Spyglass is an automotive network analysis bench — capture and simulate CAN and automotive Ethernet, calibrate over XCP, run diagnostics, script it all, and put an AI copilot on the bench that runs on your terms.
Signed builds, straight from CI. Current release v0.0.0 · Use is subject to the Spyglass license.
NSIS installer with bundled runtime. Vector XL and PCAN drivers detected at first launch.
0000…0000
Native package targeting Debian 12 / Ubuntu 22.04+. SocketCAN out of the box; udev rules included.
0000…0000
Eight modules, one bench. Each module is a workflow — the capabilities inside it share a timeline, a scripting API, and a window layout. Select a module on the plan and its deck opens below.
Everything CAN and CAN FD in one deck: watch a live bus, decode it against your DBC, stand in for missing ECUs, and replay yesterday's drive onto today's bench.
One driver API, many backends — SocketCAN on Linux, Vector XL and PCAN-Basic on Windows, plus a virtual bus for driverless development. Hot-plug aware; hardware timestamps at the driver edge.
built as a C++ core with a C ABI boundary — backends ship as plugins.
Lossless capture pipeline — lock-free ring buffer, ID/mask filters applied before frames hit the UI, indexed history for instant time-travel scrubbing. A saturated bus doesn't drop frames.
single-producer multi-consumer queue; UI, logger, and scripting each get an independent cursor.
Raw frames become named, scaled signals in real time — multiplexed messages, extended IDs, value tables. Swap or edit a DBC mid-session and the whole trace re-decodes without restarting capture.
standalone parser library with a test corpus of real-world (messy) DBC files.
Stand in for ECUs that aren't on the bench yet. Periodic and one-shot transmit, signal sliders bound to DBC signals, and residual bus simulation generated straight from the database.
simulated nodes run on the same virtual-bus path as real traffic — scripts can't tell the difference.
Play any log back onto a real or virtual bus with original timing — or scaled, for stress testing. Loop ranges, gate on triggers, remap channels on the way out.
Automotive Ethernet beside CAN, on the same synchronized timeline — a signal crossing a gateway is one cursor-measure away.
Service discovery tracked live; methods, events, and fields decode against ARXML/FIBEX definitions. Subscribe state shown per service, not buried in packet bytes.
Offer simulated services for ECU bring-up — publish events, answer method calls with scripted responses, fault-inject malformed payloads on demand.
same spy-scripting hooks as CAN; a simulated service is a script with a service ID.
Diagnostics over IP as a first-class transport — vehicle discovery, routing activation, and session handling feed straight into the Diagnostics module.
Import Wireshark captures for offline decode; export selections for anyone without a Spyglass seat. 100BASE-T1 links captured via media converters or tap hardware.
ASAM XCP master over CAN and Ethernet — browse the A2L, stream measurements at ECU rate, and tweak calibration values live with every write journaled.
Characteristics, measurements, and conversion methods in a searchable tree. Lazy-parses multi-hundred-MB A2L files — the browser opens before indexing finishes.
Dynamic DAQ list allocation, event-channel aware, timestamps from the slave clock when it provides one. Streams land in the same plotter as CAN signals.
Every download and STIM write is journaled; one click restores the working page to its pre-session state. Diff two pages before committing anything to flash.
transport-agnostic XCP core — XCP-on-CAN and XCP-on-Ethernet are thin adapters on one state machine.
ISO 14229 client with request/response pairs rendered inline in the trace — diagnostics in context, not in a separate console.
Read and clear DTCs, pull DIDs, run routines, manage sessions. Negative response codes decoded to plain language at the point of failure.
ISO-TP on CAN and DoIP on Ethernet under one service engine. Flow control, ST-min, and multi-frame reassembly handled in the transport layer — visible when you want them.
services are data, not code — new DIDs and routines are config, not releases.
Raw hex is always there, but with an ODX or diagnostic description loaded, DIDs decode to named, scaled values — same treatment signals get from a DBC.
Programming sessions with transfer progress in the trace. Seed/key algorithms plug in as small user libraries — no vendor DLL required for the common cases.
The namesake. Small scripts that sit on the live bus and react — plus the machinery to run whole test suites headless, on the bench or in CI.
