{
  "port": 1883,
  "protocol": "tcp",
  "service": "MQTT",
  "oneLiner": "An unencrypted MQTT broker — the message bus behind most IoT and home-automation setups.",
  "whatItIs": "MQTT is a publish/subscribe protocol standardized at OASIS; brokers listen on TCP 1883 for plaintext and 8883 for the TLS variant. The broker you found is most likely Mosquitto, EMQX, or HiveMQ, tying together Zigbee2MQTT, ESPHome nodes, Home Assistant, or industrial telemetry. Because a broker will hand any subscriber every retained message on a matching topic, one connection can dump the entire estate's state.",
  "exposure": {
    "verdict": "never",
    "note": "Port 1883 carries credentials and payloads in cleartext and brokers frequently allow anonymous connections; if a broker must be reachable externally, use TLS on 8883 with per-client credentials."
  },
  "checkCommand": "mosquitto_sub -h TARGET -p 1883 -t '$SYS/broker/version' -v -W 5",
  "links": [
    {
      "title": "MQTT Version 5.0 — OASIS Standard",
      "url": "https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 1883 (assigned to OASIS)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1883",
      "kind": "iana"
    },
    {
      "title": "eclipse-mosquitto/mosquitto",
      "url": "https://github.com/eclipse-mosquitto/mosquitto",
      "kind": "github"
    }
  ]
}