MQTT filter syntax
Checks # placement, whole-level + usage, UTF-8 length, null characters, and broad root wildcards against MQTT topic-filter rules.
LOCAL MQTT SECURITY TOOL
Find risky MQTT topic permissions before deployment
Lint a fixed, line-based ACL document for MQTT wildcard mistakes and RunMQTT tenant, device, and direction risks. Analysis happens entirely in this browser tab.
INTERACTIVE CHECK
Lint an ACL document locally
Start from a safe or intentionally unsafe fixture. Findings point to line numbers without sending the document to RunMQTT or analytics.
Local-only analysis
Your policy stays in this browser tab. It is not uploaded, logged, placed in a URL, or saved to local storage.
Analyze the document to see line-specific findings.
FIXED INPUT CONTRACT
One explicit boundary per line
The format is deliberately small. It models a profile, an optional literal tenant scope, one principal, and directional ACL rules.
RunMQTT device fixture
// Comments start with //
profile runmqtt
scope tenants/acme
principal device sensor-42
publish tenants/acme/devices/sensor-42/telemetry
subscribe tenants/acme/devices/sensor-42/commands/#Use profile mqtt for protocol-only checks or profile runmqtt to add scope, device, and direction checks.
Each ACL rule starts with publish, subscribe, or both, followed by exactly one MQTT topic filter.
RunMQTT scope is a literal topic prefix used by the linter to detect tenant escape; it is not uploaded or added to a Broker.
RULE SET
Standards checks and product checks stay separate
Every finding is labeled MQTT or RunMQTT so a protocol requirement is not confused with a product-specific safety model.
Duplicates and overlaps
Finds duplicate permissions and filters that are already contained by a broader rule in the same direction.
RunMQTT boundaries
Checks that rules stay under the declared literal scope and that device principals do not use another device ID or wildcard.
RunMQTT direction heuristics
Flags device publish access to command channels, device subscribe access to telemetry channels, and bidirectional grants on directional channels.
METHOD AND FIXTURES
Reproducible rules, not a score
The linter returns deterministic rule codes and line numbers. It does not invent a security score or infer runtime enforcement.
MQTT syntax and overlap behavior are tied to the OASIS MQTT 5.0 topic rules.
Safe and intentionally unsafe fixtures are shared by the page and automated tests.
Parser, rule engine, fixtures, and tests are available in the public GitHub repository.
The repository MIT License covers the linter code and fixtures.
LIMITS
Static findings are not a security audit
A clear result means only that the supplied document passed the modeled checks. Broker configuration and negative authorization tests remain decisive.
The linter does not connect to a Broker or confirm its effective ACL behavior.
Deny precedence, inherited roles, shared subscriptions, and vendor extensions are not modeled.
Telemetry and command direction findings use naming conventions and require human review.
Do not paste credentials or payloads; the input format needs topic permissions only.
Continue the security review
Use the static findings to refine policy design, then verify expected and denied traffic against the real Broker.