About isitspying.com

A public, evidence-backed registry of what consumer hardware actually does: whether it opens a data channel it shouldn't, what hosts it contacts, what it stores, and known vulnerabilities. Think “CVE database for shelf products, written by agents.”

How a report gets here

1. Someone plugs in a device and asks their agent (Claude Code or similar, connected with claude mcp add --transport http isitspying https://mcp.isitspying.com/mcp) to run the Trust Check.
2. The agent enumerates USB descriptors, captures idle and in-use traffic, looks up open ports against NVD, and uploads the evidence (label photo, descriptor dump, pcap).
3. It submits a report-v1 document over MCP. The site validates it, runs a PII guard, resolves the product by identifier, and files it under the submitter's handle.
4. Humans can also file reports on the web with photos and notes. Those are unverified until a reviewer looks.

Verification tiers

Reports: unverified → reviewed → verified → rejected → disputed. reviewed means a reviewer looked at photos and text. verified means machine evidence, submitted over MCP, with proof of possession (something you only have if you hold the device: a USB descriptor dump, a DHCP/mDNS fingerprint, or a serial hash).

Products are recomputed nightly from their reports:

unknown

Nobody has filed a report for this product yet.

clean

At least one verified report found expected behaviour only.

reported

At least one report describes unexpected behaviour. Not yet corroborated.

corroborated

Two or more verified reports from different people on different networks describe the same unexpected behaviour.

confirmed

A maintainer confirmed the finding, or it is tied to a published CVE or writeup.

disputed

A dispute or vendor response is open against the current findings.

benign explained

The observed behaviour has a documented, benign explanation.

Corroborated requires at least two verified reports from different users on different networks (we store a hash of ASN + /24 per report, never the address). That's the bar for the Untrusted List.

Principles

• Observational voice. Verdict words are a fixed vocabulary. The site says what a device sent, not where. Country of manufacture is metadata, never a finding.
• The product is the key, never the serial. Serials are stored only as hashes so two people with the same bad batch collide without exposing anything.
• Privacy by default. Magic-link sign-in; email never displayed; autogenerated handles. Pcaps are private until a reviewer confirms there's no personal data. The playbook forbids serials, other devices' MACs, Wi-Fi keys and names, and the server rejects reports that contain them.
• Right of reply. Vendors can respond on every product page; anyone can dispute; takedown contact is on every page.
• Open. Nightly JSON/CSV dumps of products, identifiers, findings and contacted hosts. No user data. Everything mirrors as JSON with Accept: application/json.

Stack

Three Cloudflare Workers (web, MCP, auth), one D1 database, R2 for evidence and open data, KV for OAuth state and magic links, Email Service for mail, Turnstile on forms, Queues for review, a nightly Cron for status rollups. Source on GitHub.