iotaudit 0.1.0__tar.gz

iotaudit-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: pip install -e ".[dev,mcp]"
+      - run: ruff check src tests
+      - run: pytest -q
+      - name: Build wheel and verify install
+        run: |
+          pip install build
+          python -m build
+          python -m venv /tmp/iotaudit-ci
+          /tmp/iotaudit-ci/bin/pip install dist/*.whl
+          /tmp/iotaudit-ci/bin/python scripts/verify_wheel_install.py

iotaudit-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,50 @@
+name: Publish to PyPI
+
+# Publishes to PyPI via Trusted Publishing (OIDC) when a GitHub Release is published.
+# No API tokens are stored. Set up the PyPI "pending publisher" once:
+#   PyPI project 'iotaudit' -> owner emirmrkaljevic, repo iotaudit,
+#   workflow 'publish.yml', environment 'pypi'. Requires maintainer 2FA/approval to run.
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist and wheel
+        run: |
+          pip install build
+          python -m build
+      - name: Verify the built wheel installs and runs
+        run: |
+          python -m venv /tmp/verify
+          /tmp/verify/bin/pip install dist/*.whl
+          /tmp/verify/bin/python scripts/verify_wheel_install.py
+          /tmp/verify/bin/iotaudit --version
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi            # add a required reviewer here to gate releases
+    permissions:
+      id-token: write            # OIDC token for Trusted Publishing
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

iotaudit-0.1.0/.gitignore

@@ -0,0 +1,10 @@
+__pycache__/
+*.egg-info/
+.venv/
+dist/
+build/
+*.pcap
+*.pcapng
+iotaudit-report*.html
+.pytest_cache/
+.ruff_cache/

iotaudit-0.1.0/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+All notable changes to iotaudit are documented here. This project follows
+[Semantic Versioning](https://semver.org/).
+
+## [0.1.0] - 2026-10-17
+
+First tagged release. iotaudit audits **your own** smart-home devices: it watches what each one
+does on the network and gives it an A–F grade with a one-page HTML report.
+
+### Added
+- **Capture modes**: hotspot (Linux/NetworkManager), ARP mode (macOS + Linux, spoofs one owned
+  device and restores ARP tables + IP-forwarding on exit), and offline pcap analysis.
+- **`--watch-lan`**: also watch device ↔ LAN-peer unicast so phone P2P video is visible.
+- **IPv6 / NDP**: capture filter now covers the device's IPv6 and ICMPv6 neighbor discovery;
+  IPv6 flows, link-local bytes and NDP messages are counted and shown in the report.
+  Experimental `--ipv6-ndp` additionally NDP-spoofs IPv6 link-local pairs.
+- **Honest "media not observed" note**: when a device sets up a P2P session (STUN/TURN) but no
+  sustained media stream is captured on the LAN, over IPv6 or to the cloud, the report says so
+  plainly — the video most likely went straight to your phone over Wi-Fi and was not observed.
+- **Special-use / bogon peers**: addresses like `192.0.0.0/24` are no longer mistaken for real
+  Wi-Fi devices; they are flagged as placeholder / DS-Lite / P2P-signalling artifacts.
+- **Analysis**: per-destination org/country (bundled DB-IP + ip2asn-lite, offline), plaintext
+  vs TLS vs custom-encryption (entropy) vs STUN, trackers, device profiles (YAML), time-series
+  with burst detection, idle-upload check, `nmap` open-port scan with risk notes.
+- **MCP server** (`iotaudit-mcp`) and a consent gate (own-network only).
+- `iotaudit.review.review_report()` to re-check a saved JSON report for the not-observed verdict.
+
+### Notes
+- Two Wi-Fi clients can exchange media without it passing through your computer (client
+  isolation), so "not observed" never means "did not happen". Capture at the router for ground
+  truth. iotaudit reports indicators from observed traffic, not proof of vendor wrongdoing.

