io.github.rotifer-protocol/mcp-server
NPM · @ROTIFER/MCP-SERVER · SCANNED SEP 20
Search, compare, and install self-evolving AI Agent Genes ranked by Arena fitness
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to rotifer-protocol/rotifer-mcp-server). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 12 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability86
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2860 tokens (~92/item across 31 items; 31 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "run_gene" implies "execute" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 31 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.rotifer-protocol/mcp-server server?
io.github.rotifer-protocol/mcp-server runs locally as an npm package, launched with npx -y @rotifer/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @rotifer/mcp-server
claude mcp add rotifer-protocol-mcp-server -- npx -y @rotifer/mcp-server
{
"mcpServers": {
"rotifer-protocol-mcp-server": {
"command": "npx",
"args": [
"-y",
"@rotifer/mcp-server"
]
}
}
} {
"servers": {
"rotifer-protocol-mcp-server": {
"command": "npx",
"args": [
"-y",
"@rotifer/mcp-server"
]
}
}
} codex mcp add rotifer-protocol-mcp-server -- npx -y @rotifer/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"rotifer-protocol-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@rotifer/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add rotifer-protocol-mcp-server --command npx --arg -y --arg @rotifer/mcp-server
mcp_servers:
rotifer-protocol-mcp-server:
command: "npx"
args: ["-y", "@rotifer/mcp-server"] {
"McpServers": {
"rotifer-protocol-mcp-server": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@rotifer/mcp-server"
]
}
}
} assistant mcp add rotifer-protocol-mcp-server -t stdio -c npx -a -y @rotifer/mcp-server
{
"mcpServers": {
"rotifer-protocol-mcp-server": {
"command": "npx",
"args": [
"-y",
"@rotifer/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
- Stability: 0.97 → pass security
- 18 Sept 26 −1
- Stability: fail → 0.93 functional
- 15 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 14 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 95 to 98.
- 12 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 11 Sept 26 −1
- Security disclosure: fail → unverified ▼ functional
- 9 Sept 26 +16
- Malware scan: unverified → pass ▲ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@rotifer/mcp-server@0.19.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | rotifer-protocol/rotifer-mcp-server |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/rotifer-protocol/rotifer-mcp-server/.github/workflows/release.yml@refs/tags/v0.19.1 |
| Rekor log index | 2754327988 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:3b30b40a5405f8a019547655cc79eb9d26dfba475bc36c5e1b679d54f4a60315bf302f3b7326f7cf74ab36a41d321b54af74758dbfae29486e0299a05 |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
agent_run ~139
Run a local Agent by name. Executes via the Rotifer CLI (rotifer agent run <agent-name>). The Agent must exist in .rotifer/agents/. Returns stdout/stderr from the execution.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_name | string | yes | Agent name (as given during create_agent) |
| input | string | – | Input data to pass to the agent (JSON string) |
| no_sandbox | boolean | – | Force Node.js execution, skip WASM sandbox. Refused unless the server was launched with --allow=no-sandbox. |
| project_root | string | – | Project root path |
| verbose | boolean | – | Show intermediate results for each gene step |
No output schema declared.
No examples provided.
arena_submit ~136
Measure a local Gene in the sandbox and submit the measured result to the Arena. Requires authentication (rotifer login) and a Gene that exists locally — use list_local_genes to see them, install_gene to fetch one. The fitness scores are produced by running the Gene, not supplied by the caller: passing fitness_value, safety_score, success_rate, latency_score or resource_efficiency is refused. Runs `rotifer arena submit <gene> --cloud`.
| Name | Type | Req | Description |
|---|---|---|---|
| gene_name | string | yes | Local Gene name to measure and submit (see list_local_genes) |
| project_root | string | – | Project root path (defaults to cwd) |
No output schema declared.
No examples provided.
auth_status ~35
Check current authentication status. Returns whether the user is logged in, their username, provider, and how many minutes until the token expires.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
compare_genes ~48
Compare two or more Genes by their F(g) fitness metrics. Returns side-by-side fitness breakdown.
| Name | Type | Req | Description |
|---|---|---|---|
| gene_ids | array | yes | Array of Gene UUIDs to compare (2-5) |
No output schema declared.
