The classic SocketCAN userspace utilities on Linux — candump, cansend, cangen, cansniffer, plus ISO-TP tools — for capturing, injecting and replaying raw CAN traffic.
Why it matters: line-oriented text in, line-oriented text out. candump output is trivially parseable and cansend takes a single string — the most agent-friendly seam onto a bus there is, with zero library binding required.
The de-facto Python CAN library — one Bus abstraction over dozens of interfaces (SocketCAN, PCAN, Vector, Kvaser, SLCAN, virtual), with message send/receive, filtering and logging.
Why it matters: a single hardware-agnostic API in the language agents write most fluently. An agent can open a bus, send a frame and read a response without caring which adapter is plugged in.
Parses CAN database files (DBC, KCD, SYM, ARXML) and encodes/decodes messages to and from named signals, with a live candump-style monitor built in.
Why it matters: it turns opaque bytes into named signals and back. Point an agent at a DBC and raw frames stop being a mystery — it can reason about EngineSpeed, not 0x0C1 byte 2.
A pure-Python implementation of ISO-TP (ISO 15765-2) — the transport layer that segments and reassembles multi-frame messages larger than a single 8-byte CAN frame.
Why it matters: diagnostics don't fit in 8 bytes. ISO-TP is the layer between raw CAN and UDS; an agent needs it to send and receive the longer payloads real diagnostic sessions require.
A Python client for UDS (ISO 14229) — the unified diagnostic services protocol — with typed request/response objects for sessions, reads, DTCs, routine control and security access.
Why it matters: UDS is how you actually talk to an ECU — read a DTC, run a routine, flash. Typed request objects are a structured API an agent can compose against instead of hand-packing service bytes.
The packet-crafting framework's automotive contrib layer speaks CAN, ISO-TP, UDS, GMLAN and SOME/IP — building, sending and dissecting frames for testing and fuzzing.
Why it matters: one scriptable object model spanning the whole automotive protocol stack. An agent can generate a malformed frame, send it, and dissect the reply — the build-run-observe loop security testing needs.
A listener-and-modules toolkit for automotive security testing — discovery, DCM/UDS probing, XCP and fuzzing — often described as "the nmap of CAN."
Why it matters: it packages the reconnaissance an agent would otherwise script from scratch — enumerate ECUs, find diagnostic services, probe access — into modules callable from the command line.
A cross-platform Qt GUI for capturing, analysing and reverse-engineering CAN traffic — with graphing, DBC handling, frame comparison and scripting.
Why it matters: the human-in-the-loop counterpart. When an agent needs a person to sanity-check a capture or reverse an unknown signal, SavvyCAN is the shared surface — and its saved captures feed straight back into the scripted tools above.
Open-source firmware for low-cost USB-to-CAN adapters, exposed to the OS through the mainline Linux gs_usb driver so the device shows up as a native SocketCAN interface.
Why it matters: the open hardware seam under everything above. A gs_usb adapter appears as a plain can0, which means every tool on this list — and every agent driving them — works unchanged, on a €30 dongle.
How to read this list: it's a running register, not a leaderboard. Projects sit at very different maturity levels and serve different roles — CLI, library, decoder, transport, diagnostics, security, hardware; the ordering is frames-up, not best-to-worst. Verify each against its own repository before adopting. Maintain one of these and want a correction, or your project added? Get in touch — no cost, no spam.