pnokerandClaude Code
43aeb11fea
H4 (SSRF): every user-supplied base URL now passes AgenticBaseUrlValidator
(http/https only; all resolved addresses must be public — loopback, private,
link-local, CGNAT, TEST-NET, reserved and ULA ranges rejected, DNS-rebinding
multi-answer included, verdicts cached 30s). Draft probes, stored-provider
probes (including model-config checks) and provider add/update all validate
through it, and probing a stored provider against a different base URL
requires an explicit API key so the stored key is never replayed to an
arbitrary host.
H5 (plaintext keys at rest): new AgenticKeyCipher (AES-256-GCM envelope,
enc:v1:<base64(iv||ciphertext||tag)>). R2dbcModelProviderStore encrypts on
write and decrypts on read; legacy plaintext rows pass through on read and
upgrade to ciphertext on the next write (lazy migration). Master key resolves
from dc3.agentic.security-master-key, then DC3_AGENTIC_MASTER_KEY, then a
stable HKDF-SHA256 derivation from DC3_SECURITY_KEY (warned once at startup);
decrypt failures fail loudly instead of degrading to plaintext.
M25/M38 (unbounded check caches): connectivity results move to bounded
Caffeine caches — stored results capped by check-cache-maximum-size/TTL,
draft probes (client-material keys) in a separate 32-entry partition with
half the TTL — and the in-flight merge map is capped, running probes
unmerged past the cap instead of growing.
M26/M35 (half-finished throttling): the platform-wide fallback is now
opt-in (transport-fallback-enabled, default false) — tenants without a model
configuration get a clear 503 problem instead of silently using the global
key; the fallback client is never cached. Cache-miss/unknown-model acquires
are throttled by the global semaphore, acquire waits are bounded by
transport-acquire-timeout-seconds (fast 503 on timeout, no event-loop
blocking — the wait parks on the virtual-thread slot scheduler), and chat
entries pass a per-tenant QPS token-bucket gate (transport-per-tenant-qps,
429 on overflow, 0 disables).
M19/M36 (no cache TTL): the four ChatClientFactory caches expire after
transport-cache-ttl-seconds, so out-of-band provider edits stop serving
stale transports.
H9 (zero metrics): Micrometer instrumentation — provider/global semaphore
permit gauges and acquire-timeout counter in ChatClientFactory,
agentic.chat.requests{tenant,provider,model,result} counter plus a duration
timer and a per-tenant QPS gate counter in AgenticChatServiceImpl, and an
agentic.check.results{kind,result} counter for connectivity probes.
H10 (broken trace): new RequestIdContextPropagationConfig in dc3-common-web
registers a ThreadLocalAccessor bridging the dc3.requestId Reactor context
key into the MDC (mirroring the MQ module precedent) and enables automatic
context propagation, so requestId reaches every thread a reactive chain hops
to and flows through the insight RPC chain.
L54 (insight error leakage): InsightTool failures now answer the model with
a stable, category-classified phrase (network/storage/invalid
request/unexpected) plus the correlated requestId, capped at 200 chars;
internal details only reach the server log.
L58 (logs missing tenant): chat lifecycle logs carry tenantId, userId and
durationMs (no request content, no credentials).
Co-Authored-By: Claude Code <noreply@anthropic.com>
English | 中文 | 日本語 | Tiếng Việt | 한국어 | Español | Русский
AI assistants: Read README.ai.md first for a concise, AI-friendly overview of IoT DC3.
IoT DC3 — Connect the Physical World to AI
An open-source Industrial IoT Runtime for Physical AI
🔌 Multi-protocol connectivity · 🤖 MCP tool gateway · ☁️ Cloud-native microservices
IoT DC3 decouples devices from applications: drivers push normalized point data into a message bus, and applications consume it through one unified API — add or change devices without touching applications, and build new applications without touching devices.
📸 Product Preview
| 📸 Platform Overview | 📸 Device Management | 📸 AI Agent |
|---|---|---|
Home / Dashboard System overview · Online device metrics · Data trend charts |
Device Management Device list · Online status · Search and filtering |
AI Agent Assistant Natural-language device queries · Data insights · Governed execution |
🏗️ Architecture Overview
Architecture at a Glance
Six-layer microservice architecture at a glance: clients → gateway → four center services → message bus → 36 protocol drivers → field devices. PostgreSQL (TimescaleDB + pgvector + AGE) persistence and optional observability stack (ELK + Prometheus + Grafana) laid out in one view.
🧱 Design principles — cross-service calls always go through Facade interfaces; the DO/BO/VO three-tier model keeps persistence, business, and API shapes strictly separated; and tenant isolation runs end to end across database, cache, and API paths. Clear boundaries that scale across services and teams.
📖 For the full architecture documentation, see System Architecture Overview.
✨ Core Features
🔌 Multi-Protocol Device Connectivity
IoT DC3 includes 36 access driver modules for industrial automation, IoT communication, data bridging, basic communication, and simulation/debugging scenarios, reducing the cost of connecting common devices and data sources:
| Category | Driver Modules |
|---|---|
| 🏭 Industrial protocols | Modbus TCP · Modbus RTU · OPC UA · OPC DA · Siemens S7 · BACnet/IP · EtherNet/IP · Omron FINS · Mitsubishi MELSEC · IEC 60870-5-104 · IEC 61850 · DNP3 · DLMS · DLT645 · KNX · M-Bus · SL651 |
| 📡 IoT protocols | MQTT · CoAP · LwM2M · HTTP · BLE · Zigbee · LoRaWAN |
| 🗄️ Data bridging | MySQL · PostgreSQL · Oracle · SQL Server · Redis |
| 🔧 Basic communication, messaging and NMS | TCP/UDP · Serial · SNMP · CAN · Kafka |
| 🧪 Simulation and debugging | Virtual · Listening Virtual |
The Driver SDK supports fast development of custom protocol drivers and registration into the runtime platform.