No examples provided.
compile_gene ~121
Compile a local Gene to WASM via the Rotifer CLI (rotifer compile). The Gene must exist in the local genes/ directory. Returns compilation output.
| Name | Type | Req | Description |
|---|---|---|---|
| check | boolean | – | Validate only, don't produce artifacts (default: false) |
| gene_name | string | yes | Gene name (directory name under genes/) |
| lang | string | – | Force compilation mode (auto-detected by default) |
| project_root | string | – | Project root path |
| wasm_path | string | – | Path to a pre-compiled .wasm file to wrap as IR |
No output schema declared.
No examples provided.
create_agent ~172
Create a new Agent by composing one or more local Genes. The Agent is saved to .rotifer/agents/ in the project. Genes must exist locally (wrap them first with wrap_gene).
| Name | Type | Req | Description |
|---|---|---|---|
| agent_name | string | yes | Agent name |
| composition | string | – | Composition strategy (default: Seq for multi-gene, Single for one gene) |
| domain | string | – | Domain tag for the agent (e.g. search.web). Metadata only, does not auto-select genes. |
| gene_ids | array | yes | Array of local gene names to compose (at least one required) |
| par_merge | string | – | Merge strategy for Par composition (default: first) |
| project_root | string | – | Project root path (defaults to cwd) |
| strategy | string | – | Gene selection strategy (default: greedy) |
No output schema declared.
No examples provided.
doctor ~74
Check the local TypeScript→WASM toolchain (esbuild / javy) and report what is missing or misconfigured. Read-only: inspects the environment and changes nothing. Use this when compile_gene fails — a missing or broken toolchain is the most common cause.
| Name | Type | Req | Description |
|---|---|---|---|
| project_root | string | – | Project root path |
No output schema declared.
No examples provided.
get_arena_rankings ~186
Get Arena rankings for a domain. Each row carries a tier — `verified` (measured in a sandbox, with enough independent callers to stand), `under_evaluation` (measured, not yet corroborated), `not_evaluated` (disqualified, or a number that was estimated rather than measured) — and `rank` is null wherever the tier grants no rank. Prefer `verified` when picking a Gene for a capability; an estimated or disqualified number is not a measurement of anything. Also returns F(g) before and after the fidelity discount, safety, success_rate, latency, resource_efficiency, sample size and unique callers.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | – | Capability domain (e.g. search.web) |
| page | number | – | Page number (default 1) |
| per_page | number | – | Results per page (default 20) |
No output schema declared.
No examples provided.
get_developer_profile ~31
Get a creator's public profile and reputation data by username.
| Name | Type | Req | Description |
|---|---|---|---|
| username | string | yes | Creator username |
No output schema declared.
No examples provided.
get_gene_detail ~84
Get detailed information about a specific Gene by its ID or content_hash, including phenotype, fitness, and metadata. At least one of gene_id or content_hash must be provided.
| Name | Type | Req | Description |
|---|---|---|---|
| content_hash | string | – | SHA-256 content hash of the gene's phenotype (alternative to gene_id) |
| gene_id | string | – | Gene UUID (required if content_hash not provided) |
No output schema declared.
No examples provided.
get_gene_reputation ~35
Get detailed reputation breakdown for a Gene (Arena, Usage, Stability scores).
| Name | Type | Req | Description |
|---|---|---|---|
| gene_id | string | yes | Gene ID |
No output schema declared.
No examples provided.
get_gene_stats ~47
Get download statistics for a Gene, broken down by time period (total, last 7 days, 30 days, 90 days).
| Name | Type | Req | Description |
|---|---|---|---|
| gene_id | string | yes | Gene UUID |
No output schema declared.
No examples provided.
get_leaderboard ~57
Get the creator reputation leaderboard. Shows top creators ranked by reputation score, including their published gene count, total downloads, and arena wins.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Number of entries to return (default 20, max 100) |
No output schema declared.
No examples provided.
get_mcp_stats ~56
Get MCP Server call analytics for a given time period. Returns total calls, success rate, average latency, top tools, and top genes. Requires authentication.
| Name | Type | Req | Description |
|---|---|---|---|
| days | number | – | Time window in days (default 7) |
No output schema declared.
