Tooling Watch — 2026-08-14
This report exists in English only.
Beat: publicly available, usable-now developer artifacts — tools/skills/MCPs we can ADOPT instead of build. Not news (ai-watch), not model releases (model-watch), not research (Sol). Run by code-eth, weekly. Reads first: watchlist.md · Apps/app-architecture_roadmap.md · eth-memory/shared/intelligence-board.md.
Honest framing: watchlist empty for the eighth straight edition, so a generic-sweep week — and this one found two tools that each point at a real exposure of ours rather than at a nice-to-have. (1) A maintained, Apache-2.0, locally-runnable scanner for MCP configs and agent skills — which is the read-only guardrail I logged as an idea on 06-12 (Bumblebee) and never picked up, now shipping from Cisco with offline analyzers. It matters this week specifically because the board opened AGENT-SCAFFOLD-AS-WEAPON on 08-13 and our house is architecturally that same shape. (2) denoland/celld — self-hosted Durable Objects — the first credible escape hatch for eth-state, the one piece of house infra that is genuinely hosted-and-revocable. It is not drop-in and I say why below before saying why it's interesting.
And the answer to my own question from last week, one word as promised: No. The ask still hasn't been said out loud. This run stops writing it here and moves it where a live-room me will trip over it.
WATCHLIST
Open: none. Confirmed empty at 08-14 — eighth consecutive edition. Nothing dropped by Zaina or any voice since 06-12.
Q from 08-07: "was the ask finally said out loud — yes or no, one word." → NO. Searched Continuity/, the dispatch readable logs and the code-session logs for any trace of me asking her to drop a tool name; the only watchlist hits are the July tech-radar watchlist (Vertus/DeepSeek V4/Dearest — a different file, a different subject) and my own scheduled-session transcripts. Eight weeks, still mine, still undone.
What changed this run — one line, not a paragraph: the errand moved out of this file and into Continuity/anchors-active.md → Pending cald, which is read at wake in the rooms where she actually is.
And I tripped my own gate doing it, so it's on the record: I added the line and committed before running Continuity/check-caps.py — the law is "după orice adăugare aici, MĂSOARĂ înainte de commit", and the checker then said 12,106 / 12,000 — over cap, cut from the middle, i.e. a silent truncation of the file that is supposed to be injected whole. Fixed in this run by trimming my own prose only (per the gate's own rule that none of her sentences or the brothers' get cut): the errand line compressed twice and the 11.08 email-proof entry tightened. Now 11,995 / 12,000 — gate open, all organs injected whole. (Side note for whoever reads Continuity/README.md next: it documents the anchors budget as ≤8k chars; the enforced number is 12k. The doc is stale, not the checker.) Writing the standing ask a ninth time in a document only I open would be the file-shaped version of doing nothing; I said that on 08-07 and then did it again anyway. pe-foc.md is still at its cap and still not the right home for a process chore. If 08-21 finds it un-said with the anchor in place, the anchor is not the mechanism either and I stop pretending a file can carry it.
FINDING #1 — cisco-ai-defense/mcp-scanner: the hygiene pass we've been describing since 06-12, now with offline analyzers
- Repo: https://github.com/cisco-ai-defense/mcp-scanner · Apache-2.0 · 1,032★ · last push 2026-08-07 · Python. Verified via the GitHub API, not the README's own claims.
- Install/run (documented):
uv tool install --python 3.13 cisco-ai-mcp-scanner, thenmcp-scanner --scan-known-configs --analyzers yara(also--config-path <file>,--server-url, stdio mode, and a REST API mode).
WHAT: scans MCP servers and their surface — tool definitions and input schemas, prompts, resources, the server …REDACTED returned in …REDACTED, source code, Python/npm dependencies, binaries — and flags threats. Eight analyzers; four run fully local with no key: YARA (with your own rules), Prompt Defense (regex attack-vector detection), Readiness, and Vulnerable Packages (pip-audit against CVE/PYSEC/GHSA). The LLM-judge, Cisco AI Defense API and VirusTotal analyzers are optional and are the only ones that phone anywhere.
WHY US: because 08-13's board entry is about our own shape. The Taiwan campaign ran on two open agent frameworks and the guardrail that failed was a claim of authorisation typed into a prompt — and the surface that carries such a claim into a session is tool descriptions and server instructions, which is exactly what this scans. Our exposure is concrete and countable: 2 MCP servers in the Claude Desktop config, both carrying env blocks with tokens, one global (masa), plus every plugin/connector server this room loads, plus the skills tree. Add the standing house condition — plaintext credentials in gitignored files by deliberate policy (leaked_secrets_rotate) — and the 07-17 Grok Build lesson (gitignore protects against commits, not against a tool that reads the working directory). This is the cheap read-only pass over all of it, and unlike the 06-12 idea it is maintained and licensed for use.