🤖 From Device Data to Physical AI
The Agentic Center is built on Spring AI, and the platform exposes an MCP tool gateway so AI agents can act on the physical world in one safe, controllable, traceable loop:
- MCP tool gateway — external AI agents connect through the Model Context Protocol: OAuth client registration, per-tool authorization, and a full audit trail for every tool call
- Natural-language assisted operations - through Tool Calling and under access control, LLMs can query devices, read/write points, and assist with command execution
- Intelligent alarm analysis - AI assists with root-cause analysis and response suggestions
- Data insights - Query device data in natural language and generate visual charts
- Multi-model support - Compatible with OpenAI API-style providers and mainstream models such as GPT, Claude, DeepSeek, and Qwen
- Conversation memory - Multi-turn conversations and context memory persisted to the database
🏗️ Cloud-Native Microservices
Distributed microservice architecture based on Spring Boot 4 + Spring Cloud 2025:
- Service governance - Spring Cloud Gateway as the unified entrypoint, with static routes and flexible environment variables
- Efficient communication - gRPC service calls with Protobuf serialization
- Horizontal scaling - Stateless design for scaling individual services by workload
- Resilience - Replaceable service nodes and fault isolation
📊 Real-Time Data Engine
- Data collection - Drivers collect device telemetry and send it asynchronously through the internal message broker — pluggable per deployment: RabbitMQ (default), Kafka, Pulsar or any MQTT 5 broker
- Time-series storage - Efficient queries for real-time and historical data
- Rule engine - Flexible alarm rules with multi-level alarms and notifications
- Event traceability - Full command and event history
🔐 Enterprise Security and Multi-Tenancy
- Tenant isolation - Tenant-level isolation across database, cache, and API paths
- Authentication and authorization - JWT + Spring Security with RBAC
- Transport encryption - TLS/SSL communication support
- Audit tracking - User operation and system event logs
🧩 Developer Friendly
- Driver SDK - A complete driver development toolkit. See the Driver Authoring Guide
- Separated frontend and backend - Vue 3 + TypeScript frontend, RESTful and gRPC APIs
- Containerized deployment - One-command startup with Podman / Docker Compose, plus compose scaling, Docker Swarm, Kubernetes and Helm deployment configs. See the Deployment Guide.
- Complete documentation - Online docs, quickstart guide, and troubleshooting guide
⚡ Quick Start
For source-based local development, start PostgreSQL and RabbitMQ, load local environment variables, then build:
make up-db
source dc3/env/dev.env.sh
mvn -s .mvn/settings.xml clean package
Use make up-db-cn if you prefer the Alibaba Cloud registry in Mainland China.
📖 For service startup order, IDE setup, verification commands, and common pitfalls, see the full Quickstart.
🛠️ Technology Stack
IoT DC3 is built on Java 21, Spring Boot 4, Spring Cloud 2025, Spring AI 2, PostgreSQL, a pluggable message broker (RabbitMQ, Kafka, Pulsar or MQTT 5), gRPC, Vue 3, TypeScript, and Vite.
See Technology Stack for component details and where each technology is used.
📖 Documentation and Community
| Resource | Link |
|---|---|
| 📚 Online docs | docs.dc3.site |
| 🎬 Live demo | demo.dc3.site |
| 🏭 Industry demos | dc3.site/en/demo |
| 🚀 Quickstart | Quickstart Guide |
| 🛠️ Technology stack | Technology Stack |
| 🏗️ Architecture | Modules and Dependencies |
| 🔧 Driver development | Driver Authoring Guide |
| 🐛 Troubleshooting | Troubleshooting |
| 📋 Changelog | Release Changelog |
| 💰 Pricing & licensing | Plans and commercial license |
| 🐛 Issue feedback | GitHub Issues |
| 🇨🇳 Gitee mirror | Gitee GVP Project |
🌍 Use Cases
Twelve illustrative industry dashboards — built on IoT DC3 with mock data — show how the platform lands in each scenario. Browse all demos.
| 🏭 Smart Factory — OEE monitoring | 💧 Water Network — digital twin | ⚡ Microgrid — solar-storage balance |
| 🌾 Precision Agriculture — greenhouse climate | 🏢 Smart Building — HVAC and occupancy | 🚦 Smart Traffic — congestion and signals |
| 🛢️ Oil & Gas Pipeline — line pressure | ⛏️ Smart Mine — gas and ventilation | ❄️ Cold Chain — temperature traceability |
| 🌿 Environmental Monitoring — air and water quality | ⚓ Smart Port — berth and yard scheduling | 🔌 EV Charging — load and storage synergy |
🤝 Contributing
Contributions of all kinds are welcome. Please follow this workflow:
- Fork and branch - Create a branch from
main, using the formatfeature/your_name/feature_description(for example:feature/pnoker/mqtt_driver) - Develop and commit - Complete your changes on the new branch and follow the Conventional Commits specification
- Open a PR - Submit a Pull Request to the
developbranch for maintainer review and merge
📄 License
IoT DC3 is open source under the AGPL 3.0 license.
- ✅ Personal learning, research, and internal use - Free
- ✅ Modify the code and open source your changes - Welcome
- ⚠️ Offering it as a commercial service to third parties without open-sourcing modifications - Requires a commercial license
For commercial licensing details, see LICENSE.txt.