# io.github.rotifer-protocol/mcp-server (npm · @rotifer/mcp-server)

Search, compare, and install self-evolving AI Agent Genes ranked by Arena fitness

- Trust score: 77/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@rotifer/mcp-server`: 77/100 (this document), [markdown](https://verifymcp.io/servers/rotifer-protocol-mcp-server/rotifer-mcp-server.md), [page](https://verifymcp.io/servers/rotifer-protocol-mcp-server/rotifer-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@rotifer/mcp-server`
- Version: `0.9.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to rotifer-protocol/rotifer-mcp-server).
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 42 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 84/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2522 tokens (~86/item across 29 items; 29 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add rotifer-protocol-mcp-server -- npx -y @rotifer/mcp-server
```

### Codex

```bash
codex mcp add rotifer-protocol-mcp-server -- npx -y @rotifer/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "rotifer-protocol-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@rotifer/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add rotifer-protocol-mcp-server --command npx --arg -y --arg @rotifer/mcp-server
```

### Hermes

```yaml
mcp_servers:
  rotifer-protocol-mcp-server:
    command: "npx"
    args: ["-y", "@rotifer/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "rotifer-protocol-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@rotifer/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 77, +72)

- [security improvement] Provenance: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The attested source repository moved: rotifer-protocol/rotifer-mcp-server
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: Apache-2.0

### 2026-08-01 (score 5, −30)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 35, +9)

- [security regression] Malware scan: pass → unverified
- [functional regression] Dependency health: partial → unverified
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100

### 2026-07-29 (score 26, +2)

- [functional improvement] Dependency health: unverified → partial

### 2026-07-28 (score 24, −29)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified

### 2026-07-27 (score 53)

First indexed and scored.

## MCP tools (29)

### `search_genes` (~131 tokens)

Search the Rotifer Gene ecosystem. Returns a list of Genes matching the query, filterable by domain and fidelity.

Input parameters:

- `domain` (string): Filter by capability domain (e.g. search.web, code.format)
- `fidelity` (string): Filter by gene fidelity type
- `page` (number): Page number (default 1)
- `per_page` (number): Results per page (default 20, max 50)
- `query` (string): Free-text search by gene name or description
- `sort` (string): Sort order (default: relevance when query is given, newest otherwise)

### `get_gene_detail` (~84 tokens)

Get detailed information about a specific Gene by its ID or content_hash, including phenotype, fitness, and metadata. At least one of gene_id or content_hash must be provided.

Input parameters:

- `content_hash` (string): SHA-256 content hash of the gene's phenotype (alternative to gene_id)
- `gene_id` (string): Gene UUID (required if content_hash not provided)

### `get_arena_rankings` (~96 tokens)

Get Arena rankings for a domain with full 5-dimensional fitness metrics: fitness (F(g)), safety, success_rate, latency, and resource_efficiency. Use this to find the best Gene for a capability.

Input parameters:

- `domain` (string): Capability domain (e.g. search.web)
- `page` (number): Page number (default 1)
- `per_page` (number): Results per page (default 20)

### `compare_genes` (~48 tokens)

Compare two or more Genes by their F(g) fitness metrics. Returns side-by-side fitness breakdown.

Input parameters:

- `gene_ids` (array, required): Array of Gene UUIDs to compare (2-5)

### `get_gene_stats` (~47 tokens)

Get download statistics for a Gene, broken down by time period (total, last 7 days, 30 days, 90 days).

Input parameters:

- `gene_id` (string, required): Gene UUID

### `get_leaderboard` (~57 tokens)

Get the creator reputation leaderboard. Shows top creators ranked by reputation score, including their published gene count, total downloads, and arena wins.

Input parameters:

- `limit` (number): Number of entries to return (default 20, max 100)

### `get_developer_profile` (~31 tokens)

Get a creator's public profile and reputation data by username.

Input parameters:

- `username` (string, required): Creator username

### `list_local_genes` (~93 tokens)

List Genes installed in the local project workspace. Scans the genes/ directory for phenotype.json files and returns metadata, compile status, and cloud origin for each Gene.

Input parameters:

- `domain` (string): Filter by domain prefix (e.g. 'search' matches 'search.web')
- `fidelity` (string): Filter by fidelity type
- `project_root` (string): Project root path (defaults to current working directory)

### `list_local_agents` (~82 tokens)

List Agents registered in the local project workspace. Returns each Agent's name, state, genome composition, strategy, and reputation. Agents are local constructs that compose multiple Genes into pipelines.