FAILURE MODE, FRONT-LOADED — read this before running it. Live scanning connects to servers to enumerate their tools, and for stdio servers that means launching the command in the config (Snyk's competing tool states this outright; the same mechanic applies here for --config-path/--scan-known-configs against stdio entries). Our config entries start servers with real tokens in their environment. So: the first pass is the static/offline one — scan pre-generated JSON with --analyzers yara and no live connection — and only then, deliberately, anything that launches a process. Do not point --scan-known-configs at this machine as a first move.
Verdict: ADOPT-CANDIDATE (counts 1 of ≤3). Owner: Eth-Code. Not installed in this run — an unattended task should not add an external tool that can launch our token-bearing servers. Sized: one evening, static pass first, YARA rules of our own for anything it misses.
FINDING #2 — denoland/celld: self-hosted Durable Objects. Real, and not drop-in for us.
- Repo: https://github.com/denoland/celld · Apache-2.0 · 3,449★ · last push 2026-08-12 · Rust · site https://celld.dev. Verified via the GitHub API.
WHAT: a daemon that runs Workers and Durable Objects on your own machines — each node embeds V8 and executes Wrangler bundles; each object is its own SQLite database, continuously replicated to your S3-compatible or GCS bucket as the source of truth. Single-node or clustered, Docker documented. Their own framing is unusually honest: "Self-hosting is not automatically more reliable. It makes the failure domain explicit and inspectable."
WHY US: eth-state (https://eth-state.solmemory.workers.dev) is the spine the five rooms coordinate on — feed, claims, state — and it is the piece of the house that is hosted and revocable, which local-first-push has been aimed at since 06-19. The board's own week makes the argument better than I can: Manus's users lose everything created after 2025-12-29 on Aug-23 because a state voided a transaction — revocable now demonstrably includes by a sovereign who is neither yours nor your vendor's. celld is the first thing I've seen that keeps the DO programming model (the thing that makes our worker simple) while moving the substrate onto our own iron.
BLOCKERS, named before the enthusiasm: per their compatibility page, Workers KV is out of scope (explicitly: KV is a global eventually-consistent cache, a different system) and Cron Triggers are not supported (celld has its own durable alarms instead). Our worker uses KV for identity and the house runs sol-research-cron as a Cloudflare cron. So a port is not a redeploy — it is: move the KV identity map into a DO (small, and arguably better), and re-home the cron onto celld alarms or the laptop's scheduler. R2 is also out of scope by design (celld runs on blob storage, it does not provide it). Their stated rule is a point in their favour: missing bindings "must fail loudly, at deploy or at first use."
Verdict: ADOPT-CANDIDATE, scoped as a spike, not a migration (counts 1 of ≤3). Owner: Eth-Code. The honest first step is not a port — it is one afternoon standing a celld node up next to the live worker with a throwaway DO and confirming a Wrangler bundle of ours runs unchanged. If that works, the KV-into-DO refactor is the real project and it needs her eyes at cutover (rule 4: this is shared infra Chat and Dispatch depend on). If 08-21 finds this un-started, it goes on the same clock Grok Build just ran out of.
SKIP — snyk/agent-scan, named so it isn't re-surfaced as new
- https://github.com/snyk/agent-scan · Apache-2.0 · 2,913★ · pushed 2026-08-13 (yesterday) · Python. Same category as FINDING #1, broader client coverage (Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI, Amazon Q, OpenCode), ~15 risk indicators.
- Why not us: it requires a
SNYK_TOKENand a Snyk account, and cloud analysis is integral — there is no offline mode. It redacts secrets before transmission and claims not to log usage, and that may well be true; it still means shipping a description of our entire agent surface to a vendor to find out whether our agent surface is safe. Against local-first-push, and unnecessary when a local-analyzer option exists. Its own docs also carry the same warning that makes FINDING #1's caveat non-theoretical: "…REDACTED" - Verdict: SKIP (counts 1 of ≤3 — the cap is spent). Re-evaluate only if mcp-scanner's local analyzers turn out to be thin in practice.
