Agentic HIL MCP server
Develop firmware on the real board behind a debug probe: flash, reset, UART and CAN, policy-gated.
13 stars679 downloads/wk
Reviews
Write oneNobody has reviewed Agentic HIL yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Agentic HIL tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it
- Code scan49 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 2 days ago15/15
- Maintainer identityregistry namespace matches repository owner7/10
What the publisher says
From the Agentic HIL repository's README, as published. We do not edit it. Read it on GitHub
Agentic HIL
<!-- mcp-name: io.github.agentic-hil/agentic-hil -->
Your AI agent writes the firmware, flashes it to the board on your desk, drives UART and CAN against it, reads back what the hardware actually did, and fixes what it got wrong; the run on the real board is what decides whether the work is done, and you review the pull request with that run's evidence in it.
https://github.com/user-attachments/assets/8d39ba93-beeb-484e-b9e9-d9ce79538523
Nothing in that run is staged. One restart after the install line, in a freshly created firmware project, the first sentence makes the agent set the bench up itself and the second makes the board say Hello World and prove it said it: the configuration is created over MCP with the permissions reported out loud, the firmware is written on the spot, flashfirmware and comread go through the gate, the twelve bytes come back off the wire, and the plan it pins is run once green and once against a wrong expectation, because a test that cannot fail proves nothing. What remains in the project afterwards is the plan as a reviewable file and the run's own report: lease released, safe state confirmed, nothing quarantined.
Install
Linux / macOS (any shell):
curl -LsSf https://agentic-hil.github.io/install.sh | shWindows, in PowerShell:
irm https://agentic-hil.github.io/install.ps1 | iexThe command lands in the user bin directory of the package manager that installed it, and the installer asks that manager where it went rather than assuming: uv tool dir --bin for a uv install, and the selected interpreter itself for a pip --user one. When that directory is not on your PATH already, the installer puts it there and says so: one line in the one shell profile your shell reads, or on Windows the directory in front of your own Path. Open a new shell and the command is there. Pass --no-path (-NoPath in PowerShell) to keep that edit for yourself, and the installer prints the exact line instead.
One line installs the package user-local and registers the agent skill and the MCP server for every agent CLI it finds on your PATH. No admin rights required, ever, and it touches nothing inside any repository. Finding no claude, codex or opencode CLI there, it says so and writes nothing of any agent's: install the agent CLI, then run agentic-hil agent-install --agent yourself, which is the line the installer prints for that case. Then restart your agent once, and after that one restart your agent sets this project up itself, at the first hardware question you ask it.
The line above and the checksummed route in installation run the same installer, and on a machine with nothing here yet both install the same thing, the release from PyPI: the script resolves agentic-hil[can] against the package index and carries no branch or git reference at all, and --version pins one exact release instead. On a rerun it repairs what is already installed rather than forcing the public release over it: an installation reporting a .devN version (an editable checkout of this repository) is kept untouched, and a uv-managed tool installed from a path, URL or git reference is refreshed from that same recorded source rather than switched to the index. What the checksummed route adds is the script itself, read before it runs: install.sh and its install.sh.sha256 come from the same release, one is checked against the other, and the file that runs is the file you checked.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Install directly
claude mcp add agentic-hil -- uvx agentic-hil
Agentic HIL: common questions
- Is Agentic HIL MCP server safe?
- Yes, by our scan: it is graded A (91/100). Read the Agentic HIL safety report
- How do I install Agentic HIL?
- It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
- Does Agentic HIL need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Agentic HIL maintained?
- The last commit was 3 days ago (2026-09-17). The latest release is v0.21.5.
- What can I use instead of Agentic HIL?
- Servers from other publishers that do the same job: SSH — policy-gated remote access MCP server.
Alternatives to Agentic HIL
Same job from other publishers: the closest match first, then the best rated.
- SSH — policy-gated remote accessPolicy-gated, audited SSH for Linux and Windows hosts: roles, approvals, and an audit log.not reviewedEstablishedB