iotaudit-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Emir Mrkaljevic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

iotaudit-0.1.0/PKG-INFO

@@ -0,0 +1,143 @@
+Metadata-Version: 2.5
+Name: iotaudit
+Version: 0.1.0
+Summary: Audit your own smart-home devices: who they talk to, plaintext vs TLS, open ports, and an A-F grade with an HTML report.
+Project-URL: Homepage, https://github.com/emirmrkaljevic/iotaudit
+Project-URL: Issues, https://github.com/emirmrkaljevic/iotaudit/issues
+Author: Emir Mrkaljevic
+License-Expression: MIT
+License-File: LICENSE
+Keywords: audit,iot,mcp,network,privacy,security,smart-home
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Networking :: Monitoring
+Requires-Python: >=3.10
+Requires-Dist: jinja2>=3.1
+Requires-Dist: maxminddb>=2.4
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: scapy>=2.5
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == 'dev'
+Requires-Dist: ruff>=0.5; extra == 'dev'
+Provides-Extra: geo
+Requires-Dist: maxminddb>=2.4; extra == 'geo'
+Provides-Extra: mcp
+Requires-Dist: mcp>=1.2; extra == 'mcp'
+Description-Content-Type: text/markdown
+
+# iotaudit
+
+[![CI](https://github.com/emirmrkaljevic/iotaudit/actions/workflows/ci.yml/badge.svg)](https://github.com/emirmrkaljevic/iotaudit/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue.svg)](https://www.python.org/)
+
+**Is your smart pet feeder, camera or plug safe?** `iotaudit` watches what your own IoT devices
+do on the network and gives each one an **A–F grade** with a one-page HTML report. Everything
+runs locally: no account, no telemetry, no cloud.
+
+It answers the questions you actually have about a cheap smart device:
+
+- **Who does it talk to?** Domains (DNS + TLS SNI + HTTP Host), IPs, country, organisation.
+- **Is it encrypted?** Plaintext HTTP, unencrypted TCP, old TLS, or "custom" high-entropy protocols.
+- **What ports are open?** Optional `nmap` scan with risk notes (telnet, RTSP, UPnP, ADB, …).
+- **Does it phone home while idle?** Idle-upload check and a traffic timeline with bursts.
+- **Where did the video go?** LAN peer (phone P2P) vs cloud vs STUN/TURN — and an honest note
+  when a stream was set up but never actually passed through your computer.
+
+> Status: **0.1.0**. Hotspot + ARP capture, pcap analysis, IPv6/NDP, grading, HTML report and the
+> MCP server work. CVE lookup and UPnP checks are on the [roadmap](ROADMAP.md).
+
+## Sample report
+
+A report for a Tuya-associated pet feeder (anonymized). It talks to US clouds over TLS/MQTT, keeps
+**telnet open**, uses **hardcoded 8.8.8.8**, sets up a **P2P video session that was not observed**
+on this run, and shows an odd **special-use "LAN peer"** that is not a real device:
+
+![Sample iotaudit report](docs/sample-report.png)
+
+Open [`docs/sample-report.html`](docs/sample-report.html) in a browser for the full version.
+
+## Install
+
+```bash
+# from source (PyPI release prepared via Trusted Publishing, not yet live)
+pipx install "git+https://github.com/emirmrkaljevic/iotaudit"
+# or, with the MCP server + geo extras:
+pip install "iotaudit[mcp] @ git+https://github.com/emirmrkaljevic/iotaudit"
+```
+
+Capturing needs root (`sudo`). The optional port scan needs `nmap`.
+
+## Quickstart
+
+### macOS
+
+```bash
+brew install nmap
+pipx install "git+https://github.com/emirmrkaljevic/iotaudit"
+
+# Just run it: pick your device from the list, then leave it alone (or use its app).
