Hot take: "vibe coding" is great for building apps and terrible for building trust.
You can vibe-code a frontend in 20 minutes. You cannot vibe-code a security review or 23 metrics building a score in real time.
https://t.co/szdpcxutC2
npm had left-pad.
Docker had typosquatting.
Python had malicious packages.
Every tool ecosystem eventually gets poisoned.
AI agents are next. The difference is the blast radius is your entire system, not a single dependency.
Use https://t.co/szdpcxutC2 ๐
@LarkDavis This is exactly the pattern that scales. Clone a trusted tool, match the docs, wait for installs.
It worked with npm. It worked with PyPI. Now it's AI agents with root access to your machine.
The only defence is verifying trust before install, not after.
Cisco's 2026 State of AI Security report:
83% of orgs plan to deploy agentic AI.
29% say they're ready to secure it.
That's not a gap.
That's a canyon with a sign that says "deploy first, ask questions never."
https://t.co/fYxMqlvov5
Built a trust scoring engine because the alternative was hoping the AI agent ecosystem would self-regulate.
It won't.
5,800+ services scored.
6 dimensions. 23 sub-metrics.
100% Free.
OpenAI just launched an AI agent to find vulnerabilities in code. Meanwhile, nobody is checking the AI agents themselves.
Codex Security scans your codebase. It does not scan the 47 MCP servers your agent connected to this week.
That's a different problem. That's ours ๐ค
Weekend project:
Pick 5 MCP servers your agent uses. Check their trust scores.
You might find that "safe" tool has a vulnerability score of 1.2 or a publisher with zero GitHub history.
โ https://t.co/fYxMqlvov5
What'd you find? Drop it below ๐
Weekend project:
Pick 5 MCP servers your agent uses. Check their trust scores.
You might find that "safe" tool has a vulnerability score of 1.2 or a publisher with zero GitHub history.
โ https://t.co/fYxMqlvov5
What'd you find? Drop it below ๐
If your AI agent auto-selects tools and there's no trust check in the pipeline, you're shipping a security incident.
Your agent can't read a README. Can't Google the author. Can't ask if a package is legit.
It needs a score.
One API call [allow / review / block]
That's it.