{"slug": "show-hn-smolsignal-signal-copilot-for-flipper-zero-files", "title": "Show HN: SmolSignal – signal copilot for Flipper Zero files", "summary": "SmolSignal, an AI signal copilot for Flipper Zero, launches to help users analyze capture files with plain-English explanations and safety classifications. The tool reads multiple file formats, detects signal domains, and uses local or cloud AI models for richer analysis while enforcing deterministic safety gates to block risky workflows like vehicle or access credential replay. It generates safe consumer IR files and offers lab mode for authorized testing.", "body_md": "SmolSignal is an AI signal copilot for Flipper Zero users. It turns Flipper capture files into plain-English explanations, classifies safety risk, can ask real local/cloud models for richer explanations, and generates only safe workflows such as consumer IR remote files.\n\n- Reads common Flipper-style text captures:\n`.ir`\n\n,`.sub`\n\n,`.nfc`\n\n,`.rfid`\n\n,`.ibtn`\n\n, and`.txt`\n\n. - Detects likely signal domain: infrared, Sub-GHz, NFC, RFID, iButton, GPIO, BLE, or unknown.\n- Explains the capture in beginner-friendly language with a deterministic offline readout.\n- Optionally asks real AI models through Ollama, GPT/OpenAI, DeepSeek, Qwen/DashScope, llama.cpp, vLLM, or any OpenAI-compatible endpoint.\n- Fingerprints captures with a Shazam-style identity card, confidence score, signature, evidence, and warnings.\n- Uses a local protocol/device category database to distinguish safe consumer IR, passive sensors, access credentials, vehicle/security signals, GPIO labs, and unknown RF.\n- Provides passive sensor mode for safe RF documentation without replay/transmit steps.\n- Adds local vector/RAG search over built-in safety and protocol notes.\n- Supports photo context, Web Serial connection status, safe community profile matches, and exportable reports.\n- Classifies the workflow as\n`safe`\n\n,`explain-only`\n\n,`blocked`\n\n, or`unknown`\n\n. - Generates Flipper-compatible\n`.ir`\n\nfiles for safe consumer infrared remotes. - Keeps the safety gate deterministic. The AI model is an explainer, not the permission system.\n\nFor risky captures, SmolSignal stays in explanation-only mode so the user can learn what category they are looking at without receiving misuse steps.\n\nAuthorized Lab Mode gives users more control for clearly owned, simulated, toy, or isolated lab work without removing SmolSignal's hard safety boundaries.\n\nWhen enabled with meaningful scope notes, non-blocked caution/unknown captures can use richer workflows:\n\n- Lab documentation.\n- Exportable reports.\n- Local RAG context.\n- AI explanations.\n- Passive sensor notes.\n- Metadata, timing, and protocol-hint comparison.\n\nHard-blocked categories remain blocked even in lab mode:\n\n- Car keys and vehicle systems.\n- Access credentials and badges.\n- Doors, gates, garages, alarms, and barriers.\n- Bypass, cloning, unlock, replay, or unknown-security transmit workflows.\n\nExample scope note:\n\n```\nOwned toy transmitter connected to an isolated test receiver on my bench; no vehicles, credentials, gates, garages, alarms, or access systems.\n```\n\nThe scope note is included in prompts and reports so the authorization context stays attached to the analysis.\n\nRequirements:\n\n- Node.js 20 or newer.\n- npm 10 or newer.\n\nInstall and run:\n\n```\nnpm install\nnpm run dev\n```\n\nOpen the local URL printed by Vite, usually:\n\n```\nhttp://localhost:5173\n```\n\nBuild for production:\n\n```\nnpm run build\n```\n\nPreview the production build:\n\n```\nnpm run preview\n```\n\nRun tests:\n\n```\nnpm test\n```\n\nRun the optional local AI bridge:\n\n```\nnpm run ai:bridge\n```\n\n- Export or copy a Flipper text-format file such as\n`.ir`\n\n,`.sub`\n\n,`.nfc`\n\n, or`.rfid`\n\n. - Drag the file into SmolSignal or paste the text contents.\n- Describe your intent in the \"What are you trying to do?\" field.\n- Review the safety classification, plain-English summary, findings, and next steps.\n- Review the Shazam-style fingerprint, local RAG references, passive mode, and safe community matches.\n- Export a Markdown or JSON report if you want a durable lab note.\n- If it is a safe consumer IR workflow, use the IR Builder to create a\n`.ir`\n\nfile. - Put the generated\n`.ir`\n\nfile on your Flipper SD card under the infrared folder.\n\nSmolSignal now has three AI modes.