+sudo "$(which iotaudit)" capture --mode arp --i-own-this-network
+```
+
+iotaudit scans your LAN, lists devices (IP, MAC, vendor; Tuya/Espressif flagged as likely IoT),
+and lets you pick one. It then ARP-spoofs **only that device** so its traffic flows through your
+Mac, captures for up to an hour (Ctrl+C stops early and still writes the report), and restores the
+ARP tables and IP-forwarding on exit. With a device picked, `--watch-lan` (phone P2P) and the
+IPv6/NDP filter are on by default.
+
+### Linux
+
+```bash
+sudo apt install nmap
+pipx install "git+https://github.com/emirmrkaljevic/iotaudit"
+
+# Same ARP flow as macOS:
+sudo "$(which iotaudit)" capture --mode arp --i-own-this-network
+
+# Or hotspot mode: your laptop becomes an AP; re-pair the device to it (needs NetworkManager).
+sudo iotaudit capture --mode hotspot --iface wlan0 --ssid iotaudit --password 'choose-a-pass' \
+     --device 10.42.0.50 --scan --out feeder.html
+```
+
+### Analyse an existing capture
+
+```bash
+# from Wireshark, your router, or OpenWrt `tcpdump -w`
+iotaudit analyze capture.pcap --device 192.168.1.50 --json results.json --out report.html
+```
+
+The report lands at `./iotaudit-report.html` with a matching `.json` next to it.
+
+## IPv6, P2P video, and "not observed"
+
+Live video from a camera or feeder often does **not** go to the cloud — it goes **directly to your
+phone** over the local Wi-Fi (P2P), after a short STUN/TURN handshake. iotaudit tries hard to see
+that stream (`--watch-lan` spoofs device↔phone, and the capture filter now includes IPv6 and NDP),
+but two Wi-Fi clients can talk **without their traffic ever passing through your computer** —
+because of Access-Point client isolation, a phone ignoring the spoof, or the stream riding IPv6
+link-local (`fe80::`). When that happens the report says so honestly:
+
+> *Live video set up but not observed here* — the session was negotiated (STUN) but no sustained
+> stream was captured; it most likely went straight to your phone. **Not observed ≠ not happening.**
+
+For ground truth, capture at the router instead. `--ipv6-ndp` (experimental) also NDP-spoofs IPv6
+link-local pairs.
+
+## MCP server
+
+```bash
+iotaudit-mcp        # exposes audit tools to a local assistant ("audit my pet feeder")
+```
+
+## Consent & scope
+
+iotaudit only audits **your own** network. It refuses non-private targets and requires
+`--i-own-this-network` (or an interactive `I OWN THIS NETWORK` confirmation). ARP/NDP spoofing on a
+network you do not own may be illegal.
+
+Findings are **indicators based on observed traffic, not proof** of wrongdoing by any vendor.
+IP geolocation by [DB-IP](https://db-ip.com). MIT licensed.

iotaudit-0.1.0/README.md

@@ -0,0 +1,113 @@
+# iotaudit
+
+[![CI](https://github.com/emirmrkaljevic/iotaudit/actions/workflows/ci.yml/badge.svg)](https://github.com/emirmrkaljevic/iotaudit/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue.svg)](https://www.python.org/)
+
+**Is your smart pet feeder, camera or plug safe?** `iotaudit` watches what your own IoT devices
+do on the network and gives each one an **A–F grade** with a one-page HTML report. Everything
+runs locally: no account, no telemetry, no cloud.
+
+It answers the questions you actually have about a cheap smart device:
+
+- **Who does it talk to?** Domains (DNS + TLS SNI + HTTP Host), IPs, country, organisation.
+- **Is it encrypted?** Plaintext HTTP, unencrypted TCP, old TLS, or "custom" high-entropy protocols.
+- **What ports are open?** Optional `nmap` scan with risk notes (telnet, RTSP, UPnP, ADB, …).
+- **Does it phone home while idle?** Idle-upload check and a traffic timeline with bursts.
+- **Where did the video go?** LAN peer (phone P2P) vs cloud vs STUN/TURN — and an honest note
+  when a stream was set up but never actually passed through your computer.
