Our new LTEClaw MCP server decodes LTE signals up to Layer 3 and detects terminal activity in the uplink. It can reveal cellular spy cameras that otherwise give no visible sign.
Wireless cameras with a built-in LTE modem are small, cheap and need no Wi-Fi or cabling. That makes them attractive for legitimate surveillance, but also for covert use in meeting rooms, hotels, labs or secured sites. Optical sweeps often miss them. Their radio transmissions are harder to hide.
With Y9535A LTEClaw, YOTASYS has built a tool that makes this activity visible. LTEClaw runs on the YOTACLAW platform and uses an Anritsu MS2090A to capture IQ data. An AI agent or a browser dashboard controls it. All signal processing happens locally, and the system works purely passively: it never transmits and never attaches to a network.
Key functions
- Downlink scan with decoder-style carrier table: Band, EARFCN, PCI, bandwidth, antenna ports, RSRP, RSRQ and SINR for every active LTE carrier.
- Layer 3 decoding (MIB and SIB1): MCC, MNC, operator, tracking area code, eNB ID, cell ID and sector. This shows which networks and sites are present around the receiver.
- Uplink terminal detection: For each carrier, LTEClaw analyses the matching uplink (FDD and TDD). It reports burst count, signal level, activity ratio and resource-block allocations. A strong, bursty signal in an otherwise quiet channel points to a terminal nearby, such as an LTE camera.
- Continuous monitor with alerts: Alerts are raised when activity starts and ends, with optional webhook delivery.
- Baseline comparison: New cells or changed cell identities relative to a trusted reference scan are flagged.
- Handover for localisation: Each alert stores its IQ capture as a signal event, so GeopositionClaw or IQClaw can take over to localise the source.
- Simulator and offline analysis: Train and test without an instrument, or analyse recorded IQ files.
What LTEClaw does not do: It decodes only broadcast system information, never user data, calls or subscriber identities. Terminals are detected, not identified. Very weak or distant devices below the receiver noise floor cannot be seen, so a missing detection is no proof of absence.
LTEClaw is a building block for counter-surveillance, site protection and RF security assessments. Use it only for authorised purposes in line with national telecommunications and data-protection law.
Interested in a demo? Contact us at info@yotasys.com.