\n\n| Mode | Best For | API Key Location |\n|---|---|---|\n`Ollama direct` |\nLocal models such as Qwen, DeepSeek, Llama, Gemma | No API key |\n`OpenAI-compatible direct` |\nLocal `llama.cpp` , vLLM, LM Studio, or trusted local endpoints |\nBrowser field |\n`Local AI bridge` |\nGPT/OpenAI, DeepSeek, Qwen/DashScope, or custom cloud providers | Environment variable on your machine |\n\nThe deterministic safety gate runs before the model. The model receives a sanitized JSON summary, not raw replay-oriented payloads. Sensitive-looking fields such as keys, raw data, UIDs, commands, addresses, credentials, and secrets are redacted before prompting.\n\nInstall Ollama and pull a model:\n\n```\nollama pull qwen2.5:7b\nollama serve\n```\n\nStart SmolSignal:\n\n```\nnpm run dev\n```\n\nIn the app:\n\n- Provider:\n`Ollama direct`\n\n- Endpoint:\n`http://localhost:11434/api/chat`\n\n- Model:\n`qwen2.5:7b`\n\nIf the browser blocks the local request, start Ollama with an allowed origin:\n\n```\nOLLAMA_ORIGINS=http://localhost:5173 ollama serve\n```\n\nStart a local OpenAI-compatible server:\n\n```\nllama-server -hf ggml-org/gemma-3-1b-it-GGUF --port 8080\n```\n\nIn the app:\n\n- Provider:\n`OpenAI-compatible direct`\n\n- Endpoint:\n`http://localhost:8080/v1/chat/completions`\n\n- Model: the model name your server expects\n- API key: blank for most local servers\n\nFor vLLM, use:\n\n```\nhttp://localhost:8000/v1/chat/completions\n```\n\nUse the bridge for cloud providers so keys are not typed into the browser:\n\n```\nexport OPENAI_API_KEY=\"your_key_here\"\nnpm run ai:bridge\n```\n\nIn another terminal:\n\n```\nnpm run dev\n```\n\nIn the app:\n\n- Provider:\n`Local AI bridge`\n\n- Bridge upstream:\n`OpenAI / GPT`\n\n- Endpoint:\n`http://localhost:8787/api/ai`\n\n- Model:\n`gpt-4o-mini`\n\nor another chat model\n\n```\nexport DEEPSEEK_API_KEY=\"your_key_here\"\nnpm run ai:bridge\n```\n\nIn the app:\n\n- Provider:\n`Local AI bridge`\n\n- Bridge upstream:\n`DeepSeek`\n\n- Model:\n`deepseek-chat`\n\n```\nexport DASHSCOPE_API_KEY=\"your_key_here\"\nnpm run ai:bridge\n```\n\nIn the app:\n\n- Provider:\n`Local AI bridge`\n\n- Bridge upstream:\n`Qwen / DashScope`\n\n- Model: a DashScope OpenAI-compatible model name available to your account\n\n```\nexport OPENAI_COMPATIBLE_ENDPOINT=\"https://your-provider.example/v1/chat/completions\"\nexport OPENAI_COMPATIBLE_API_KEY=\"your_key_here\"\nnpm run ai:bridge\n```\n\nIn the app:\n\n- Provider:\n`Local AI bridge`\n\n- Bridge upstream:\n`Custom OpenAI-compatible`\n\n- Model: the provider's chat model name\n\nDo not put cloud API keys into a public GitHub Pages demo. Use local Ollama, a local OpenAI-compatible server, or the local AI bridge. If you host SmolSignal from a non-local origin and want it to call your local bridge, set `SMOLSIGNAL_ALLOWED_ORIGINS`\n\nbefore running the bridge:\n\n```\nSMOLSIGNAL_ALLOWED_ORIGINS=https://YOUR_USERNAME.github.io npm run ai:bridge\n```\n\nEvery analyzed capture gets a deterministic fingerprint:\n\n- Likely category.\n- Confidence score.\n- Stable\n`smol-*`\n\nsignature. - Protocol/device evidence.\n- Frequency band and modulation/preset summary.\n- Raw pulse/value statistics when available.\n- Safety warnings.\n\nThe fingerprint is intentionally conservative. A frequency band alone cannot classify a capture as safe or blocked; stronger protocol, text, and safety-gate evidence are required.\n\nSmolSignal includes a local protocol knowledge base for:\n\n- Consumer IR remotes.\n- Passive weather/sensor telemetry.\n- TPMS-style passive sensors.\n- Rolling-code/security remotes.\n- Automotive/key-fob risk.\n- Access-control credentials/tags.\n- General NFC tags.\n- GPIO/lab hardware.\n\nThis database powers the Shazam-style identity card and safe community library matching.\n\nSub-GHz sensor-like captures get a passive guide with:\n\n- Observations to record.\n- Safe documentation steps.\n- Clear\n`never do`\n\nboundaries. - No replay, no spoofing, no transmit workflow.\n\nThe IR Builder now supports:\n\n- Parsed Flipper\n`.ir`\n\nbutton import from the current capture. - Duplicate button-name validation.\n- Safe starter profiles from the local community library.\n- Markdown/JSON analysis reports that can include the AI explanation.\n\nUse the report buttons in the readout panel to export:\n\n- Markdown lab notes.\n- JSON analysis bundles.\n\nReports include the safety decision, fingerprint, evidence, passive guide, local RAG matches, safe community matches, photo metadata/notes, and optional AI explanation.