Input parameters:

- `project_root` (string): Project root path (defaults to current working directory)
- `state` (string): Filter by agent state (e.g. 'Active', 'Inactive')

### `install_gene` (~86 tokens)

Install a Gene from the Rotifer Cloud Registry into the local project. Downloads phenotype and metadata. Requires a valid gene_id from search_genes or get_gene_detail.

Input parameters:

- `force` (boolean): Overwrite if gene already exists locally (default: false)
- `gene_id` (string, required): Gene UUID to install
- `project_root` (string): Project root path (defaults to cwd)

### `arena_submit` (~132 tokens)

Submit a Gene to the Arena with fitness metrics. Requires authentication (rotifer login). Upserts the Gene's Arena entry with 5-dimensional fitness scores.

Input parameters:

- `fitness_value` (number, required): Overall fitness score F(g) (0-1)
- `gene_id` (string, required): Gene UUID to submit
- `latency_score` (number, required): Latency score (0-1, higher is better)
- `resource_efficiency` (number, required): Resource efficiency score (0-1)
- `safety_score` (number, required): Safety score (0-1)
- `success_rate` (number, required): Success rate (0-1)

### `create_agent` (~172 tokens)

Create a new Agent by composing one or more local Genes. The Agent is saved to .rotifer/agents/ in the project. Genes must exist locally (wrap them first with wrap_gene).

Input parameters:

- `agent_name` (string, required): Agent name
- `composition` (string): Composition strategy (default: Seq for multi-gene, Single for one gene)
- `domain` (string): Domain tag for the agent (e.g. search.web). Metadata only, does not auto-select genes.
- `gene_ids` (array, required): Array of local gene names to compose (at least one required)
- `par_merge` (string): Merge strategy for Par composition (default: first)
- `project_root` (string): Project root path (defaults to cwd)
- `strategy` (string): Gene selection strategy (default: greedy)

### `agent_run` (~125 tokens)

Run a local Agent by name. Executes via the Rotifer CLI (rotifer agent run <agent-name>). The Agent must exist in .rotifer/agents/. Returns stdout/stderr from the execution.

Input parameters:

- `agent_name` (string, required): Agent name (as given during create_agent)
- `input` (string): Input data to pass to the agent (JSON string)
- `no_sandbox` (boolean): Force Node.js execution, skip WASM sandbox
- `project_root` (string): Project root path
- `verbose` (boolean): Show intermediate results for each gene step

### `compile_gene` (~121 tokens)

Compile a local Gene to WASM via the Rotifer CLI (rotifer compile). The Gene must exist in the local genes/ directory. Returns compilation output.

Input parameters:

- `check` (boolean): Validate only, don't produce artifacts (default: false)
- `gene_name` (string, required): Gene name (directory name under genes/)
- `lang` (string): Force compilation mode (auto-detected by default)
- `project_root` (string): Project root path
- `wasm_path` (string): Path to a pre-compiled .wasm file to wrap as IR

### `run_gene` (~135 tokens)

Execute a local Gene via the Rotifer CLI (rotifer run). The Gene must exist in the local genes/ directory. Returns execution output.

Input parameters:

- `gene_name` (string, required): Gene name (directory name under genes/)
- `input` (string): Input JSON data to pass to the gene
- `no_sandbox` (boolean): Run without WASM sandbox, Node.js only (default: false)
- `project_root` (string): Project root path
- `trust_unsigned` (boolean): Allow Node.js execution for Cloud-installed genes (default: false)
- `verbose` (boolean): Show detailed execution output (default: false)

### `init_gene` (~112 tokens)

Initialize a new Rotifer Gene project. Creates a directory with phenotype.json template and starter files. Supports Wrapped, Hybrid, and Native fidelity types.

Input parameters:

- `domain` (string): Default gene domain (default: general)
- `fidelity` (string): Gene fidelity type (default: Wrapped)
- `gene_name` (string, required): Gene name (will create genes/<gene_name>/ directory)
- `no_genesis` (boolean): Skip genesis genes installation (default: false)
- `project_root` (string): Project root path

### `scan_genes` (~102 tokens)

Scan source files for candidate gene functions or local SKILL.md files that can be wrapped as Genes. Returns discovered candidates with metadata.

Input parameters:

- `path` (string): Path to scan (defaults to current directory)
- `project_root` (string): Project root path
- `skills` (boolean): Scan for SKILL.md files instead of source functions (default: false)
- `skills_path` (string): Directory to scan for skills (default: .cursor/skills)

### `wrap_gene` (~145 tokens)

Wrap a function or SKILL.md as a Rotifer Gene. Generates phenotype.json from the source. The target must exist in the project.

