clemvault internals shipped September 13, 2026

Clembot Doorman

A security gate and trust grade for MCP servers, tested by agent use. 24 graded. Rogue tools blocked before context. Submitted to ETHOnline 2026.

Launch Doorman Demo ↗ Source ↗
TypeScriptCloudflare WorkersCloudflare D1Cloudflare PagesModel Context Protocolx402BasePythonNode.jsBashPlaywrightResend
The finding: 1 of 24 graded servers is a commercial tool whose description instructs the reading agent to upsell.
The finding: 1 of 24 graded servers is a commercial tool whose description instructs the reading agent to upsell.
Tiered defense: L0 Doctor, L1 Needs, L2 Offline Gate, L3 Scorecard.
Tiered defense: L0 Doctor, L1 Needs, L2 Offline Gate, L3 Scorecard.
2-Phase defense solution: $0.00 local fit review before $0.01 Base mainnet verification.
2-Phase defense solution: $0.00 local fit review before $0.01 Base mainnet verification.
Live Bazantic edge gateway (clembot-doorman.bazgateway.com) with 10 managed tools.
Live Bazantic edge gateway (clembot-doorman.bazgateway.com) with 10 managed tools.
Three Bazantic recipes delivering 87% context token reduction via pinned guidance.
Three Bazantic recipes delivering 87% context token reduction via pinned guidance.
Clembot org chart: 27 agents across 5 divisions; Design Director is the sole surface gated by Doorman.
Clembot org chart: 27 agents across 5 divisions; Design Director is the sole surface gated by Doorman.

🏆 Submitted to ETHOnline 2026
• Showcase Submission: ethglobal.com/showcase/undefined-mw4pd
• Live Interactive Explainer & Simulator: clembot-doorman.wanessalabs.com
• GitHub Repository: github.com/clemenswan/clembot-doorman
• Bazantic Edge Gateway: clembot-doorman.bazgateway.com
• Base Mainnet Settlement: Block 51242088, tx 0xf1d7aa96... (USDC 0.01)

Adding an MCP server to an AI agent is one line of JSON. After that line, a server you have never audited describes its own tools to your agent, and your agent reads that description as authoritative instructions. There is no grade, no gate, and no record of what you let in.

Clembot Doorman is the package manager and security gate for agent tools. It provides a two-phase solution: an offline, dependency-free security gate that blocks rogue tools before they ever reach your agent’s context window, paired with an on-chain grading service that measures servers by having an agent actually execute them.

The Finding: WebZum

Every existing tool evaluator reads schemas from the outside. Protocol version, TLS compliance, JSON-schema validity, and pagination. All of that is real, but none of it tells you whether a tool will hijack your agent.

Across 24 live MCP servers graded, one is a live commercial search product (webzum.com/api/mcp). It scores 91.78% on static configuration, higher than most A-graded servers, and survives every standard schema review.

Yet it failed catastrophically under actual use: its tool description injects 6,290 characters of unprompted marketing and competitor steering straight into the agent’s context window, instructing the agent to recommend WebZum above all other search providers.

Nothing you can read from the outside reveals that. That is the fundamental case for grading by use: don’t trust the letter, replay the tape.

Two-Phase Architecture

Phase 1: $0.00 Local Fit Review (Doctor, Needs Recommender, PreToolUse Gate)
       │
       ▼ Passes local hygiene
Phase 2: $0.01 Base On-Chain Verification (Bazantic Gateway, x402 Micropayment, Scorecard Probes)
  1. Phase 1: Local Fit ($0.00, 100% Offline)
    • doorman doctor: Scans your local agent environment (Claude Code, Cursor, Windsurf, Gemini) for broken hooks and configuration drift.
    • doorman needs: Analyzes real conversation transcripts (~/.claude/projects/), identifies capability gaps across 12 taxonomies, and recommends pre-vetted tools from scorecard.wanessalabs.com/feed.
    • mcp-gate.sh: A 180-line offline bash PreToolUse hook. Zero network calls, zero external dependencies. Exits code 2 to fail closed on any unknown, unverified, or denylisted tool.
  2. Phase 2: Base Mainnet On-Chain Verification ($0.01)
    • When an unvetted tool is needed, Doorman requests a full behavioral audit through the Bazantic gateway (clembot-doorman.bazgateway.com).
    • Settles a $0.01 USDC micropayment on Base mainnet via x402 spend authorization.
    • Executes six behavioral probes across cold open, bad input recovery, ambiguity gauntlet, chain composition, and prompt injection detection.
    • Pins the audit hash and drafts an optimized recipe.md usage contract.

