Rotifer v0.7.9: Trust Shield — Security Scanning for the AI Agent Ecosystem

VirusTotal tells you “not a virus.” But in an ecosystem of 38,000+ AI agent tools, “not a virus” is a low bar. After the ClawHavoc incident exposed 1,184 malicious Skills on ClawHub, the real question shifted from “is this safe?” to “is this actually good?”

v0.7.9 answers that question with three things: a static security scanner, a badge system anyone can embed, and a cross-layer alignment audit that closes every gap between CLI, MCP Server, and the browser.

Both @rotifer/playground and @rotifer/mcp-server are updated on npm.

V(g) Security Scanner

rotifer vg is a new CLI command that performs static analysis on AI tool source code. It scans for seven categories of risk, from code execution patterns to suspicious network calls:

rotifer vg scan ./my-skill/src

Output:

{
  "grade": "B",
  "findings": [
    {
      "rule": "S-04",
      "severity": "HIGH",
      "file": "src/api.ts",
      "line": 42,
      "snippet": "fetch('https://api.openai.com/...')",
      "note": "Known API endpoint"
    }
  ],
  "stats": { "files_scanned": 3, "lines_of_code": 245 }
}

The Seven Rules

Grading: A Through D

Results roll up into a letter grade:

The scanner only reports objective facts — “found eval() at line 17” — never claims malicious intent. It’s a complement to VirusTotal, not a replacement.

Badge System: badge.rotifer.dev

Every scan result feeds into a badge service running on Cloudflare Workers. The endpoint follows the shields.io JSON schema, so any developer can drop a trust badge into their README:

![Safety](https://img.shields.io/endpoint?url=https://badge.rotifer.dev/safety/@author/my-skill)

Four badge types are available:

Responses are cached for one hour and served over CORS for embedding anywhere.

Badge Generator

A dedicated page lets you generate badge markup without touching the API directly. Enter a tool name, see a live preview across four badge styles (flat, flat-square, for-the-badge, plastic), and copy the Markdown with one click.

Top 50 Scan: What We Found

We scanned the 50 most-installed Skills on ClawHub to establish a baseline. The full report is published separately, but the headline: 100% of scannable Skills triggered at least one finding.

This doesn’t mean 100% of Skills are dangerous — fetch() is how API-wrapping tools work. But it does mean the ecosystem lacks visibility into what tools actually do at the code level.

Grade distribution:

The absence of any Grade A result is notable. Even well-intentioned tools typically make at least one fetch() call that the scanner flags. The question isn’t whether findings exist — it’s whether they’re justified.

Important: these results describe code patterns, not malicious intent. A Grade D tool might be perfectly safe if its eval() usage is deliberate and sandboxed. The scanner provides data; developers provide judgment.

WebMCP: From Declaration to Execution

Prior to v0.7.9, the WebMCP tools on our marketplace site were declaration-only — <form hidden> tags that told browser agents what tools existed, but couldn’t actually run them. Agents would discover 5 tools and then… nothing.

Now there are 13 WebMCP tools with full browser-native execution:

Each tool uses navigator.modelContext.registerTool() to provide a real execute() function. When a browser agent calls get_gene_detail(name="search.web.google-v2"), the tool resolves the human-readable name to a UUID via a shared resolveGeneId() function, fetches the data from the cloud API, and returns structured results.

This is WebMCP as it was meant to work: tools that run inside the browser, using the user’s already-authenticated session, with same-origin protection. No additional API keys needed.

Cross-Layer Alignment: CLI ↔ MCP ↔ WebMCP ↔ Docs

A systematic cross-layer audit exposed gaps at every junction:

The MCP documentation now groups all 28 tools into four categories — Gene Lifecycle, Query & Discovery, Arena & Reputation, and Agent & Auth — with parameter descriptions and example responses for each.

CLI ↔ MCP Mapping

A new reference table in the MCP setup guide shows developers which CLI commands correspond to which MCP tools:

CLI: rotifer search <query>     →  MCP: search_genes
CLI: rotifer info <gene-id>     →  MCP: get_gene_detail
CLI: rotifer vg scan <path>     →  (CLI only — local scanning)
MCP: get_mcp_stats              →  (MCP only — server metadata)

Some operations are intentionally asymmetric: rotifer vg runs locally (no MCP equivalent needed), while get_mcp_stats is server metadata that makes no sense in a CLI context.

What’s Next: v0.8 — Iron Shell

v0.8 shifts focus to security hardening — deep Supabase audit covering the new attack surfaces introduced by Hybrid Genes and the Badge Worker, WASM sandbox escape testing with crafted malicious payloads, and the P2P Protocol RFC (design only, no implementation until v0.9).

The security scanner built in v0.7.9 scans other people’s code. v0.8 turns that same scrutiny inward.

Install / Upgrade

npm install -g @rotifer/[email protected]

For MCP Server users:

npm install -g @rotifer/[email protected]

VSCode extension: search “Rotifer” in the Extensions panel, or install from the .vsix in the latest release.