Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/HermeticOrmus/LibreEmbed-Claude-CodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/hermeticormus/libreembed-claude-code/firmware-update)<a href="https://agentmods.dev/commands/hermeticormus/libreembed-claude-code/firmware-update"><img src="https://agentmods.dev/badge/commands/hermeticormus/libreembed-claude-code/firmware-update/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/hermeticormus/libreembed-claude-code/firmware-update"><img src="https://agentmods.dev/badge/commands/hermeticormus/libreembed-claude-code/firmware-update.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.00816 |
| Opus 5.5 | $0.00006 | $0.00326 |
| Sonnet 5.5 | $0.00003 | $0.00163 |
| Haiku 4.5 | $0.00002 | $0.00082 |
Grade A, and why
firmware-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/firmware-update
Firmware OTA command: image packaging, distribution, flash write, verification, rollback.
Trigger
/firmware-update <action> [options]
Actions
package
Package a raw firmware binary with header and signature.
/firmware-update package --tool imgtool --key ecdsa-p256.pem --version 2.1.0 --slot-size 0x70000
/firmware-update package --custom-header --magic 0xDEADBEEF --crc32
distribute
Generate OTA distribution scripts or server configurations.
/firmware-update distribute --transport mqtt --broker mosquitto --topic-prefix device/fw
/firmware-update distribute --transport aws-iot-jobs --thing-group my-devices
/firmware-update distribute --transport http --server nginx --tls
apply
Generate MCU-side OTA write and verify code.
/firmware-update apply --mcu stm32f407 --banks dual --transport uart-ymodem
/firmware-update apply --mcu esp32 --sdk esp-idf --transport https
/firmware-update apply --mcu nrf52840 --bootloader mcuboot --transport ble-smp
verify
Generate post-write verification code.
/firmware-update verify --method crc32
/firmware-update verify --method sha256+ecdsa --curve p256
Process
- Define flash layout: bootloader size, bank A/B addresses, NVM region.
- Choose transport: MQTT for IoT, HTTPS for large payloads, BLE SMP for local.
- Implement write → verify → set-boot-flag → reset sequence.
- Implement confirm sequence with application-level self-test.
- Test power-loss simulation at each step.
Output Examples
imgtool sign and flash
# Package
imgtool sign \
--key signing-key.pem --header-size 0x20 --align 4 \
--version 2.1.0+0 --slot-size 0x70000 \
build/firmware.bin build/firmware_signed.bin
# Verify signed image
imgtool verify --key signing-key.pem build/firmware_signed.bin
# Flash bootloader + signed app
openocd -f interface/stlink.cfg -f target/stm32f4x.cfg \
-c "program mcuboot.bin 0x08000000 verify" \
-c "program firmware_signed.bin 0x08010000 verify reset exit"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago First seen · 108 lines · 16 tokens per session scan A 3d7731ccb492
firmware-update is a command published in the GitHub repository HermeticOrmus/LibreEmbed-Claude-Code (50 stars, last pushed 6d ago), licensed MIT. It adds 16 tokens to every session and 816 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-01.
Other commands, from other repositories
debug
A command-line debugging toolkit for embedded programs using J-Link or OpenOCD, tools that connect a computer to a microcontroller for inspection.
la
A command for capturing and decoding signals with a Saleae logic analyzer, a device that records electrical digital signals over time. It supports buses such as UART, SPI, and I2C, which are common ways chips communicate with peripherals.
flash
A command for writing firmware to a microcontroller using OpenOCD, a tool that programs chips through a connected debugging probe.
test
A command for generating and running tests for embedded C code, either on a computer or on a physical development board. It creates both runnable test code and a written list of test cases.
map
A parser for Keil compiler map files, which are build reports describing where program code and data are placed in memory. It reports object sizes, memory regions, symbols, and stack or heap details.
verify
An embedded-device verification workflow that checks a development step through building, flashing firmware, debugging with J-Link, and reading serial logs. Firmware is software that runs directly on a microcontroller or other device.