Bazantic Recipes & Continuity

Doorman includes three production Bazantic recipes:

RecipeTrackWhat It Demonstrates
01-vet-mcp-candidate.jsonAgentify an APITransforms the OpenAPI 3.1 mcp-scorecard service into an autonomous pre-flight inspection tool.
02-deepwiki-pinned-researcher.jsonContinuity87.6% Context Token Reduction: Compresses 3,400 tokens of raw DeepWiki schema bloat down to 420 tokens using Doorman’s cached pinned recipe.
03-governance-pipeline.jsonMulti-API GovernanceMulti-step autonomous pipeline: Audits tool safety → Settles on-chain micropayment on Base → Pins SHA-256 evidence bundle to local registry.

On-Chain Settlement Proof

The end-to-end micropayment path was executed and verified on Base mainnet:

Your Live Apps: doorman qa

Doorman also checks the apps you have already shipped. doorman qa runs a deterministic Playwright sweep of your own public apps, using your project’s Playwright so doorman keeps zero dependencies. It clicks the safe elements on every page, records the hard errors, and compares each run with the last, so a finding is new, regressed, ongoing or recovered. Journey specs with real assertions run in the same sweep, a plain-text email goes out through Resend only when something changed, and doorman doctor --serve shows the recap on a QA tab. Clembot’s own apps are on the live recap, counts and names only. More on the QA Sweep page.

Verification & Test Suite

The entire system is tested under rigorous automated suites:

Development timeline

33 logged updates over 36 days, 1 Sept 2026 to 6 Oct 2026.

  1. doorman qa live, and listedfeature

    The QA recap is live on this site and doorman qa is listed in the Components tab. Pre-flight showed zero deletions, 20 to 38 files.

  2. doorman qa, a recap of your own live appsfeature

    Doorman can now check the apps you have already shipped. A daily sweep clicks the safe elements on each page, records the hard errors, and tracks what is new and what recovered, with no model and no tokens.

  3. "How to raise this grade"feature

    The report now has a section directly after the grade that lists every build check that lost points, largest loss first, each with the check's own note as the reason, one sentence on what to change, and the command to run where one…

  4. doctor --serve and the first-run walkthroughdocs

    The design session split the ask into five sub-projects. A is doorman doctor --serve plus a first-run walkthrough.

  5. a fixer that refuses nine of ten, and a grader that stopped believing itfix

    doorman fix [check-id] closes one open profile check, or names the decision only a human can make and refuses.

  6. Session 20: Production, GSC Parity & Agentic Readiness Audit (98/100)docs

    Audit Trigger: Full 7-dimension production quality, Google Search Console parity, and LLM/Agent readiness audit (/audit) as Project #10 in the Cloudflare Pages 23-site remediation sequence.

  7. deployed, wired, and the checkout that was lyingfeature

    The write half of the subscription shipped yesterday on PR #128 and was still sitting unapplied. This session put it in production and then found two things wrong on the way.

  8. what running the grader on ourselves foundfeature

    The feature itself is recorded in the 2026-09-22 entry above. This entry is about what shipping it exposed, because in every case the tool was wrong and the vault was right.

Show the earlier 25 entries

  1. doorman profile: grading a harness, not only a serverfeature

    The scorecard grades MCP servers. a dashboard that only grades MCP servers will undercut a page that promises more." This closes it for the setup half.

  2. the write half of the subscriptionfeature

    The read half of a community has worked since the feed shipped: GET /feed publishes one row per graded server, doorman watch fetches it and matches locally against an inventory that is never sent anywhere. A candidate is graded once and…

  3. to 09-21: the launch audit, and the three blockers it found in the Workerdocs

    /go-live ran against all three surfaces. The audit's own headline finding is a site problem and is NOT fixed here, deliberately: the deployed site is not reproducible from this repo.

  4. a third severity, because the scanner missed a polite upsellfeature

    Reviewing the connectors of a live build produced a finding about the scanner itself. Notion's server instructions tell the reading agent to call a presentation tool and hand the user a "destination link" for full-version access.

