RKMCP · Model Context Protocol server

Hand your coverage gaps
straight to your AI agent.

RKMCP is RKTracer's built-in Model Context Protocol server. It serves your uncovered lines, decisions and MC/DC conditions, complete with the exact test vectors to add, as JSON-RPC, so an AI agent can write the unit tests that close them. Zero third-party dependencies. Nothing decrypted ever touches the disk.

Book a Demo Download Free Trial

stdio & HTTP transports · standard MCP client · in-memory only

agent ⇄ rktracer-mcp

# Point your AI agent at the project, it auto-runs RKTracer
$ rktracer-mcp-stdio --path ./bms-ecu

  found rk-coverage.txt · running rkresults…
  decrypting mcp.dat in memory (AES-256)…
  ✓ coverage served over MCP, 7 tools ready

# The agent calls a tool and gets tests to write back
→ tools/call get_uncovered_report
  ✓ 14 functions · 58 unit tests to add
  v1 C1=T C2=-  => TRUE   (missing)
  v2 C1=F C2=T  => TRUE   (missing)
  v3 C1=F C2=F  => FALSE  (missing)

What it is

The bridge between your coverage data and your AI agent

RKTracer measures exactly how your code behaves when it runs, every line, branch, condition and MC/DC pair. The RKMCP server takes that result and exposes it over the Model Context Protocol, the open standard AI agents use to call tools. The agent asks "what isn't covered?" and gets back not just the gaps, but the precise inputs needed to close each one.

It is a faithful, dependency-free C++17 implementation built with a plain Makefile, designed to drop into the same embedded toolchain that builds your firmware. No Python runtime, no pip, nothing to install on your build machine or CI runner.

At a glanceBuilt in to RKTracer

Speaks standard MCP (JSON-RPC), works with any MCP client
Two transports: stdio (agent subprocess) and HTTP
7 tools, from a one-line summary to per-function test vectors
Pure C++17 · zero third-party libraries · builds with make
Coverage returned inline, nothing written to disk
Stable, versioned output schema (rktracer-coverage-v1)

How it works

From build to AI-written tests in four steps

Point the server at your project. It does the rest, and the decrypted coverage never leaves memory.

Discover

Start with --path and the server finds your rk-coverage.txt, validates the RKTracer layout, and runs rkresults.

Decrypt in memory

RKTracer's encrypted mcp.dat is decrypted (AES-256-CBC) entirely in RAM. The plaintext coverage XML never touches the disk.

Serve over MCP

The agent connects over stdio or HTTP and calls tools. Each call returns the coverage data inline as a JSON-RPC result.

Generate & verify

The agent turns the returned test vectors into unit tests, re-runs RKTracer, and watches MC/DC climb toward your target.

The toolset

Seven tools your agent can call

From a headline number to a per-function list of exactly which tests to write.

Tool	What the agent gets back
`get_coverage_summary`	Headline rates and totals, line, statement, MC/DC, plus a self-verification check.
`get_coverage_report`	Full per-file and per-function metrics with every gap; optionally embeds the source.
`list_coverage_gaps`	The primary test-gen tool, one flat list of every gap, filterable by file, function or kind.
`get_uncovered_report`	Uncovered lines and decisions grouped by function, each with the concrete MC/DC test vectors to add.
`get_uncovered_lines`	Just the uncovered lines, grouped by function, with file and function filters.
`get_mcdc_gaps`	Only the uncovered MC/DC decisions, with the exact truth-table vectors needed to satisfy them.
`get_function_coverage`	One function's metrics, gaps and source, for focused, function-by-function work.

Every tool returns machine-readable JSON and the same data as readable text, so any MCP client can consume it.

Why it helps AI test generation

It doesn't just say "this is uncovered", it says "write this test"

Most coverage tools leave the agent to guess the inputs. RKMCP hands it the answer: each uncovered decision comes with the masking-MC/DC vectors, the exact condition values and expected outcome, straight from RKTracer's analysis. The agent's job shrinks from "figure out how to reach this branch" to "render these rows as tests."

Precise targets

The agent works from real, runtime-measured gaps, not a static guess at what might be untested.

Ready-made vectors

Each vN row is one unit test: condition values plus expected result, computed to the DO-178C C+1 rule.

Closed loop

Generate, re-run RKTracer, ask again. The agent iterates until the coverage your standard requires is reached.

get_uncovered_report, targets for unit-test generation

src/battery_monitor.c
  bm_max_cell_voltage @142  uint16_t bm_max_cell_voltage(const uint16_t *cells, uint8_t count)
    uncovered_lines: 142, 144, 145, 147, 148, 149, 150, 153
    mcdc @144  cells==NULL || count==0u   [0/3 MC/DC vectors exercised]
      C1 = cells==NULL
      C2 = count==0u
      add tests:
        v1  C1=T C2=-  => TRUE   (missing)
        v2  C1=F C2=T  => TRUE   (missing)
        v3  C1=F C2=F  => FALSE  (missing)

- = don't-care (short-circuit masked). Each vN is one unit test to add.

Built for safety-critical teams

Secure and self-contained by design

Nothing hits the disk

The encrypted mcp.dat is decrypted in memory and served inline in the JSON-RPC result. No plaintext coverage artifact is ever written out.

AES-256 encrypted source

Coverage data stays encrypted at rest (AES-256-CBC) and is only ever decrypted into memory by the server that serves it.

Zero dependencies

JSON, XML and base64 are all bundled. Pure C++17, plain Makefile, auditable, and trivial to drop into an offline CI runner.

Two transports, one schema

stdio for a local agent subprocess, HTTP for a remote one. Both share the same core, so the wire output is identical either way.

Self-verifying output

Each response carries a consistency check (instrumented lines vs. lines-valid), and the result validates against a published JSON schema.

Runs anywhere RKTracer does

Same toolchain as your firmware build, Linux and macOS, host or CI. Offline-friendly, no runtime to provision.

FAQ

Questions teams ask about RKMCP

MCP is an open standard that lets AI agents call external tools and data sources over JSON-RPC. RKMCP implements the server side, so any MCP-capable agent can ask RKTracer for coverage data and act on it.

No. In project mode the encrypted mcp.dat is decrypted entirely in memory and returned inline in the JSON-RPC response. The plaintext coverage XML is never persisted to disk.

Any standard MCP client. RKMCP has been driven by the official MCP client over both stdio and HTTP. Point your agent at the stdio binary or the HTTP endpoint and the seven tools appear automatically.

Just a C++17 compiler and make. There are no third-party libraries, the JSON, XML and base64 handling are all bundled. No Python, no package manager, nothing extra on your CI runner.

Instead of just flagging an uncovered branch, RKMCP returns the exact MC/DC test vectors, the condition values and expected outcomes, needed to cover it. The agent renders those rows directly as unit tests, then re-runs RKTracer to confirm the gap is closed.

Put your coverage gaps to work

See RKMCP feed your AI agent on your own code. Book a 30-minute demo, or download the free trial and connect your agent today.