▲ ADVISORY
FUZZ AROUND · FIND OUT

ISSUE 10.0 SEPT 2026 FREE · TAKE ONE

The bus
doesn't
lie.

CANarchy is an open, stream-first runtime for analyzing and manipulating CAN and J1939 buses. Every command emits a canonical JSONL event. Every event is replayable. Nothing is hidden behind a GUI, a license key, or a dongle.

WHAT THIS IS

A toolkit for security researchers, red teams,
fleet auditors, OSS tinkerers, and the
occasional agent operating without supervision.

WHAT IT IS NOT

A replacement for can-utils, python-can,
SavvyCAN, or common sense.

Read the Docs ★ Star It

J1939 NATIVE·JSONL WIRE FORMAT·MCP SERVER·UDS DISCOVERY·DBC PROVIDERS·RATE-CONTROLLED REPLAY·FRAME GATEWAY·ACTIVE-COMMAND SAFETY·AGENT-DRIVEN PIPELINES·OPEN SOURCE · GPL-3.0·

SIX
MOVES.

CORE SUBCOMMANDS
all composable · all emit events

NO.01● STABLE

STREAM

JSONL events. Stable schema. Pipe to grep, jq, duckdb, or your agent. The CLI is the API.

NO.02● STABLE

J1939

Heavy vehicles are not an afterthought. PGNs, TP reassembly, address claim — first-class.

NO.03● STABLE

UDS

Discover services. Trace transactions. Every active command is gated behind --ack-active, --dry-run, and a typed YES.

NO.04● STABLE

DBC

Provider-backed discovery. Local cache. Reverse-engineering matchers when you only have frames.

NO.05● STABLE

GATEWAY

Bridge buses. Rewrite frames in flight. Replay captures with real timing or compressed.

NO.06● STABLE

AGENT

Deterministic subcommands. MCP server. Build loops with Claude, Cursor, or anything that can shell out.

◉ LIVE TAPE · can0 @ 250K

// EXHIBIT A — ONE PIPELINE, ONE TRUTH

CAPTURE. DECODE.
COMPARE. REPLAY.

# STEP 1 — CAPTURE + DECODE

$ canarchy capture can0 --jsonl \
    | canarchy j1939 decode --stdin --jsonl

{"ts":"17:42:19.20","pgn":61444,
 "name":"EEC1","engine_rpm":1842.25}
{"ts":"17:42:19.22","pgn":61444,
 "name":"EEC1","engine_rpm":1847.00}
{"ts":"17:42:19.24","pgn":65262,
 "name":"ET1", "coolant_c":88}

# STEP 2 — COMPARE AGAINST BASELINE

$ canarchy j1939 compare \
    baseline.candump run.candump \
    --text

unique_pgns:
- run.candump: 65262[ET1]
dm1_differences:
- sa=0x00 [Engine #1]
  run.candump: present=True faults=spn=110/fmi=3
  baseline.candump: present=False faults=none

■ MCP SERVER · AGENTS GET A SEAT

PLUG CLAUDE
STRAIGHT INTO
THE CAN BUS.

ALL TOOLS · ONE SCHEMA · ZERO GLUE CODE

$ canarchy mcp serve

ONE-SHOT WIRE-UP: canarchy mcp install --client claude-desktop

TOOL CATALOG · canarchy MCP (showing 9 of the full surface)

captureinterface, duration, decodestream<Event>

decodefile, dbc?stream<Event>

filterexpression, filestream<Event>

replayfile, rate, interface?stream<Event>

j1939_dm1file, source_address?stream<Event>

uds_scaninterface?stream<Event>

dbc_inspectdbc, search?, layout?Bundle

gatewaysrc, dst, ack_activestream<Event>

simulateprofile, rate?, ack_activestream<Event>

■ ALL EVENTS: canarchy/v1 ◆ GUARDS: PLANNED ■ STREAMING

AGENT TRANSCRIPT · LIVE claude ↔ canarchy

USER Audit the truck on can0 for 10s and flag anything that looks like an unsolicited diagnostic session.

