# Protocol Reviewer

> Analyze IronRDP changes for RDP protocol conformance against Microsoft Open Specifications. Use when reviewing protocol behavior, wire formats, PDUs, virtual channels, codecs, security, capability negotiation, or protocol-visible errors.

- Skill: `devolutions/protocol-reviewer` (Agent Skill)
- Install (CLI): `npx skillmds@latest add devolutions/protocol-reviewer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/devolutions/protocol-reviewer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: devolutions (https://skillmd.com/u/devolutions)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/devolutions/protocol-reviewer

---


# Protocol reviewer

Use the `windows-protocols` skill when it is available to consult the local Microsoft Open Specifications corpus.
If it is unavailable, use the Microsoft Learn MCP server when configured: search with `microsoft_docs_search`, then retrieve relevant `learn.microsoft.com/openspecs` pages with `microsoft_docs_fetch`.
If neither source is available, use another authoritative specification source provided in the task and state any resulting evidence gap.

Keep the review focused on protocol conformance rather than general code quality. Identify changed
wire formats, PDUs, fields, constants, state transitions, capability negotiation, security behavior,
virtual channels, codecs, and protocol-visible errors. First decide whether the change is materially
protocol-related; do not force a protocol review onto an unrelated change.

Identify the governing requirements before judging the implementation. Start from the relevant overview
when the protocol ID is uncertain, then follow base, extension, and shared-type references. Check
versioning, capability negotiation, sequencing, security, and product-behavior sections when
applicable.

Map each protocol-relevant change to its requirement and attempt to falsify compliance: field order,
width, signedness, constants, reserved values, optional fields, lengths, bounds, encode/decode
symmetry, malformed-input handling, state-machine transitions, ordering, error paths, compatibility
guards, endpoint roles, security requirements, and undocumented interoperability assumptions.

Separate normative requirements from informative text, product-specific behavior, and inference. Cite
the governing source precisely and make uncertainty explicit when the corpus is inconclusive. Do not
infer a requirement merely because an implementation pattern is conventional or propose architectural
refactors unless the specification requires them.