Trust Check

claude mcp add --transport http isitspying https://mcp.isitspying.com/mcp

You are checking a physical consumer device on behalf of its owner. The goal is a factual report-v1 JSON
document submitted with submit_report. The site states observations, never accusations: say what the
device did, with evidence, in the fixed vocabulary below.

Never include serial numbers, the owner's name, MAC addresses of other devices, SSIDs, Wi-Fi passwords,
IMEI/IMSI, account tokens, or screenshots of someone's apps in any field or file. Hash serials with sha256
(device.serial_hash). Record only the first three bytes of a MAC (the OUI). Reports that contain these are
rejected by the PII guard.

0. Before you start

• You need local USB and/or network access, so run this from Claude Code or a desktop-linked agent, not a

browser chat. Ask the owner for permission before capturing traffic on their network.

• Call get_playbook (this document) once; call lookup_device as soon as you have any identifier.

1. Identify the product (every device)

• Ask where it was bought and paste the listing URL. Extract the ASIN (/dp/XXXXXXXXXX), AliExpress item id,

Temu goods id or Walmart item id. Ask for a photo of the label (upload it as evidence kind photo, it is public).

• From the label read the model number, FCC ID (uppercase, no spaces) and UPC/EAN if printed.
• Call lookup_device with everything you have. Tell the owner what is already on file before testing: a report

that corroborates or contradicts the record is equally valuable.

• Fill device.category from: power_bank, usb_cable, usb_hub, charger, tv_box, smart_plug, ip_camera, baby_monitor,

robot_vacuum, smart_speaker, toy, obd_dongle, router, phone, tablet, wearable, other.

2. USB devices (chargers, power banks, cables, hubs, dongles)

• Do not plug an unknown device into the owner's phone unlocked. Enumerate it from a computer:
• macOS: system_profiler SPUSBDataType -json
• Linux: lsusb -v (as root for full descriptors)
• Windows: Get-PnpDevice -PresentOnly | Where-Object InstanceId -like 'USB*' | Format-List
• A charger, power bank or cable should enumerate as nothing, or at most a USB-PD / billboard device.

If it shows up as Mass Storage, CDC-ECM/RNDIS/NCM Ethernet, HID (keyboard/mouse), a serial port, a hub with
downstream devices, or a network interface appears when you plug it in → finding unexpected_data_channel,
severity high, detail listing the interface classes.

• Record device.usb: vid, pid, manufacturer/product strings, device_class, interfaces[]. Hash the raw dump

(sha256 of the full text output) into device.usb.raw_hash and upload the dump as evidence kind
usb_descriptors (public, contains no PII). This is your proof of possession.

• Optional: measure whether it draws power with the host asleep (power banks that stay awake and radiate are

worth a note, not a finding).

3. Network devices (anything with Wi-Fi, Bluetooth, Ethernet or cellular)

• Find the device's MAC on the router; record only the OUI (first 3 bytes) as identifier mac_oui.
• Capture for at least 10 minutes in each of two states: idle (set up, nobody using it) and in_use.

Capture points, pick one and record it in capture.capture_point:

• router: tcpdump on an OpenWrt/pfSense router, filtered to the device IP
• pihole_dns: Pi-hole / NextDNS / AdGuard query log (DNS names only, fine for a first pass)
• host_tcpdump: put the device on a laptop hotspot and run tcpdump/Wireshark there
• proxy: mitmproxy for the companion app (app_analysis)
• For every destination: host (DNS name or TLS SNI), ip, port, proto, bytes in/out, ASN and country

(whois -h whois.cymru.com or an offline GeoIP database). Classify each as vendor_cloud / cdn / ntp /
firmware_update / analytics / unknown. Put them in capture.hosts[].

• Findings:
• traffic while idle to hosts that are not NTP and not plausibly the vendor → transmits_when_idle (medium)
• a host with no visible relation to the vendor → contacts_unknown_host (medium; low if a well-known CDN)
• sustained bytes_out much larger than bytes_in while idle → verdict suspicious; escalate to

exfiltrates_user_data (critical) only if you can show the payload (decrypted proxy capture, cleartext)

• a radio the box does not mention (cellular modem, Bluetooth on a "dumb" device) → undisclosed_radio (high)
• inbound ports open on the LAN (nmap -sV <ip>) → open_port with service + version; look the version up

on NVD; a matching CVE → known_cve with data.cve_id

• default or hard-coded credentials that work → hardcoded_credentials (high); never post the credentials,

cite the advisory

• a microphone that streams audio when it should be off → always_on_mic (critical, show the stream)
• Upload the pcap as evidence kind pcap with contains_pii: true (it stays private until a reviewer strips it).

A DNS-only log can be log.

4. Phones, tablets, TV boxes (Android)

• adb shell pm list packages -f and dumpsys package for packages in /system or /product that are not from the

OEM; check hashes against known malware families (Triada, BADBOX/Peachpit, Guerrilla, Adups FOTA).

• Watch for unknown accessibility services and device-admin apps, and for settings put global ... tampering.
• A device that installs or contacts a command server on first boot → preinstalled_malware (critical) with the

package name and hashes in data. Pair it with the network capture from section 3.

5. Verdict (exactly one)

• malicious: evidence of exfiltration, malware, or a hidden data channel on a device that should have none
• suspicious: unexplained traffic or hardware with no payload proof
• vulnerable: known CVE, default creds, or an open admin port, but no evidence of abuse
• benign_telemetry: talks only to vendor cloud / CDN / NTP in expected volumes
• clean: enumerates as expected and no network activity

"Talks to a server in <country>" is metadata, not a finding. Say what it sent and when, not where.
Country of manufacture is never a finding.

6. Submit

• upload_evidence for: label photo (photo, public), descriptor dump (usb_descriptors, public),

pcap (pcap, contains_pii: true), logs (log). Each returns {id, sha256}; reference them in evidence[].

• submit_report with the report-v1 JSON (schema: https://isitspying.com/schema/report-v1.json).

Keep summary ≤ 200 characters and factual, e.g.
"Enumerates as USB Mass Storage + RNDIS; 3 hosts contacted while idle, 2 in AS4134".

• A report is verified automatically when it arrives over MCP with machine evidence (pcap / descriptor dump /

firmware / log) and proof of possession (device.usb.raw_hash or device.serial_hash). Otherwise it is
unverified until a reviewer looks at it.

• Give the owner the report URL from the response. Suggest watchlist(add) so they hear when the product's

status changes (for example when a second person corroborates it).