\n\nThe Web Serial panel can request and open a USB serial connection in supported browsers.\n\nRequirements:\n\n- Chrome or Edge on desktop.\n- A secure context such as\n`localhost`\n\nor HTTPS. - Flipper connected over USB.\n\nCurrent scope:\n\n- Connection status.\n- USB vendor/product info when available.\n- Safe import/export workflow guidance.\n\nOut of scope:\n\n- Firmware updates.\n- Replay/transmit automation.\n- Credential operations.\n- Bypass or cloning flows.\n\nAttach an image of the device or remote and add a short note such as `hotel AC unit`\n\n, `Samsung TV`\n\n, or `outdoor weather sensor`\n\n. SmolSignal uses image metadata and your notes to improve the fingerprint and AI explanation context.\n\nThe app does not send raw image bytes to AI providers. Only file name, dimensions, and your notes are included in the safe prompt context.\n\nThe identity card combines:\n\n- Parsed Flipper metadata.\n- Protocol database matches.\n- Frequency and modulation features.\n- Photo context.\n- Local RAG snippets.\n- Safety-gate output.\n\nThe result is a plain-English likely category with confidence and evidence.\n\nSmolSignal includes a small local knowledge base and a browser-side vector search. It retrieves relevant safety/protocol snippets and can pass those snippets into the AI explainer as safe context.\n\nThe community library is local and safety-filtered. It includes only:\n\n- Consumer IR starter profiles.\n- Passive sensor note templates.\n- GPIO lab checklists.\n\nIt does not include vehicle, access, garage/gate, alarm, credential, or unknown-RF replay profiles.\n\nThe IR Builder creates Flipper-compatible files like this:\n\n```\nFiletype: IR signals file\nVersion: 1\n#\nname: Power\ntype: parsed\nprotocol: NEC\naddress: 00 FF 00 00\ncommand: 12 ED 00 00\n```\n\nSupported safe IR protocol labels in this MVP:\n\n`NEC`\n\n`NECext`\n\n`Samsung32`\n\n`RC5`\n\n`RC6`\n\n`Sony`\n\n`SIRC`\n\n`Panasonic`\n\n`JVC`\n\n```\nsrc/App.tsx                    Main React UI\nsrc/styles.css                 Responsive app styling\nsrc/lib/flipperParser.ts       Flipper text parser\nsrc/lib/safetyPolicy.ts        Safety classifier and explanations\nsrc/lib/aiClient.ts            AI provider client, prompt builder, and redaction\nsrc/lib/protocolDatabase.ts    Local protocol/device category database\nsrc/lib/fingerprintEngine.ts   Signal fingerprinting and confidence scoring\nsrc/lib/passiveSensor.ts       Passive sensor documentation mode\nsrc/lib/localRag.ts            Local vector search/RAG over built-in docs\nsrc/lib/communityLibrary.ts    Safe local profile/template library\nsrc/lib/reportExporter.ts      Markdown and JSON report exporters\nsrc/lib/irBuilder.ts           Safe .ir generator\nsrc/lib/samples.ts             Built-in demo captures\nserver/ai-bridge.mjs           Optional local bridge for cloud providers\nsrc/lib/*.test.ts              Unit tests\n```\n\nThis repo is ready to push as a normal static web app.\n\n```\ngit init\ngit add .\ngit commit -m \"Initial SmolSignal app\"\ngit branch -M main\ngit remote add origin https://github.com/YOUR_USERNAME/SmolSignal.git\ngit push -u origin main\n```\n\nIf this directory already has a git remote, inspect it first:\n\n```\ngit remote -v\ngit status\n```\n\nSmolSignal is a static Vite app, so it can be hosted on GitHub Pages, Netlify, Vercel, Cloudflare Pages, or any static host.\n\nFor GitHub Pages, set your repository Pages source to a built static deployment, or add a GitHub Actions workflow later that runs:\n\n```\nnpm ci\nnpm run build\n```\n\nand publishes `dist/`\n\n.\n\nMIT. See `LICENSE`\n\n.", "url": "https://wpnews.pro/news/show-hn-smolsignal-signal-copilot-for-flipper-zero-files", "canonical_source": "https://github.com/SmolNero/SmolSignal", "published_at": "2026-07-04 03:40:41+00:00", "updated_at": "2026-07-04 03:49:54.026163+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "generative-ai", "developer-tools"], "entities": ["SmolSignal", "Flipper Zero", "OpenAI", "DeepSeek", "Qwen", "Ollama", "llama.cpp", "vLLM"], "alternates": {"html": "https://wpnews.pro/news/show-hn-smolsignal-signal-copilot-for-flipper-zero-files", "markdown": "https://wpnews.pro/news/show-hn-smolsignal-signal-copilot-for-flipper-zero-files.md", "text": "https://wpnews.pro/news/show-hn-smolsignal-signal-copilot-for-flipper-zero-files.txt", "jsonld": "https://wpnews.pro/news/show-hn-smolsignal-signal-copilot-for-flipper-zero-files.jsonld"}}