+
+> Status: **0.1.0**. Hotspot + ARP capture, pcap analysis, IPv6/NDP, grading, HTML report and the
+> MCP server work. CVE lookup and UPnP checks are on the [roadmap](ROADMAP.md).
+
+## Sample report
+
+A report for a Tuya-associated pet feeder (anonymized). It talks to US clouds over TLS/MQTT, keeps
+**telnet open**, uses **hardcoded 8.8.8.8**, sets up a **P2P video session that was not observed**
+on this run, and shows an odd **special-use "LAN peer"** that is not a real device:
+
+![Sample iotaudit report](docs/sample-report.png)
+
+Open [`docs/sample-report.html`](docs/sample-report.html) in a browser for the full version.
+
+## Install
+
+```bash
+# from source (PyPI release prepared via Trusted Publishing, not yet live)
+pipx install "git+https://github.com/emirmrkaljevic/iotaudit"
+# or, with the MCP server + geo extras:
+pip install "iotaudit[mcp] @ git+https://github.com/emirmrkaljevic/iotaudit"
+```
+
+Capturing needs root (`sudo`). The optional port scan needs `nmap`.
+
+## Quickstart
+
+### macOS
+
+```bash
+brew install nmap
+pipx install "git+https://github.com/emirmrkaljevic/iotaudit"
+
+# Just run it: pick your device from the list, then leave it alone (or use its app).
+sudo "$(which iotaudit)" capture --mode arp --i-own-this-network
+```
+
+iotaudit scans your LAN, lists devices (IP, MAC, vendor; Tuya/Espressif flagged as likely IoT),
+and lets you pick one. It then ARP-spoofs **only that device** so its traffic flows through your
+Mac, captures for up to an hour (Ctrl+C stops early and still writes the report), and restores the
+ARP tables and IP-forwarding on exit. With a device picked, `--watch-lan` (phone P2P) and the
+IPv6/NDP filter are on by default.
+
+### Linux
+
+```bash
+sudo apt install nmap
+pipx install "git+https://github.com/emirmrkaljevic/iotaudit"
+
+# Same ARP flow as macOS:
+sudo "$(which iotaudit)" capture --mode arp --i-own-this-network
+
+# Or hotspot mode: your laptop becomes an AP; re-pair the device to it (needs NetworkManager).
+sudo iotaudit capture --mode hotspot --iface wlan0 --ssid iotaudit --password 'choose-a-pass' \
+     --device 10.42.0.50 --scan --out feeder.html
+```
+
+### Analyse an existing capture
+
+```bash
+# from Wireshark, your router, or OpenWrt `tcpdump -w`
+iotaudit analyze capture.pcap --device 192.168.1.50 --json results.json --out report.html
+```
+
+The report lands at `./iotaudit-report.html` with a matching `.json` next to it.
+
+## IPv6, P2P video, and "not observed"
+
+Live video from a camera or feeder often does **not** go to the cloud — it goes **directly to your
+phone** over the local Wi-Fi (P2P), after a short STUN/TURN handshake. iotaudit tries hard to see
+that stream (`--watch-lan` spoofs device↔phone, and the capture filter now includes IPv6 and NDP),
+but two Wi-Fi clients can talk **without their traffic ever passing through your computer** —
+because of Access-Point client isolation, a phone ignoring the spoof, or the stream riding IPv6
+link-local (`fe80::`). When that happens the report says so honestly:
+
+> *Live video set up but not observed here* — the session was negotiated (STUN) but no sustained
+> stream was captured; it most likely went straight to your phone. **Not observed ≠ not happening.**
+
+For ground truth, capture at the router instead. `--ipv6-ndp` (experimental) also NDP-spoofs IPv6
+link-local pairs.
+
+## MCP server
+
+```bash
+iotaudit-mcp        # exposes audit tools to a local assistant ("audit my pet feeder")
+```
+
+## Consent & scope
+
+iotaudit only audits **your own** network. It refuses non-private targets and requires
+`--i-own-this-network` (or an interactive `I OWN THIS NETWORK` confirmation). ARP/NDP spoofing on a
+network you do not own may be illegal.
