How yagohehe/iotgpt works
IoTGPT combines a background MQTT intrusion-detection pipeline with an operator-facing LLM agent. Simulated traffic is stored and classified in two stages; the agent then answers operator queries using predictions, event history, and RAG documentation, and can submit mitigation plans for human review. The graph preserves the documented evaluation capability but omits experiment runners and training/deployment machinery. Edges for the classifier pipeline and some integrations follow README statements; unsampled implementation details are not inferred.
Main entry points: tools.py Agent tools · agent.py ReAct agent · ml_models_classification.py Binary detection · dashboard.html Web dashboard
Components 16
Traffic and IDS
- MQTT simulator
simulator/mqtt_log_simulator.py - Event store
- Binary detection
classifier/ml_models_classification.py - Attack classification
classifier/ml_models_classification.py - Prediction store
Agent and RAG
- ReAct agent
app/agent.py - System prompts
app/prompt - Agent tools
app/tools.py - RAG knowledge
app/rag_doc - Chroma index
app/chroma_mqtt_qwen
Operator interface
- Web dashboard
app/static/dashboard.html - FastAPI backend
app/server.py
Human review
- HITL requests
- HITL API
app/hitl_routes.py
Evaluation
- Agent evaluation
evaluation/runners/exp2b_agent_qualitative.py
Other components
- Security operator
Connections 17
- MQTT simulator → Event store: inserts events
README.md - Event store → Binary detection: classifies events
README.md - Binary detection → Attack classification: classifies attacks
README.md - Attack classification → Prediction store: writes predictions
README.md - Security operator → Web dashboard: uses
README.md - Web dashboard → FastAPI backend: queries
app/server.py - FastAPI backend → ReAct agent: invokes
app/server.py - ReAct agent → System prompts: loads
app/agent.py - ReAct agent → Agent tools: invokes tools
app/agent.py - Agent tools → Prediction store: queries
README.md - Agent tools → Event store: queries
README.md - Agent tools → RAG knowledge: retrieves context
README.md - Agent tools → Chroma index: uses index
app/tools.py - Agent tools → HITL requests: creates request
README.md - Security operator → HITL API: reviews plans
README.md - HITL API → HITL requests: reads and updates
app/hitl_routes.py - Agent evaluation → ReAct agent: evaluates
evaluation/runners/exp2b_agent_qualitative.py