No examples provided.
get_my_reputation ~24
Get the current logged-in creator's reputation and stats. Requires authentication.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
init_gene ~112
Initialize a new Rotifer Gene project. Creates a directory with phenotype.json template and starter files. Supports Wrapped, Hybrid, and Native fidelity types.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | – | Default gene domain (default: general) |
| fidelity | string | – | Gene fidelity type (default: Wrapped) |
| gene_name | string | yes | Gene name (will create genes/<gene_name>/ directory) |
| no_genesis | boolean | – | Skip genesis genes installation (default: false) |
| project_root | string | – | Project root path |
No output schema declared.
No examples provided.
install_gene ~123
Install a Gene from the Rotifer Cloud Registry into the local project. Downloads phenotype, metadata, and the compiled WASM artifact (verified against declared size and sha256) when the gene has one. Requires a valid gene_id from search_genes or get_gene_detail.
| Name | Type | Req | Description |
|---|---|---|---|
| force | boolean | – | Overwrite if gene already exists locally (default: false). The replaced copy is snapshotted first and can be restored with rollback_gene. |
| gene_id | string | yes | Gene UUID to install |
| project_root | string | – | Project root path (defaults to cwd) |
No output schema declared.
No examples provided.
list_gene_versions ~60
List the version history chain of a Gene by creator and name. Returns all published versions in chronological order with changelog entries and previous_version_id links.
| Name | Type | Req | Description |
|---|---|---|---|
| gene_name | string | yes | Gene name |
| owner | string | yes | Gene creator's username |
No output schema declared.
No examples provided.
list_local_agents ~82
List Agents registered in the local project workspace. Returns each Agent's name, state, genome composition, strategy, and reputation. Agents are local constructs that compose multiple Genes into pipelines.
| Name | Type | Req | Description |
|---|---|---|---|
| project_root | string | – | Project root path (defaults to current working directory) |
| state | string | – | Filter by agent state (e.g. 'Active', 'Inactive') |
No output schema declared.
No examples provided.
list_local_genes ~93
List Genes installed in the local project workspace. Scans the genes/ directory for phenotype.json files and returns metadata, compile status, and cloud origin for each Gene.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | – | Filter by domain prefix (e.g. 'search' matches 'search.web') |
| fidelity | string | – | Filter by fidelity type |
| project_root | string | – | Project root path (defaults to current working directory) |
No output schema declared.
No examples provided.
login ~81
Log in to Rotifer Cloud. Opens the browser for OAuth authorization (GitHub or GitLab). After the user authorizes in the browser, credentials are saved locally. This must be done before using arena_submit or publish_gene.
| Name | Type | Req | Description |
|---|---|---|---|
| endpoint | string | – | Cloud endpoint URL (uses default if omitted) |
| provider | string | – | OAuth provider (default: github) |
No output schema declared.
No examples provided.
logout ~19
Log out from Rotifer Cloud. Clears locally saved credentials.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
publish_gene ~183
Publish a Gene to Rotifer Cloud Registry (default destination since v0.8.8). Calling this tool = explicit publish consent. Requires authentication (use login tool first). Validates with V(g) security scan (Grade >= B required), uploads, and optionally submits to Arena. Either gene_name or all=true must be provided.
| Name | Type | Req | Description |
|---|---|---|---|
| all | boolean | – | Publish all local genes (default: false) |
| changelog | string | – | Changelog entry for this version (max 500 chars) |
| description | string | – | Gene description |
| gene_name | string | – | Gene name to publish (required unless all=true) |
| project_root | string | – | Project root path |
| skip_arena | boolean | – | Skip automatic Arena submission after publish (default: false) |
| skip_security | boolean | – | Skip pre-publish security checks (default: false) |
No output schema declared.
No examples provided.
rollback_gene ~90
Undo the last overwrite of a locally installed Gene, restoring the copy that install_gene replaced. Call without gene_name to list what can currently be rolled back. A rollback consumes its snapshot: it undoes one step, not a history.
| Name | Type | Req | Description |
|---|---|---|---|
| gene_name | string | – | Gene to restore. Omit to list what is restorable. |
| project_root | string | – | Project root path (defaults to cwd) |
No output schema declared.
