probe0 emulates a whole embedded system in software and hands it to your agent over MCP. Snapshot a running board, fork it a thousand ways, and read back why each branch died.
Boards and buses we target
Coding agents are good at web because the feedback loop is free and instant. They fall apart on firmware because the loop needs a human wiring a board to a debugger. It isn't a knowledge gap. They just can't see the hardware.
Route it, send it to fab, wait.
Board lands. Flash it. It dies in driver init.
One sensor value, one microsecond, gone.
Guess, respin, wait again. Repeat.
2–6 wks
Every hardware iteration, before a single line of firmware gets validated.
#1
Hardware dependency ranks as the biggest blocker to continuous delivery in embedded.
arXiv, Embedded DevOps: A Survey
0
Boards an agent can touch today without a human holding the debugger.
Existing simulators are session-shaped. The core object is a running sim that a person watches, with a machine interface bolted on afterwards. In probe0 the core object is an immutable state snapshot plus a transition. That difference is architectural, and it's why forking costs us almost nothing and costs them a rewrite.
Snapshot the whole system at cycle N: registers, RAM, flash, peripheral state, in-flight bus transactions. Then fork it N ways. Each branch runs independently from an identical start, so debugging stops being linear guess-and-check and becomes parallel tree search.
Sub-second cold start, no persistent VM, no license server. An agent asks for a thousand boards for twenty seconds, then they're gone.
A typed object carrying a cause chain and a minimal reproduction the agent can replay directly.
No library covers every part, so the library generates itself. Every model a user builds improves it for everyone.
Same input, same cycle count, same result. Reproducible CI, replayable failures, and a check you can point at in review.
A failure comes back as a typed object: what broke, the chain of events that produced it, a minimal reproduction, and the registers worth reading next. Scroll to walk the chain.
A typed failure carrying the expression that blew up and the line it blew up on.
imu_ready @ drivers/imu.c:212
At t=1.204 an I²C read to 0x68 came back NACK. First observable symptom.
The BMI270 model was in SUSPEND, so it was never going to answer.
Register 0x7D, the wake command, was never issued to the device.
bmi270_wake() gets branched around whenever BOOT_FAST=1. That is the root cause.
The trace carries the fork handle and the mutation, so replay is a single call.
fork cycle_88231 · set BOOT_FAST=1
{
"failure": { "type": "assert",
"expr": "imu_ready",
"loc": "drivers/imu.c:212" },
"cause_chain": [
{ "t": 1.204, "event": "i2c1_read",
"result": "NACK", "addr": "0x68" },
{ "reason": "BMI270 model in SUSPEND state" },
{ "reason": "register 0x7D never written" },
{ "reason": "init skipped bmi270_wake()
when BOOT_FAST=1" }
],
"minimal_repro": { "fork": "cycle_88231",
"set": { "BOOT_FAST": 1 } },
"suggested_inspect": ["0x7D", "PWR_CTRL"]
}
An MCP server and one static CLI binary. Wire it into Claude Code, Cursor, Codex, or your own harness. Every session carries a sim-second budget and a fork ceiling, because an agent should never be able to burn unbounded compute.
snapshot(label?)
Capture full machine state, return a handle
fork(handle, n, mutations[])
Branch N futures from one snapshot
replay(run_id)
Deterministic re-run of a prior execution
get_trace(run_id)
Structured causal failure object
boot(firmware, platform)
Load a binary and start the emulation
run(cycles?, until?)
Advance execution
step(n)
Single-step instructions
read_reg(name)
Read a CPU or peripheral register
write_mem(addr, bytes)
Write guest memory
inject_i2c(bus, addr, data)
Push bus traffic into the system
inject_sensor(model, value)
Set a peripheral model's reported value
list_peripherals()
Enumerate the emulated system
fuzz(param, range, n)
Sweep a parameter across N forks
generate_model(datasheet_pdf)
Datasheet to behavioral peripheral model
Serial debugging walks one path and backtracks. Fork search walks all of them at once and reports only the branches that diverged.
Click the grid to fork every live branch.
Every node is an independent machine state descended from the same cycle. A faulted branch stops there. A real agent pulls its trace and forks again from the last good state.
4 machine states at depth 1.
Every emulator has a fidelity gap. Most vendors leave you to find theirs on a bench at 2am. We run identical firmware on emulated and real silicon, diff the register traces, and publish the divergence, so you know which bug classes probe0 is accountable for before you trust it with one of yours.
Early access is small and hands-on. We want the failure you have already burned two board spins on.
Join the waitlist