RDP automation and inspection
lamco-rdp-tools
Two command-line tools for RDP: one inspects a server, one drives it.
lamco-rdp-tools is two small command-line tools for RDP. rdpsee inspects a server without logging in, and rdpdo drives a session the way vncdotool drives VNC, taken well past it. Built by Lamco Development LLC.
rdpsee and rdpdo
|
Linux and Windows, 64-bit
|
Built on IronRDP
|
MIT OR Apache-2.0
The command-line tools RDP never had
RDP never had the command-line tools that VNC users take for granted. In the VNC world you reach for vncdotool to type and click and capture a screen from a script, and for openQA when you want visual testing. On RDP there was nothing clean: a couple of dead or heavy Python projects, and otherwise FreeRDP wrapped in a virtual display. lamco-rdp-tools closes that gap with two tools.
rdpsee observes. It inspects a server and never changes it: a pre-authentication security scan across a whole subnet, the TLS certificate, a stable fingerprint, the negotiated capabilities, and a screenshot, all without a login where the server allows it.
rdpdo acts. It completes a session and drives it: keyboard and mouse input, screen capture, visual matching, clipboard and file transfer, audio capture, provisioning, and session recording, chained on one connection. It started as the vncdotool for RDP and went past it, into visual testing, audio verification, and CI output that no VNC tool offers either.
Neither needs an agent installed in the guest. Both are standalone binaries that talk to any standards-compliant RDP server.
Observe, then act
rdpsee only ever reads, so it is safe to point at production or at a host you are auditing. rdpdo is the one that types and clicks and changes state. "What is this server?" is rdpsee. "Make this server do something" is rdpdo. Most real work uses both: inspect first, then act.
rdpsee observes
Reads only. Never changes the server.
Three depths, from a probe that never opens a session to a full login.
- 1No login: scan a subnet, read the certificate, take a fingerprint.
- 2Optional login: a screenshot of the login screen or the desktop.
- 3With credentials: the full negotiated capability report.
rdpdo acts
Logs in. Types, clicks, captures, asserts.
A chain of commands on one connection.
- →Log in and wait for the screen to settle.
- →Type, click by matching an on-screen image, and assert the result.
- →Write a JUnit or JSON report for CI.
Inspect a server
rdpsee runs one command per invocation and works at three depths, from a probe that never opens a session to a full login.| Command | What it tells you | Login |
|---|---|---|
| scan | Pre-auth security posture for one host or a whole subnet: the selected protocol, whether NLA is required, and capability flags. Probes a CIDR range concurrently. | None |
| cert | The server's TLS certificate: subject, issuer, validity, algorithms, SANs, SHA-256. | None |
| id | A stable JA4-style fingerprint of the server's configuration, plus the certificate's SHA-256. | None |
| report | The negotiated capabilities: security, desktop size, color depth, graphics tier, codecs, channels. | Only with credentials |
| shot | A screenshot: the login screen with no credentials where allowed, the desktop with them. | Optional |
# Find every RDP host in a range and fail CI if any allows weak security
rdpsee scan 10.0.0.0/24 --ci --expect tls,nla
# Inspect one server's certificate and fingerprint, no login
rdpsee -s 192.168.1.10 cert
rdpsee -s 192.168.1.10 id
rdpsee scan reads a server's security posture before authenticating, across a subnet, in one command. The VNC and RDP worlds had nothing that does exactly that.
Drive a session
rdpdo takes a chain of commands and runs them in order on one connection. The same invocation can log in, wait for the screen, type, click by matching an on-screen image, and assert the result. About 60 commands across 13 categories.Input
Type, key, click, drag, scroll, type a password without logging it.
Capture
Full screen, a region, to stdout, or a timelapse.
Visual matching
Wait for the screen or a template image to appear, click a matched image, measure how long a match takes, diff two images.
Stability
Wait until the screen settles or changes.
Clipboard
Set and read text, send and receive files.
Display
Resize, multi-monitor.
Audio
Capture the RDP audio stream and assert it is playing or matches a reference.
Pixel
Read a pixel, assert a color, find a color, checksum a region.
Provisioning
Accept a portal prompt, unlock, log in, run a boot sequence.
Calibration
Generate a click-offset profile and apply it.
Scripting
Run a script, record and replay a session, retry, soft-fail.
Baseline
Save and check named reference images.
Info
Connection info, performance metrics, status, and the built-in help.
# Log in, wait for the desktop, run a visual check, and write a JUnit report for CI
rdpdo -s 192.168.1.10 -u user -p pass --junit results.xml \
type "user" key tab type-password env:RDP_PASSWORD key enter \
expect baselines/desktop.png 0.95 60
Audio verification
RDP carries audio, and rdpdo can confirm sound is playing or matches a reference.
