publish_gene runs a static security scan and refuses below grade B, and vg_scan lets you run the same check before you get there. In a registry of code other people will execute in their own sandbox, that gate is the difference between a package index and a supply-chain incident.
The MCP server for Rotifer, a registry and runtime for Genes — capability modules compiled to WASM. It searches the public registry, installs Genes locally, wraps your own functions or SKILL.md files as new ones, compiles and tests them in a sandbox, composes several into an Agent, and publishes back.
- Discovery — search_genes, get_gene_detail, get_arena_rankings with five-dimensional fitness, compare_genes, get_gene_stats, get_leaderboard, get_developer_profile, get_gene_reputation, list_gene_versions, suggest_domain
- Local workspace — list_local_genes, list_local_agents, install_gene
- Gene lifecycle — init_gene, scan_genes for candidate functions or SKILL.md files, wrap_gene, test_gene, compile_gene to WASM, run_gene, and doctor to check the TypeScript-to-WASM toolchain when compilation fails
- Agents — create_agent composes local Genes into a pipeline; agent_run executes it through the Rotifer CLI
- Publishing — publish_gene validates with a V(g) security scan and uploads; arena_submit records fitness metrics; vg_scan runs the same static safety analysis on its own
- Accounts — login opens a browser OAuth flow, plus logout, auth_status, get_my_reputation and get_mcp_stats
The npm package @rotifer/mcp-server, run with npx over stdio. Node.js 20 or newer. Discovery and local work need no account; arena_submit and publish_gene require login, which opens a GitHub or GitLab OAuth flow in the browser and saves credentials locally. Compiling needs a local TypeScript-to-WASM toolchain — esbuild and javy — and doctor reports what is missing, since a broken toolchain is the usual reason compile_gene fails. Publishing requires a V(g) security grade of B or better.
One command — npx @rotifer/mcp-server