embedded-mcp

MCP server that gives AI agents (GitHub Copilot, Claude Desktop, Cursor, etc.) direct tool access to TI CC26xx and Nordic nRF52/nRF91 embedded hardware.

TI devices are controlled via XDS110 + dslite. Nordic devices are controlled via nrfjprog.

The agent can detect devices, erase flash, program firmware, reset targets, read TI memory/MAC addresses, and capture UART logs — without touching the terminal.

Supported hardware:

• TI: CC2652R7 (and wider CC26xx/CC13xx via .ccxml)
• Nordic: nRF52 and nRF91 (detect/reset/erase/program)

Prerequisites

| Requirement | Notes | | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------ | | TI UniFlash 8.5.0 | Provides dslite.bat. Install to C:\TI\uniflash_8.5.0\. | | nRF Command Line Tools | Provides nrfjprog.exe (must be in PATH or set via NRFJPROG_PATH). | | TI XDS110 debug probe | Any TI LaunchPad includes one. | | .ccxml target config | Generated by TI UniFlash for your device. A ready-made cc2652r7.ccxml is included. | | uv | Python package manager. winget install astral-sh.uv or pip install uv. | | Python 3.10+ | Managed automatically by uv. |

Setup

Option A — From GitHub (no PyPI publish needed)

Add to your mcp.json (VS Code: .vscode/mcp.json, Claude Desktop: claude_desktop_config.json):

{
  "servers": {
    "embedded-mcp": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/Umer-Mahmood/embedded-mcp",
        "embedded-mcp"
      ],
      "env": {
        "DSLITE_PATH": "C:\\TI\\uniflash_8.5.0\\dslite.bat",
        "CCXML_PATH": "C:\\path\\to\\cc2652r7.ccxml",
        "NRFJPROG_PATH": "nrfjprog.exe"
      }
    }
  }
}

uvx fetches and caches the package automatically on first use. No manual install needed.

Option B — From PyPI (once published)

{
  "servers": {
    "embedded-mcp": {
      "type": "stdio",
      "command": "uvx",
      "args": ["embedded-mcp"],
      "env": {
        "DSLITE_PATH": "C:\\TI\\uniflash_8.5.0\\dslite.bat",
        "CCXML_PATH": "C:\\path\\to\\cc2652r7.ccxml",
        "NRFJPROG_PATH": "nrfjprog.exe"
      }
    }
  }
}

Option C — Local repo (for development)

{
  "servers": {
    "embedded-mcp": {
      "type": "stdio",
      "command": "uv",
      "args": [
        "--directory",
        "C:\\path\\to\\embedded-mcp",
        "run",
        "embedded-mcp"
      ],
      "env": {
        "DSLITE_PATH": "C:\\TI\\uniflash_8.5.0\\dslite.bat",
        "CCXML_PATH": "C:\\path\\to\\cc2652r7.ccxml",
        "NRFJPROG_PATH": "nrfjprog.exe"
      }
    }
  }
}

Environment Variables

| Variable | Required | Default | Description | | ------------------- | -------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------- | | DSLITE_PATH | Yes | TI default install path | Full path to dslite.bat | | CCXML_PATH | Yes | cc2652r7.ccxml in CWD | Target configuration file for your device | | NRFJPROG_PATH | No | nrfjprog.exe | Path or command name for nrfjprog | | DEFAULT_UART_PORT | No | (unset) | Default COM port for uart_read/uart_write. If unset, pass port explicitly or call list_serial_ports first. | | DEFAULT_UART_BAUD | No | 115200 | Default UART baud rate |

For Nordic tools, pass snr only when multiple J-Link probes are connected. With a single connected probe, omit snr and auto-selection is used.

Tools

| Tool | Description | | ------------------- | ----------------------------------------------------------------------------- | | get_config | Show active TI/Nordic paths and defaults | | detect_device | Detect target=CC26XX \| NRF52 \| NRF91 (optional snr for Nordic) | | mass_erase | Erase selected target (TI mass erase or Nordic --eraseall) | | flash_binary | Program selected target. Nordic uses --program --chiperase --verify --reset | | verify_binary | Verify device flash matches a firmware file (TI only) | | reset_device | Reset selected target (TI board reset or Nordic --reset) | | read_memory | Read bytes from any address, returns hex dump | | read_ble_mac | Read primary BLE MAC from FCFG1 (non-destructive) | | read_ieee_mac | Read primary IEEE 802.15.4 MAC from FCFG1 (non-destructive) | | list_serial_ports | List all available COM ports with descriptions | | uart_read | Capture serial output for N seconds | | uart_write | Send string over serial, return response |

TI-only tools: verify_binary, read_memory, read_ble_mac, read_ieee_mac, uart_read, uart_write.

CC2652R7 Memory Map

| Region | Address | Notes | | -------------------- | ----------------- | ---------------------------------------------- | | Application firmware | 0x00000000 | Main flash start | | CCFG (device config) | 0x57FA8–0x57FFF | Protection flags, bootloader config | | FCFG1 (factory cal.) | 0x50001000 | Read-only factory calibration, always readable | | BLE MAC address | 0x500012E8 | 6 bytes, little-endian (reverse for display) | | IEEE 802.15.4 MAC | 0x500012F0 | 8 bytes, little-endian (reverse for display) |

Test with MCP Inspector

npx @modelcontextprotocol/inspector uvx --from . embedded-mcp

Example Copilot session

"Is the device connected? If yes, erase it, flash firmware.bin to 0x0, then reset and show me boot logs."

Copilot will chain detect_device → mass_erase → flash_binary → reset_device → uart_read autonomously.

⚠️ Warnings

• mass_erase erases all user flash. Confirm before calling on a production device.
• Some devices include a bootloader that, once flashed, permanently disables JTAG. Mass erase is the only recovery path in that case (if the bootloader permits it).
• The CCFG region at 0x57FA8 controls device protection flags. Writing incorrect values here can brick the device.