Visual testing with CI output
expect plus --junit and --fail-capture.
Record and replay
Capture a session and replay it as an editable script.
Three capabilities no VNC tool offers either.
The tools it supersedes
The VNC world has had mature command-line tools for years. vncdotool automates VNC from a script, vncsnapshot grabs a screen, and openQA does visual testing. They are good, and if you are on VNC you should use them. RDP had no equal. The closest tools were Python projects that have either stopped (rdpy is unmaintained) or that aim at a different job (PyRDP is built for man-in-the-middle and forensic capture, not desktop automation), plus aardwolf (a young headless client) and the common workaround of FreeRDP driven inside a virtual X display, which is awkward to script and needs a display server. For security-style screenshots there is scrying, a solid multi-target scanner, but it does not drive a session or report capabilities.
lamco-rdp-tools replaces that scatter with two static binaries. rdpdo does what vncdotool does, then adds visual matching, audio verification, recording, and CI output. rdpsee does the inspection and reconnaissance no single RDP tool packaged cleanly before. There is no Python to install and no guest agent to deploy.
| rdpsee + rdpdo | vncdotool | aardwolf | FreeRDP + xdotool | scrying | |
|---|---|---|---|---|---|
| Protocol | RDP | VNC | RDP | RDP | RDP, VNC, web |
| Drives a session | yes (rdpdo) | yes | partial | yes, clunky | no |
| Inspects pre-auth | yes (rdpsee) | no | no | no | partial (screenshot) |
| Visual matching | yes | no | no | no | no |
| Audio verification | yes | no | no | no | no |
| CI output (JSON, JUnit) | yes | no | no | no | no |
| Language / form | Rust, static binaries | Python | Python | C plus shell | Rust |
| Guest agent | none | none | none | none | none |
Fair routing: If you are on VNC, use vncdotool and openQA. If you need RDP man-in-the-middle or forensic capture, PyRDP is built for that. For everything else on RDP, automation, testing, provisioning, and inspection, this is the toolkit.
Two commands to try it
# Inspect a server (no login)
rdpsee -s 192.168.1.10 scan
rdpsee -s 192.168.1.10 report
# Drive a session
rdpdo -s 192.168.1.10 -u user -p pass \
type "hello" key enter capture /tmp/out.png
From here, the getting-started tutorial and how-to guides in the repository cover the rest.
Available today through GitHub Releases
Download a signed binary for your platform below, or browse the full GitHub release. The single release carries a Linux .tar.gz and a Windows .zip, each signed, plus SHA256SUMS. Verify the checksums and put the binaries on your PATH. Or build from source with a recent Rust toolchain. Other channels are being prepared.
Checksums and GPG signatures (SHA256SUMS and the .asc files) are on the v1.1.1 release page.
# From the GitHub release: download the Linux .tar.gz or Windows .zip plus SHA256SUMS, verify, install
# (the release page lists the exact asset names for your platform)
# Or build from source
git clone https://github.com/lamco-admin/lamco-rdp-tools.git
cd lamco-rdp-tools
cargo build --release
# binaries: target/release/rdpsee and target/release/rdpdo
Requirements: a reachable RDP target. Optional: the OpenH264 library for H.264 decode, loaded at runtime. Without it, other codecs still decode.
Runs on Windows too
rdpsee and rdpdo run on Windows as well as Linux. The release includes rdpsee.exe and rdpdo.exe, built for 64-bit Windows and statically linked, so each is a single file you can unzip and run with nothing else to install. The commands are identical to the Linux versions; only the binary differs. For H.264 decode, drop openh264.dll next to the exe; without it, the other codecs still decode. The binaries are not yet Authenticode-signed, so Windows shows a one-time SmartScreen warning the first time you run them. Configuration lives under %APPDATA%\rdpdo\.
Two binaries, one release
lamco-rdp-tools 1.1.1, June 2026, now for Linux and Windows. The two binaries, rdpsee and rdpdo, ship and version together from one project, built and documented the same way. Built with Rust (edition 2024, MSRV 1.89) on the IronRDP protocol stack.
Ownership and license
Developed by Lamco Development LLC. The intellectual-property transfer completed on 2026-06-02. lamco-rdp-tools is dual-licensed MIT OR Apache-2.0.
(c) 2025-2026 Lamco Development LLC. All rights reserved.
Works with Lamco RDP Server, and any standards-compliant RDP server
The same team tests Lamco RDP Server, the Wayland-native RDP server, with these tools, and they work against any standards-compliant RDP server. Use rdpsee to scan and inspect a server and rdpdo to drive and test it. For the whole RDP-on-Linux picture, see the RDP focus area.