↳ agent decides to capture, then filter for UDS traffic before deciding whether an active probe is warranted

→ call capture

{ "interface": "can0", "duration": 10, "decode": "j1939" }

← {"command":"capture","ok":true,"data":{...}} … 428 events

→ call filter

{ "expression": "name~=UDS.*", "file": "$last" }

← 3 matching events — all sa=0x27

AGENT Flagged 3 uds.session.request from sa=0x27. No active probe attempted over MCP — that requires canarchy uds scan can0, gated behind --ack-active and a typed YES.

DETERMINISTIC

Same inputs in, same JSONL out. Agents can loop without drift.

STREAMING

Tools return event streams. No 10k-token blobs, no truncation.

DRY-RUN BY DEFAULT

Active commands require explicit --ack-active plus a typed YES. Guard framework (speed / ignition / session, marked PLANNED in the MCP catalog above) is on the roadmap.

THE
MATRIX.

FIRST-CLASS ONLY · NO HALFWAY
■ = shipped · □ = not a focus

CANarchy compared with can-utils, python-can, cantools, SavvyCAN, Caring Caribou, and TruckDevil
WORKFLOW	CANarchy	can-utils	python-can	cantools	SavvyCAN	Caring Caribou	TruckDevil
CLI-first	Yes	Yes	No	Yes	No	Yes	No
JSONL events	Yes	No	No	No	No	No	No
Pipe composition	Yes	No	No	No	No	No	No
J1939 native	Yes	No	No	No	No	No	Yes
UDS workflows	Yes	No	No	No	No	Yes	No
DBC decode/encode	Yes	No	No	Yes	Yes	No	No
Provider-backed DBC	Yes	No	No	No	No	No	No
Agent / MCP	Yes	No	No	No	No	No	No

▣ DEFINITELY-REAL REVIEWS

TESTIMONIALS.
ALLEGEDLY.

▲ ALL QUOTES FABRICATED

“Connected it to OpenClaw. What could go wrong?”

Anonymous

incident responder, Tuesday

VERIFIED · SORT OF

“Used CANarchy to baseline our fleet. Found three ECUs we didn’t own. Rolling back the audit.”

J. Ramirez

fleet security, mid-sized logistics co.

DEFINITELY A HUMAN

“I am an autonomous agent. The MCP server is delicious. I have consumed 1.4M events. Send more.”

claude-haiku-4-5

unsupervised, running on someone’s homelab

AGENT REVIEW

“My lawyer says I can’t describe what we did with it. 10/10.”

Redacted

red team, Tier-1 OEM

NDA-COMPLIANT

“Bricked a test bench in 3.2 seconds. JSONL receipts were immaculate.”

M. Okafor

PhD candidate, automotive security

PEER-REVIEWED (BY PEERS)

“The truck hasn’t started since Thursday. I regret nothing.”

K. “PGN” Dale

owner-operator, somewhere in Nebraska

UNVERIFIED VIBES

* Any resemblance to real people, fleets, or incidents is entirely intentional and also fully deniable.

▲▲▲ MANIFESTO ▲▲▲

SIX RULES.
ONE EXCEPTION: YOU.

01ONE RUNTIME, MANY DOORS
02CAPTURE FIRST, ASK QUESTIONS LATER
03J1939 IS NOT A PLUGIN
04AGENTS DRIVE · HUMANS RIDE
05SCRIPT IT, DON’T CLICK IT
06PoC || GTFO

▣ INSTALL / RUN

THREE
COMMANDS.
ZERO FLUFF.

Plug in a USB CAN interface, point it at a log file, or spin up a virtual bus. You’ll have your first JSONL event before your coffee is cold.

$ ZSH · canarchy v0.10.0

# 1. install
➜ pip install canarchy

# 2. check your environment
➜ canarchy doctor --text

# 3. stream + decode J1939 events as JSONL
➜ canarchy capture can0 --jsonl | canarchy j1939 decode --stdin --jsonl

# 4. (optional) let an agent drive it
➜ canarchy mcp serve

The bus doesn't lie.