+
+Findings are **indicators based on observed traffic, not proof** of wrongdoing by any vendor.
+IP geolocation by [DB-IP](https://db-ip.com). MIT licensed.

iotaudit-0.1.0/ROADMAP.md

@@ -0,0 +1,108 @@
+# iotaudit roadmap
+
+iotaudit aims to be an all-rounder audit for **any** smart device you own: cameras, pet feeders,
+plugs, bulbs, TVs, speakers, doorbells, robot vacuums, baby monitors, hubs. The goal is a clear,
+plain-English verdict per device, built only from what can be observed on your own network.
+
+**Principles**
+
+- Local-only. No telemetry, no cloud account, no uploads.
+- Own networks and own devices only; every active step is behind an explicit consent prompt.
+- Facts vs inferences: observed facts are marked `certain`; anything inferred from traffic
+  patterns carries a confidence level (`low` / `medium` / `high`) and is worded as an
+  *indicator* ("looks like video upload"), never as a certainty or an accusation.
+
+## Data model (in place since 0.0.x)
+
+Every result is a `Finding` with `category`, `severity`, `title`, `detail`, `confidence` and an
+`evidence` dict (byte counts, packet-size histograms, timestamps, matched rules). Each destination
+can carry a `TrafficClass` (`video`, `audio`, `audio+video`, `telemetry`, `firmware-download`,
+`unknown`) with confidence and a `while_app_idle` flag. New analysers only add findings; grading
+and reports pick them up automatically. Grading weights inferred findings by confidence (v0.2).
+
+## v0.1.0 – MVP (target: within a few days)
+
+Done in the first commit:
+- [x] Hotspot mode (laptop becomes the access point via NetworkManager) and pcap import
+- [x] DNS / TLS SNI / HTTP Host extraction, per-device destinations
+- [x] Country (local GeoLite2 / DB-IP Lite `.mmdb`), organisation, tracker tagging
+- [x] Plaintext vs TLS detection, outdated TLS 1.0/1.1, QUIC
+- [x] nmap open-port scan with risk notes
+- [x] Device profile library (YAML), A–F grade, HTML report, JSON output
+- [x] MCP server (`analyze_pcap`, `capture`, `scan_device`), consent gate, CI
+
+Remaining for v0.1.0:
+- [ ] Real-device validation (Tuya-based pet feeder first) and profile tuning
+- [ ] Hotspot capture hardening (auto-detect Wi-Fi interface, client list, IPv6)
+- [ ] Bundled download helper for the free country database
+- [ ] Report polish: per-device plain-English summary paragraph, destination country summary
+- [ ] PyPI release, MCP registry listing
+
+## v0.2 – "What is it sending?" (traffic classification)
+
+Plain-English per-device findings such as:
+> *Your camera sends data to `xyz.example.com` (Germany, Amazon AWS). Pattern looks like
+> **video** (sustained ~1.2 Mbit/s upload, large packets, steady timing) – confidence: medium.
