec(query: string): Promise<D1ExecResult>;
return random.choice(list(sig.choices.keys()))
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=5 CMD curl -fs http://127.0.0.1:6278/healthz || exit 1
origins = ["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"]
VEHICLE_DEV_URL=http://127.0.0.1:6401
activate_fault_scenario, uds_clear_dtcs
streamable-http
.dev.vars.example
.oxfmtrc.json
.oxlintrc.json
.prettierignore
escape = _call(app, "analyze_can_log", {"path": "../../etc/passwd.asc"})atob(data: string): string;
declare function atob(data: string): string;
@cfworker/json-schema, @cloudflare/ai-chat, @cloudflare/containers, @modelcontextprotocol/sdk, @phosphor-icons/react, agents, ai, react
Gates applied: no_behavioural_pass.
27edbba1add1full audit observations/trust-audit/mcp-server/farzadnadiri__mcp-can.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 27edbba1add1 | BLOCK | F | 58 | first audit |
Questions
What is the MCP-CAN MCP server?
Talk to Your Car Using AI
What tools does MCP-CAN expose?
22 in total: 16 read-only, 4 that write, and 2 that can delete or overwrite (activate_fault_scenario, uds_clear_dtcs). Every one is listed on this page with its risk.
Is MCP-CAN safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (58/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does MCP-CAN need?
No credential environment variables were found in its source, so it appears to need none.
How does MCP-CAN run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as peykan-web at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (27edbba1add1), read on 2026-10-10. The repository is watched and re-audited when it changes.