Hook a message, a signal edge, or a diagnostic response, then react: log it, transform it, inject a reply. Event hooks — on_message, on_signal_change, on_timer, on_uds_response — mean scripts wake only when their trigger fires. Gateways, fault injection, and quick fixtures in a few lines.
embedded Python runtime, typed API, each spy isolated — one bad script can't stall the pipeline. Hot reload without dropping capture.
Declarative send/expect sequences — transmit, assert on the response, loop with timing tolerances — reported pass/fail with full trace context. A failed sequence saves its trace slice, so every red result reproduces offline.
Drive Spyglass from outside — capture control, signal reads, frame transmission, and sequencer runs over a remote API, so CI racks and HIL benches script the tool without touching the GUI. One client owns transmit at a time; observers attach read-only.
gRPC service over the same core the GUI uses — a passing sequence in CI is the same code path as the bench.
The cross-cutting deck: plotting, trace views, logging, and the GUI shell serve every module — CAN signals, SOME/IP events, and XCP DAQ streams all land in the same windows.
Real-time strip charts. Drag any signal — CAN, Ethernet, or DAQ — onto a plot, overlay freely, cursor-measure deltas between channels. Min/max envelope decimation keeps spikes visible when a million points collapse into one pixel column.
GPU-batched line rendering; redraw cost stays flat as channels are added.
Fixed and scrolling modes, per-column filters, and decoded payloads inline. Virtualized rows — a firehose of frames scrolls smoothly. Plot cursor, trace selection, and log playhead share one timeline.
Record to BLF, ASC, candump, or PCAP. Format-faithful — logs round-trip through Vector tooling without timestamp drift.
reader/writer pairs behind one log interface; adding a format touches nothing else.
Dockable layout that saves per-project — a bench setup restores exactly, window for window. Dark mode is the default, not an afterthought.
thin shell over the core modules — the GUI owns pixels, never protocol state.
An AI that reads the bus with you — explains anomalies, drafts spy scripts, and translates DTCs to plain language. You choose what powers it: bring your own model, or run the in-house one.
Point Spyglass at any provider you already trust: Anthropic, OpenAI, Azure-hosted deployments, or a fully local endpoint (Ollama, llama.cpp). Keys live in your OS keychain; per-feature model routing lets a small local model handle autocomplete while a frontier model handles trace analysis.
provider adapters behind one completion interface — adding a backend is a config entry, not a release.
A model served entirely inside your network, tuned on automotive semantics — DBC conventions, UDS negative response codes, XCP command traffic, SOME/IP service patterns. Air-gapped benches get full copilot features with zero bytes leaving the lab. Proprietary captures stay proprietary.
served on-prem behind the same BYOA interface — switching between it and an external provider is one dropdown.
Select a window of frames and ask — why did bus load spike, what changed after this event, which node went quiet. The copilot answers with references back into the trace, not vague summaries.
Describe the fixture in plain language — "answer every VIN request with this value, drop every third frame from 0x321" — and get a runnable spy script draft, using your loaded DBC's real signal names.
A DTC plus its freeze frame becomes a plain-language summary: what the code means, what the snapshot data suggests, what to probe next. Grounded in the loaded diagnostic description.
The look-back deck. Open yesterday's logs with no adapter plugged in and get the full bench — trace, plots, decode, scripting — pointed at recorded traffic instead of a live bus. Where drive files become answers.
Open BLF, ASC, candump, or PCAP files directly — no hardware, no capture session. Everything the live bench offers works on the file: filtering, plotting, DBC decode, spy scripts running against recorded frames at any playback speed.
a log file is just another frame source behind the Trace Engine cursor — the rest of the app can't tell.
Today's DBC against last month's capture. Databases evolve — apply a new DBC, ARXML, or ODX to any old log and the whole file re-decodes, so a fixed signal definition pays off retroactively across your archive.
Two drives, side by side. Align captures on a trigger event, then diff signal behavior between them — before/after a firmware flash, good unit vs bad unit. Divergences get flagged on a shared timeline.
alignment is event-based, not wall-clock — two logs recorded weeks apart still line up.
Query hours of traffic by condition — "battery voltage below 300 V while vehicle speed above 20 kph" — and jump between hits. Bookmark moments with notes; annotations save with the log for whoever opens it next.
Numbers from the current release cycle.
Spyglass is an internal automotive network analysis toolkit. This page hosts release artifacts and documents the architecture module by module. Use is governed by the Spyglass license. Questions, bugs, feature asks — write to the bench.