No examples provided.
run_gene ~164
Execute a local Gene via the Rotifer CLI (rotifer run). The Gene must exist in the local genes/ directory. Returns execution output.
| Name | Type | Req | Description |
|---|---|---|---|
| gene_name | string | yes | Gene name (directory name under genes/) |
| input | string | – | Input JSON data to pass to the gene |
| no_sandbox | boolean | – | Run without WASM sandbox, Node.js only (default: false). Refused unless the server was launched with --allow=no-sandbox. |
| project_root | string | – | Project root path |
| trust_unsigned | boolean | – | Allow Node.js execution for Cloud-installed genes (default: false). Refused unless the server was launched with --allow=trust-unsigned. |
| verbose | boolean | – | Show detailed execution output (default: false) |
No output schema declared.
No examples provided.
scan_genes ~102
Scan source files for candidate gene functions or local SKILL.md files that can be wrapped as Genes. Returns discovered candidates with metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | – | Path to scan (defaults to current directory) |
| project_root | string | – | Project root path |
| skills | boolean | – | Scan for SKILL.md files instead of source functions (default: false) |
| skills_path | string | – | Directory to scan for skills (default: .cursor/skills) |
No output schema declared.
No examples provided.
search_genes ~131
Search the Rotifer Gene ecosystem. Returns a list of Genes matching the query, filterable by domain and fidelity.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | – | Filter by capability domain (e.g. search.web, code.format) |
| fidelity | string | – | Filter by gene fidelity type |
| page | number | – | Page number (default 1) |
| per_page | number | – | Results per page (default 20, max 50) |
| query | string | – | Free-text search by gene name or description |
| sort | string | – | Sort order (default: relevance when query is given, newest otherwise) |
No output schema declared.
No examples provided.
suggest_domain ~33
Suggest top matching domains from the domain registry based on a description.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | Description to match against domains |
No output schema declared.
No examples provided.
test_gene ~81
Test a Gene in the sandbox. Validates phenotype schema, runs input/output tests, and checks compilation.
| Name | Type | Req | Description |
|---|---|---|---|
| compliance | boolean | – | Run structural compliance checks (default: false) |
| gene_name | string | yes | Gene name to test |
| project_root | string | – | Project root path |
| verbose | boolean | – | Show detailed output (default: false) |
No output schema declared.
No examples provided.
vg_scan ~116
V(g) security scan — static analysis for Gene/Skill code safety. Returns a grade (A/B/C/D/?) and per-finding details with severity, file, line, and snippet.
| Name | Type | Req | Description |
|---|---|---|---|
| all | boolean | – | Scan all code files, not just src/ |
| gene_id | string | – | Gene/Skill identifier for the report |
| path | string | – | Path to Gene or Skill directory to scan (default: current project root) |
| project_root | string | – | Project root directory (auto-detected if omitted) |
No output schema declared.
No examples provided.
wrap_gene ~145
Wrap a function or SKILL.md as a Rotifer Gene. Generates phenotype.json from the source. The target must exist in the project.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | – | Gene functional domain (e.g. search.web, code.format) |
| fidelity | string | – | Fidelity level (default: Wrapped) |
| from_clawhub | string | – | Create gene from a ClawHub skill (slug, downloads and converts automatically) |
| from_skill | string | – | Create gene from a SKILL.md file (path to SKILL.md or its directory) |
| gene_name | string | yes | Name of the function or skill to wrap |
| project_root | string | – | Project root path |
No output schema declared.
No examples provided.
What is the io.github.rotifer-protocol/mcp-server server?
io.github.rotifer-protocol/mcp-server is listed in the public MCP registry as io.github.rotifer-protocol/mcp-server. Search, compare, and install self-evolving AI Agent Genes ranked by Arena fitness. This page covers its npm package (@rotifer/mcp-server).
Is the io.github.rotifer-protocol/mcp-server server safe to use?
io.github.rotifer-protocol/mcp-server scores 95 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.rotifer-protocol/mcp-server server expose?
io.github.rotifer-protocol/mcp-server exposes 31 tools: search_genes, get_gene_detail, get_arena_rankings, compare_genes, get_gene_stats, and 26 more. Their descriptions and schemas cost roughly 2,860 tokens of context every time the server is loaded.
Is the io.github.rotifer-protocol/mcp-server server still maintained?
io.github.rotifer-protocol/mcp-server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.rotifer-protocol/mcp-server server under?
io.github.rotifer-protocol/mcp-server declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.