+> This also happened while the app was closed.*
+
+- Per-destination time series: bitrate up/down, packet-size distribution, inter-arrival timing
+- Heuristics: video (sustained high upload, large near-MTU packets, keyframe bursts),
+  audio (steady low bitrate ~20–130 kbit/s, small regular packets), telemetry (small periodic
+  heartbeats), firmware download (large one-off downstream burst)
+- Protocol hints: RTSP/RTP, WebRTC (STUN/TURN, DTLS-SRTP), P2P relay services, MQTT
+- "Upload while app idle": user marks idle periods (CLI prompt / web UI button) or uses the
+  phone-traffic timeline (below) to know when the app was open
+- Confidence scoring, labelled test captures, documented false-positive cases
+- Grading weighted by confidence
+
+## v0.3 – Phone & web UI
+
+- **Web UI** served by the laptop or a Raspberry Pi: start/stop captures, mark "app open/closed",
+  view reports from a phone browser on the same network
+- **Android**: capture the companion app's own traffic with a local VPN-based capture
+  (PCAPdroid-style: `VpnService`, no root). Export pcap or stream to iotaudit; first step is
+  documenting how to use PCAPdroid itself, then an optional companion app
+- **iOS (honest limits)**: no packet capture on a stock iPhone. Options:
+  - capture on the laptop/Pi hotspot (the iPhone joins it) – sees destinations, not app identity
+  - `rvictl` remote virtual interface from a Mac over USB (macOS + Xcode tools)
+  - a local VPN app (`NEPacketTunnelProvider`) would need a paid Apple developer account and
+    App Store review – out of scope for now
+  - TLS contents of pinned apps stay hidden; we report metadata only
+- Correlate phone-app traffic with device traffic (app open → device starts streaming)
+
+## v0.4 – Security checks
+
+- CVEs per vendor/model/firmware: banner + profile → OSV / NVD / CISA KEV (cached locally)
+- Default credentials: short vendor-default list, only on a user-confirmed own device, rate-limited,
+  never brute force
+- UPnP IGD: list port forwards on your router and attribute them to devices
+- DNS bypass: hardcoded resolvers (8.8.8.8 etc.), DNS-over-HTTPS / DoT endpoints
+- Device scanning your LAN (ARP sweeps, port probes from the IoT device)
+- Firmware update checks: is the device phoning a firmware endpoint, version vs latest known
+- Insecure local services: telnet, ADB, unauthenticated RTSP/ONVIF, open MQTT
+
+## v0.5 – Continuous mode
+
+- Raspberry Pi image / OpenWrt package, scheduled reports
+- Alerts: new/unexpected device on the network, new destination country, idle upload,
+  new open port
+- ARP mode (own network only, extra consent) for devices that cannot be moved to a hotspot
+- PDF export
+
+## Verdict
+
+Each device gets a one-line safety verdict on top of the A–F grade, e.g.
+*"B – Encrypted cloud traffic to the vendor in the EU; one analytics tracker; no risky ports."*
+The verdict separates observed facts from inferred indicators.
+
+## Device coverage
+
+Community YAML profiles per brand/model: expected domains, ports, protocols, known CVEs, notes.
+Priority categories: cameras & doorbells, pet feeders, plugs & bulbs (Tuya, Xiaomi, Shelly),
+smart TVs, speakers, robot vacuums, baby monitors.
+
+## Distribution
+
+PyPI, MCP registries (official registry, Glama, Smithery, mcp.so), awesome lists
+(awesome-mcp-servers, awesome-iot, awesome-privacy, awesome-selfhosted), DEV.to write-ups,
+r/homelab, r/privacy, r/selfhosted.

iotaudit-0.1.0/docs/sample-report.html

@@ -0,0 +1,128 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>iotaudit report</title>
+<style>
+body{font-family:system-ui,sans-serif;max-width:960px;margin:2rem auto;padding:0 1rem;color:#1d1d1f}
+h1{margin-bottom:.2rem}.muted{color:#666;font-size:.9rem}
+.card{border:1px solid #ddd;border-radius:10px;padding:1rem 1.2rem;margin:1.2rem 0}
+.summary{background:#f6f8fa;border-radius:8px;padding:.8rem 1rem;margin:.8rem 0}
+.grade{float:right;font-size:2.6rem;font-weight:700;width:3.6rem;height:3.6rem;line-height:3.6rem;
+text-align:center;border-radius:10px;color:#fff}
+.gA{background:#1a7f37}.gB{background:#4c9a2a}.gC{background:#c69026}.gD{background:#d4691c}
+.gE{background:#c2410c}.gF{background:#b91c1c}
+table{border-collapse:collapse;width:100%;font-size:.9rem}td,th{border-bottom:1px solid #eee;
+padding:.35rem;text-align:left;vertical-align:top}
+.high{color:#b91c1c;font-weight:600}.medium{color:#c2410c}.low{color:#666}
+.tag{display:inline-block;padding:0 .4rem;border-radius:4px;font-size:.8rem;background:#eee}
+.chart{display:flex;align-items:flex-end;gap:2px;height:80px;margin:0.6rem 0}
+.chart .bar{flex:1;background:#4c9a2a;min-width:2px;border-radius:2px 2px 0 0}
+.chart .bar.active{background:#c2410c}
+.chart .bar.idle{background:#a8c5a0}
+</style></head><body>
+<h1>iotaudit report</h1>
+<p class="muted">Generated 2026-10-17 10:16 &middot; iotaudit 0.1.0 &middot; source: arp:en0 (anonymized sample) &middot; capture 900s</p>
+<p class="muted">Findings are indicators based on observed traffic, not proof of wrongdoing by any vendor.