Input parameters:

- `domain` (string): Gene functional domain (e.g. search.web, code.format)
- `fidelity` (string): Fidelity level (default: Wrapped)
- `from_clawhub` (string): Create gene from a ClawHub skill (slug, downloads and converts automatically)
- `from_skill` (string): Create gene from a SKILL.md file (path to SKILL.md or its directory)
- `gene_name` (string, required): Name of the function or skill to wrap
- `project_root` (string): Project root path

### `test_gene` (~81 tokens)

Test a Gene in the sandbox. Validates phenotype schema, runs input/output tests, and checks compilation.

Input parameters:

- `compliance` (boolean): Run structural compliance checks (default: false)
- `gene_name` (string, required): Gene name to test
- `project_root` (string): Project root path
- `verbose` (boolean): Show detailed output (default: false)

### `publish_gene` (~183 tokens)

Publish a Gene to Rotifer Cloud Registry (default destination since v0.8.8). Calling this tool = explicit publish consent. Requires authentication (use login tool first). Validates with V(g) security scan (Grade >= B required), uploads, and optionally submits to Arena. Either gene_name or all=true must be provided.

Input parameters:

- `all` (boolean): Publish all local genes (default: false)
- `changelog` (string): Changelog entry for this version (max 500 chars)
- `description` (string): Gene description
- `gene_name` (string): Gene name to publish (required unless all=true)
- `project_root` (string): Project root path
- `skip_arena` (boolean): Skip automatic Arena submission after publish (default: false)
- `skip_security` (boolean): Skip pre-publish security checks (default: false)

### `list_gene_versions` (~60 tokens)

List the version history chain of a Gene by creator and name. Returns all published versions in chronological order with changelog entries and previous_version_id links.

Input parameters:

- `gene_name` (string, required): Gene name
- `owner` (string, required): Gene creator's username

### `get_mcp_stats` (~56 tokens)

Get MCP Server call analytics for a given time period. Returns total calls, success rate, average latency, top tools, and top genes. Requires authentication.

Input parameters:

- `days` (number): Time window in days (default 7)

### `auth_status` (~35 tokens)

Check current authentication status. Returns whether the user is logged in, their username, provider, and how many minutes until the token expires.

### `login` (~81 tokens)

Log in to Rotifer Cloud. Opens the browser for OAuth authorization (GitHub or GitLab). After the user authorizes in the browser, credentials are saved locally. This must be done before using arena_submit or publish_gene.

Input parameters:

- `endpoint` (string): Cloud endpoint URL (uses default if omitted)
- `provider` (string): OAuth provider (default: github)

### `logout` (~19 tokens)

Log out from Rotifer Cloud. Clears locally saved credentials.

### `get_gene_reputation` (~35 tokens)

Get detailed reputation breakdown for a Gene (Arena, Usage, Stability scores).

Input parameters:

- `gene_id` (string, required): Gene ID

### `get_my_reputation` (~24 tokens)

Get the current logged-in creator's reputation and stats. Requires authentication.

### `suggest_domain` (~33 tokens)

Suggest top matching domains from the domain registry based on a description.

Input parameters:

- `description` (string, required): Description to match against domains

### `vg_scan` (~116 tokens)

V(g) security scan — static analysis for Gene/Skill code safety. Returns a grade (A/B/C/D/?) and per-finding details with severity, file, line, and snippet.

Input parameters:

- `all` (boolean): Scan all code files, not just src/
- `gene_id` (string): Gene/Skill identifier for the report
- `path` (string): Path to Gene or Skill directory to scan (default: current project root)
- `project_root` (string): Project root directory (auto-detected if omitted)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/rotifer-protocol-mcp-server/rotifer-mcp-server#diagnostics

## Score history

- 2026-08-03: 77
- 2026-08-02: 77
- 2026-08-01: 5
- 2026-07-31: 35
- 2026-07-29: 26
- 2026-07-28: 24
- 2026-07-27: 53

## Links

- npm package: https://www.npmjs.com/package/@rotifer/mcp-server
- Socket report: https://socket.dev/npm/package/@rotifer/mcp-server
- Repository: https://github.com/rotifer-protocol/rotifer-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/rotifer-protocol-mcp-server/rotifer-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/rotifer-protocol-mcp-server/rotifer-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/rotifer-protocol-mcp-server/rotifer-mcp-server