open-brxBLOCK
Open-source platform for Battle Company BRX laser taggers: hosted game modes, live scoring, custom weapons and a laptop Mission Control on stock guns over Bluetooth LE. Also the source of The Ultimate BRX Manual.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An open-source (MIT) platform that turns Battle Company BRX laser taggers into one connected laser tag system: hosted game modes, live scoring, custom weapons, objectives and a laptop Mission Control, on stock guns with stock firmware. It is a self-hosted alternative to Battle Company's Edge software: no subscription, no location lock, and it is designed for large fields with no venue Wi-Fi. The same repo is the source of two public doors built from one static-site generator: the platform landing/docs (docs/platform/) at , and The Ultimate BRX Manual, the public reference for the tagger and headset, built from docs/manual/ and served at .
Today a laptop runs a full scored Team Deathmatch on real taggers over Bluetooth LE (Tier 0), and the per-player phone app (the BRX Combat HUD) plus the Mission Control console have run two whole multi-phone matches outdoors on real hardware (2026-08-30 and 2026-09-01). The phone-node path is what lifts the laptop's BLE-range limit.
Start here: `docs/README.md`, the documentation index. It points to docs/architecture-topology.md (how it is wired and what is proven), the manual, the spec of record (docs/spec/), the ADRs and the open-work list.
Credit: Protocol discovery and the tagger-rider ESP32 concept originate with [LaserTagMods](https://github.com/LaserTagMods) (JEDGE / JBOX projects). This project is a fresh, independent implementation, no code copied, but it stands on that discovery work.
Prime directives
- Stock BRX firmware is never modified. All control is via the documented Bluetooth serial protocol
(protocol/brx-protocol.md). Power-cycling always restores a tagger; Battle Company's USB updater is the factory-restore path.
- Store-and-forward everywhere: every node buffers timestamped events locally and syncs when in c
651865fd206dOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mc --env BRX_MC_TOKEN=${BRX_MC_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"mc": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"BRX_MC_TOKEN": "${BRX_MC_TOKEN}"
}
}
}
}Exposed tools (15)
10 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
connect | write | Open a persistent BLE session to a tagger and start buffering its |
diagnostics | read | One-shot BLE health sweep of one tagger: firmware version ($VERSION), |
diff_captures | read | Token-level diff of two session captures (paths or bare labels). Use to |
disconnect | read | Close the BLE session for an alias. |
fleet_status | read | Armory dashboard: scan for BRX taggers (or use the given addresses), |
get_events | read | Drain buffered tagger→host messages newer than since_seq. Each event: |
identify | write | Connect briefly to a BLE address, send $PING,*, and report: reachable?, |
list_connections | read | List open sessions: alias, address, connected, buffer depth, last-seen. |
panic | destructive | Return a tagger to a sane state: sends $CLEAR,* then $SP,99,*. |
parse_query_dump | read | Parse a Teensy USB `QUERY` console dump (paste the text) into a device |
scan | read | BLE scan for nearby devices. BRX Gen2/3 taggers advertise the Nordic |
send | write | Send one raw framed command (e.g. |
send_batch | write | Send an ordered command sequence with pacing between frames (config |
session_log | read | Timestamped capture of ALL traffic both directions to a JSONL file. |
wait_for | read | Block until a tagger message starting with prefix (e.g. |
Trust audit
BLOCKgrade F · trust 36/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (13 observation(s))
- Shell
- declared (8 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
const dsGeom = pg => pg.evaluate(src => { const dsUncovered = () => eval(src);top: eval(src) }), dsUncoveredSrc);
const ratio = eval(src)();
const r = await pg.evaluate(src => { const ratio = eval(src)();r2.contrast = (pg, sel) => pg.evaluate(([src, sel]) => { const ratio = eval(src)(); return [...document.querySelectorAll(sel)].map(e => ({ text: e.textContent.trim().slice(0, 30), cr: Math.round(ratiothis.verify = false; /** @type {string|null} */ this._challenge = null;connect({ url, mdns, qr, pub, secret, trusted = true, verify = false, firstContact = false } = {}) {this.verify = false; this._challenge = null; this.trusted = true;
2026-08-23-connect-attempts-no-headset.btsnoop
2026-08-23-gset-respawn05.btsnoop
2026-08-23-gset-respawn15.btsnoop
2026-08-23-gset-respawn30.btsnoop
2026-08-23-no-headset-instant-disconnect.btsnoop
importlib.import_module(f"{__name__}.{_m.name}")mod = importlib.import_module(stem)
value = getattr(importlib.import_module(modname), name)
return random.Random(":".join(str(k) for k in (seed,) + key))print(f" operator token: {token} (open the URL above — it carries the token; --no-auth to disable)", flush=True)import { encodeUuid, advertChangeReason, advertNeedsSnapshot, configGameByte } from './beacon.js';import { Presence, stationView, AdvertGate, configGameByte } from './beacon.js'; // utility items (docs/spec/utility.md)tryImport('beacon', () => import('brx-beacon').then(m => ({ v: m.BrxBeacon }))), // our advertise plugin (app/plugins/brx-beacon)'--- ble beacon scan ---',
const playerAdvertGate = new AdvertGate(); // polish H1: whole-UUID compare; a start counts only once it worked (beacon.js)
panic
.assetsignore
Gates applied: no_behavioural_pass.
651865fd206dfull audit observations/trust-audit/mcp-server/tony99nyr__open-brx.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 651865fd206d | BLOCK | F | 36 | first audit |
Questions
What is the open-brx MCP server?
Open-source platform for Battle Company BRX laser taggers: hosted game modes, live scoring, custom weapons and a laptop Mission Control on stock guns over Bluetooth LE. Also the source of The Ultimate BRX Manual.
What tools does open-brx expose?
15 in total: 10 read-only, 4 that write, and 1 that can delete or overwrite (panic). Every one is listed on this page with its risk.
Is open-brx safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (36/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does open-brx need?
It reads BRX_MC_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (651865fd206d), read on 2026-10-11. The repository is watched and re-audited when it changes.