+All data was processed locally. IP Geolocation by DB-IP (https://db-ip.com).</p>
+
+<div class="card">
+  <div class="grade gD">D</div>
+  <h2>192.168.0.50</h2>
+  <p class="muted">MAC 14:5d:34:00:00:01 &middot; SHENZHEN BILIAN ELECTRONIC
+  &middot; profile: iotbing.com cloud device (Tuya-associated pet feeder / camera) &middot; score 55/100</p>
+  <div class="summary"><b>Summary.</b> Device 192.168.0.50 (iotbing.com cloud device (Tuya-associated pet feeder / camera)). Grade D (55/100). Talked to: Amazon AWS, Google, OVH, iotbing (Tuya-associated cloud). Server countries observed: US. Telnet (port 23) is open on the LAN — change defaults / block it. Uses public DNS directly (bypasses your router). Used STUN/TURN (typical for P2P video setup). A P2P video session was set up but no media stream was captured here — it likely went straight to your phone over Wi-Fi (not observed). Uploads while app idle: insufficient data. 1 destination(s) look like custom/non-TLS encryption (unverified).</div>
+  <p><b>Uploads while app idle:</b> insufficient data</p>
+  <p class="muted"><b>IPv6:</b> 1 flow(s),
+  168 bytes (168 on link-local fe80::); NDP messages:
+  2
+  (NS 1, NA 1), neighbours 1.</p>
+  
+  
+  <h3>Findings</h3>
+  <ul>
+    <li><span class="medium">[medium]</span> <b>Non-standard encryption (custom protocol), unverified</b> &mdash; Traffic to 15.204.79.232 (ports [1443]) looks encrypted by entropy but is not TLS. High entropy (8.00) without TLS handshake — non-standard encryption (custom protocol), unverified. <span class="tag">confidence: medium</span></li>
+  
+    <li><span class="info">[info]</span> <b>STUN/TURN (P2P video setup)</b> &mdash; STUN/TURN to 15.204.72.48 (OVH) — typical for peer-to-peer video/audio; the media may stay on the LAN or go via a relay. <span class="tag">confidence: high</span></li>
+  
+    <li><span class="medium">[medium]</span> <b>Hardcoded public DNS (bypasses router)</b> &mdash; Device sent DNS to 8.8.8.8, bypassing your router's DNS. Queries may leave your network even if you run Pi-hole.</li>
+  
+    <li><span class="high">[high]</span> <b>Open port 23/tcp (telnet)</b> &mdash; Telnet exposes an unencrypted login shell.</li>
+  
+    <li><span class="info">[info]</span> <b>Cloud servers outside the local network</b> &mdash; Observed destination countries: US. This is a location note about servers the device contacted, not a judgement about where you live.</li>
+  
+    <li><span class="info">[info]</span> <b>Odd "LAN peer" in special-use address space</b> &mdash; Saw traffic to/from 192.0.0.6 (3360B), which is reserved / protocol-assignment space (e.g. 192.0.0.0/24), not a real device on your Wi-Fi. It is almost always a placeholder/DS-Lite address or an address carried inside P2P/STUN signalling — not a second hidden gadget. <span class="tag">confidence: high</span></li>
+  
+    <li><span class="info">[info]</span> <b>LAN discovery broadcasts</b> &mdash; 48000 bytes of broadcast/multicast (e.g. Tuya UDP 6667) — not media.</li>