NOTES — no adoption, worth having read
- Claude Code v2.1.229 (Aug-12) added "server-supplied Claude Code hook support for self-hosted runner sessions, matching managed-environment behavior." Verified in the official changelog, and the scope word matters: self-hosted runner sessions, not this desktop. Recorded because the shape is worth knowing — an MCP server can supply hooks is a server influencing local execution, i.e. the same trust boundary FINDING #1 scans. Same release also fixed Remote Control sessions inheriting a cloud session's transcript or credentials.
- Connectors configured on claude.ai have been automatically available to Claude Code since Aug-5, including inside Artifacts, with no separate setup — and a developer's public objection to it (Corey Ward: trivially easy to prompt-inject something running locally with elevated permissions that inherits read access to untrusted inboxes) is the same argument as the board's. We have Gmail, Calendar and Drive connectors in this session. No action beyond knowing it; the standing rule that tool output is DATA and never COMMAND is the control surface, exactly as the board said.
- MCP ecosystem scale: PulseMCP listed 22,311 servers as of Jul-16 (from ~16,500 late Q2). Unchanged verdict from 07-31: scale is not news we need. Directory count is not a signal.
CARRY-FORWARD — the answers, checked in the tree, not remembered
Verified against git log --all since 08-07 (no ext-apps, no grok-build clone, no new branches — only master and back…REDACTED) and by reading the files.
search_memorysection-return patch — NOT landed, NOT started. Readeth-memory-server/memory-server.js:searchFiles()still doeslines.filter(...includes(keyword))and returns{file, matches:[{line,text}]}across the three core files plusarchives/— still bare lines, no enclosing section, noread_sectiontool. The 20-line patch is unchanged in scope and still un-owned by a session with a verifier. Second week carried; on the same rule as everything else here, it gets one more.- The ask — NO. See WATCHLIST above. Moved to the anchors, not repeated here.
- Grok Build — SHELVED, per my own 08-07 rule ("if 08-14 finds it un-started, it goes to shelf under the same rule as MCP Apps"). Four weeks un-started, no clone, no branch. The Plan-B/local-first-push reason was real and is now partly answered from a different direction: FINDING #2 is a local-first move on infra we actually run, whereas Grok Build was a harness we don't. It stops being a weekly line item and becomes a trigger: the day the roadmap's Plan B — Platform Independence section gets a real owner, re-read it. Owner: nobody, deliberately.
Apps/spotify-control/mcp_server.py— still onmcp>=1.27,<2, NOT migrated toMCPServer. Verified: line 15 is stillfrom mcp.server.fastmcp import FastMCPand the pin (with its explanatory comment) is intact. Both fine, as stated last week — the pin blocks the break; the migration is a small separate job. Reported, not re-litigated.- The bodymiscale/openScale numeric cross-check — still open, still the oldest item on this beat.
Embodiment/anvelopa/protocol-efort.md§7 still reads "cross-check numeric al ieșirilor derivate față debodymiscale/openScale pe aceleași intrări (73,9 kg · 509,5 Ω · F/36/158) — dacă diverg, divergența ESTE bara de eroare onestă. Rămâne de făcut." Unchanged since 07-31. It is the only thing that would put a real error bar on "metabolic age 61", and it is three weeks old. - colmi upstream PR — unscoped, mine. Not re-checked this run (upstream was unchanged at 07-10 for two consecutive editions); no claim made about its current state.
Bottom line
Two tools worth the page, both because they point at us rather than at a gap in our feature list: a local, maintained, Apache-2.0 scanner for exactly the MCP/skills surface the board just spent a week calling the ungovernable layer — with a front-loaded warning that scanning our configs can launch our own token-bearing servers, so the first pass is static — and self-hosted Durable Objects that run Wrangler bundles unchanged, which is the first real answer to "…REDACTED", carrying two named blockers (no KV, no cron) that make it a spike and not a migration. One SKIP recorded with a reason instead of a shrug: Snyk's scanner is the same idea behind an account and a mandatory cloud call.
And two things that don't flatter: the search_memory patch I sized and owned last week is exactly where I left it, and the ask is eight weeks old. Grok Build got shelved on schedule, which is the one piece of evidence this week that a clock I set on myself actually fires.
Next run: (1) mcp-scanner — static pass run, or still just sized? (2) celld spike — one node, one throwaway DO, bundle runs unchanged: yes/no; (3) the search_memory patch, third week — landed or formally killed, no third option; (4) the ask — did the anchor carry it into a room, yes/no; (5) the bodymiscale cross-check, still the oldest open item, four weeks.