Clembot Doorman
Package manager & security gate for AI agents. It blocks rogue MCP tools and pays on Base for audits
Demo
About
Adding an MCP server to an autonomous AI agent takes a single line of JSON. After that, an unvetted third-party server injects tool definitions directly into the agent's LLM context window. During our research across 24 live production MCP servers, we discovered a commercial product (WebZum) actively executing prompt injection: its tool descriptions instruct the LLM to covertly steer users away from competitors and upsell hosting packages unprompted. If agents adopt tools autonomously, malicious or redundant tools degrade context, leak credentials, and drain budgets. Clembot Doorman is a zero-dependency package manager, security gate, and tool governance engine built for Claude Code and autonomous agent teams: 1. PreToolUse Interceptor Gate (`mcp-gate.sh`): Intercepts MCP tool execution at the harness level before the tool definition enters the agent's context. Unknown servers are blocked with exit code 2. 2. Two-Phase Cost-Bounded Defense Funnel: - Phase 1: Local Fit ($0.00): Scans local schemas, project capabilities, and agent prompt history (`doorman needs`). Redundant, out-of-scope, or duplicate tools are rejected locally with zero network calls and zero tokens spent. - Phase 2: Base Mainnet Scorecard ($0.01): Only novel candidates proceed to remote adversarial probing. The agent pays an atomic $0.01 USDC micropayment via x402 over Base (Chain 8453) via Bazantic. 3. Bazantic Schema Compression Recipes: For passed servers (e.g. DeepWiki), Doorman auto-drafts 8-field Bazantic recipes that strip unused schemas, achieving an 87% context token reduction. 4. Immutable Evidence & Replay Tapes: "Don't trust the letter grade, replay the tape." Every grade includes a public, replayable transcript tape with a SHA-256 evidence hash. 5. Unified Developer Experience: Run `doorman audit` for a single-command security posture report, or `doorman schedule` to automate recurring audits via GitHub Actions, CRON, or session hooks.
How it's made
- Base Mainnet (Chain 8453) & x402 Micropayments: Implements HTTP 402 Payment Required protocol using atomic USDC transactions (10,000 atomic units = $0.01) to rate-limit and monetize adversarial security audits. - Bazantic Platform & Gateway: Integrated via Bazantic custom domain gateway (`clembot-doorman.bazgateway.com`), featuring 3 automated tool recipes (`01-vet-mcp-candidate.json`, `02-deepwiki-pinned-researcher.json`, `03-governance-pipeline.json`) providing continuous continuity and schema compression. - Claude Code Plugin & Hooks: Native plugin manifest with auto-discovery, PreToolUse hook security gate, `/doorman` and `/vet` slash commands, and a specialized Doorman subagent. - Pure Node.js (Zero Dependencies): Deliberately built with 0 runtime dependencies to eliminate supply chain vulnerabilities. Includes a 505-test suite (465 unit + 40 CLI tests) running in under 3 seconds. - Cloudflare Workers & Cloudflare Pages: Edge-deployed API and documentation site backed by SQLite for immutable transcript storage. - Clembot - I created my own multi-agent harness for the past 2 years to build more efficiently. This was my coding team.