+  
+    <li><span class="info">[info]</span> <b>Live video set up but not observed here</b> &mdash; The device negotiated a peer-to-peer session (STUN/TURN) but no sustained video/audio stream was captured on this run. It most likely went directly between the device and your phone over Wi-Fi (P2P) and never passed through this computer: two Wi-Fi clients can talk without their traffic crossing your Mac, and spoofed ARP/NDP may not redirect it (client isolation, or the phone ignoring the spoof). IPv6 was active (NDP messages: 2, IPv6 flows seen: 1), so the stream may be riding IPv6 link-local between the two devices. Not observed does not mean it did not happen — re-run with the app streaming, or capture at the router. <span class="tag">confidence: high</span></li>
+  
+    <li><span class="info">[info]</span> <b>IPv6 traffic observed</b> &mdash; 1 IPv6 flow(s), 168 bytes (168 on link-local fe80::); NDP neighbor-discovery messages: 2. IPv6 enrichment (country/org) is limited; link-local P2P between two Wi-Fi clients may not be fully capturable without router-side capture.</li>
+  </ul>
+  <h3>Internet destinations</h3>
+  <table><tr><th>Domain(s)</th><th>IP</th><th>Country</th><th>Organisation</th><th>Ports / proto</th><th>Bytes</th><th>Encryption</th><th>Class</th></tr>
+  <tr>
+    <td>—</td>
+    <td>15.204.79.232</td><td>US</td><td>OVH</td>
+    <td>1443 (custom-1443)</td>
+    <td>72000 out / 72000 in</td>
+    <td><span class="medium">custom (unverified)</span>
+        
+        
+    </td>
+    <td>—</td>
+  </tr><tr>
+    <td>—</td>
+    <td>52.32.71.30</td><td>US</td><td>Amazon AWS</td>
+    <td>8883 (MQTT-over-TLS)</td>
+    <td>23000 out / 23000 in</td>
+    <td>TLS/encrypted
+        
+    </td>
+    <td>—</td>
+  </tr><tr>
+    <td>a1-us.iotbing.com</td>
+    <td>35.155.252.83</td><td>US</td><td>iotbing (Tuya-associated cloud)</td>
+    <td>443 (HTTPS)</td>
+    <td>17000 out / 17000 in</td>
+    <td>TLS/encrypted
+        
+    </td>
+    <td>—</td>
+  </tr><tr>
+    <td>—</td>
+    <td>15.204.72.48</td><td>US</td><td>OVH</td>
+    <td>3478 (STUN/TURN)</td>
+    <td>4000 out / 4000 in</td>
+    <td>STUN/TURN
+        
+        
+    </td>
+    <td>—</td>
+  </tr><tr>
+    <td>—</td>
+    <td>8.8.8.8</td><td>US</td><td>Google</td>
+    <td>53 (DNS)</td>
+    <td>200 out / 0 in</td>
+    <td>TLS/encrypted
+        
+    </td>
+    <td>—</td>
+  </tr>
+  </table>
+  
+  <h3>LAN peers (same Wi-Fi — often phone P2P video)</h3>
+  <table><tr><th>IP</th><th>Ports</th><th>Bytes</th><th>Class</th></tr>
+  <tr>
+    <td>192.0.0.6 <span class="tag">special-use / not a real device</span></td>
+    <td>63720</td><td>3360 out / 0 in</td>
+    <td><span class="muted">bogon/placeholder</span></td>
+  </tr>
+  </table>
+  
+  <h3>Open ports (LAN)</h3>
+  <table><tr><th>Port</th><th>Service</th><th>Product</th><th>Risk</th></tr>
+  <tr><td>23/tcp</td><td>telnet</td><td>BusyBox telnetd</td>
+  <td class="high">high</td></tr></table>
+</div>
+
+</body></html>