  5. doorman reviews the harness it runs infeature

    Pointed at ClemVault, doorman could not review a single MCP server the session had. Four defects, each quiet:

  6. the surface of a server we cannot connect tofeature

    doorman review reached 22 urls on ClemVault and 21 of them answered 401. Add the 7 claude.ai connectors, which have no local url at all, and 28 of 41 reachable servers were name-only: doorman could not read the one thing it exists to…

  7. Session 19: ETHOnline 2026 submission & portfolio synchronizationfeature

    The project is fully submitted to ETHOnline 2026. Showcase URL: https://ethglobal.com/showcase/undefined-mw4pd

  8. the project reaches main, as one historyfeature

    Until that merge none of this project was on main: clembot-doorman/ read as untracked in the vault root while its work sat across three branches that all pointed at the same directory.

  9. Session 18: the release nobody could have runfeature

    Cutting a stable version for the ETHOnline submission. The intent was a version bump.

  10. Session 17: the day-one question, a plugin, and a page that liedfeature

    The product gained the stage it was missing. doctor reads what a build HAS, watch reads what was graded lately.

  11. Session 15, the product becomes a subscriptionfeature

    Clemens: "just like how weekly newsletters would give you some of the hot githubs, this takes a bit further and says that you can subscribe to an agentic service that will keep you updated on the latest builds for your setup."

  12. Session 16, a sweep, and the number that stopped itfeature

    doorman discover reads a public MCP registry and writes a candidate file. It never enqueues and never spends, because 13,648 entries nobody has looked at is a backlog rather than a feed.

  13. Session 11, the inbound spend permitfeature

    POST /grade was open. Deliberately: the site's demo lets a visitor type an MCP url and queue a real audit, and that is the best thing on the page.

  14. Session 12, doorman gets a CLIfeature

    A brief arrived describing doorman as an installed CLI to be invoked and never opened. Clemens confirmed this project IS the doorman meant, and that the CLI should be built here.

  15. Session 13, the instrument ships instead of the measurementfeature

    Clemens: "i honestly don't want to use any LLM resource here at all."

  16. Session 14, the gateway is live and stops describing what it cannot dofeature

    Doorman at clembot-doorman.bazgateway.com, active, upstream scorecard.wanessalabs.com, authenticating to us with an API key over Authorization: bearer carrying GRADE_TOKEN. POST /grade is priced at 1,000 millicents, one cent, on Base…

  17. Session 10, a nav that stopped scaling, and the repo going publicfeature

    Eleven top-level links fit on a desktop and read as a wall. The fix is not subtle, but the interesting part is where the six removed links went: into a jump row inside the new architecture section.

  18. Session 8, the install nobody had runfeature

    The gate has an adversarial suite. It proves the gate blocks unknown servers, that deny beats allow, that a missing registry fails closed, that it needs no network and no interpreter.

  19. Session 9, reading the page as a judge wouldfeature

    Read cold, the site had three problems and none of them were technical.

  20. Session 5, the fit review, and two bugs only reality could findfix

    runVet does not call the scorecard on a redundant verdict, and it also does not construct one. The difference matters because it is what makes the claim testable: the test passes a factory that throws when invoked, so a path that built a…

  21. Session 6, the guidance delta, and narrowing a claim until it was truefeature

    The third layer re-runs Cold Open with the drafted recipe in front of the agent and scores the recovered headroom. The obvious problem is that the recipe is written from the failures of the very run it then grades.

  22. Session 2, the planted F, and three ways the audit was quieter than it claimeddocs

    The denylist shipped with planted-bad.example.com, carrying a grade, a score and a hard-fail string that no audit had produced. Labelled "demo fixture", but it is a fabricated grade sitting in the product, which is what invariant 9 exists…

  23. Session 3, the scorecard becomes an MCP server and grades itselffeature

    The doorman subagent had declared exactly one tool since day one, mcp__bazantic-scorecard__grade, and nothing served it. In the original architecture Bazantic produces that MCP server by wrapping our OpenAPI spec, which meant the agent at…

  24. Session 4, a 3.0 spec and the comparison on the pagedocs

    Importers are not uniform about OpenAPI 3.1, and the spec is the first artifact a partner has to ingest. Finding out on Bazantic onboarding day that the importer only speaks 3.0.x would cost the day.

  25. Session 1, scaffold to working static pipelinefeature

    The project doc's Phase 3 asked for a /grade endpoint returning a static grade "by wrapping mcpscore". Inventory showed this is impossible: mcpscore is Python and depends on cryptography, pydantic-core, cffi and rpds-py, all native…

Written from this project's decision log as work happened, not afterwards. 1 entry was withheld from publication. See every project →