Sigil Bot

What Sigil Bot does

Sigil Bot watches public package registries for newly published and updated packages. When a new package appears, the bot downloads it into quarantine, runs all eight scan phases, stores the results, and publishes a report page at sigilsec.ai/scans.

                ┌──────────────────────┐
                │     SIGIL BOT        │
                │                      │
                │  Monitors registries  │
                │  Downloads packages   │
                │  Runs Sigil scans     │
                │  Stores results       │
                └──────────┬───────────┘
                           │
          ┌────────────────┼────────────────┐
          │                │                │
          ▼                ▼                ▼
   ┌────────────┐  ┌────────────┐  ┌────────────┐
   │ Scan DB    │  │ Badges     │  │ Threat     │
   │ /scans/*   │  │ /badge/*   │  │ Feed       │
   │ pages      │  │ SVGs       │  │ RSS + API  │
   └────────────┘  └────────────┘  └────────────┘

Monitored registries

Five registries are monitored continuously. Each has a dedicated watcher process with optimised polling for that registry's API.

Scan pipeline

Every scan follows the same five-stage pipeline: watch, queue, scan, store, publish.

WATCHER ──▶ QUEUE ──▶ SCANNER ──▶ STORE ──▶ PUBLISHER
 Poll feeds   Redis     Download    Postgres   Report page
 Deduplicate  Priority  Extract     Findings   Badge cache
 Filter       Retry     Sigil scan  Metadata   RSS feed
 Enqueue      Backoff   All phases             Alerts

Typosquatting detection

New packages with names within edit distance 2 of popular AI packages are automatically boosted to critical priority. This catches common squatting patterns before developers encounter them.

Target packages monitored for typosquats:
  langchain, openai, anthropic, transformers,
  huggingface, crewai, autogen, llamaindex,
  pinecone, chromadb, fastapi, streamlit

Detection patterns:
  Character substitution: langch4in, openal
  Character insertion:    langchainn, openaai
  Character deletion:     langchai, opena
  Transposition:          langchian, openia

Flagged packages receive an additional finding in the Provenance phase noting the name similarity.

Threat feed

Scan results are published to multiple output channels for downstream consumption.

RSS feed

Standard RSS 2.0 feed at sigilsec.ai/feed.xml. Contains the latest 100 scan results. Supports filtered variants:

All scans:      sigilsec.ai/feed.xml
Threats only:   sigilsec.ai/feed.xml?verdict=high_risk,critical_risk
ClawHub only:   sigilsec.ai/feed.xml?ecosystem=clawhub
PyPI only:      sigilsec.ai/feed.xml?ecosystem=pypi
npm only:       sigilsec.ai/feed.xml?ecosystem=npm

API endpoint

GET /api/v1/feed?ecosystem={eco}&verdict={v}&limit={n}&since={iso_datetime}

JSON array of recent scans. Same filtering as RSS. This is what the MCP server queries, the GitHub App looks up, and third-party integrations consume.

Alerts

HIGH RISK and CRITICAL RISK findings trigger alerts to subscribed webhook endpoints. Only findings with a risk score of 25 or above generate alerts.

Scan attestations

Every scan produced by Sigil Bot is cryptographically signed. This lets anyone verify that a scan result is genuine and untampered.

For full verification steps and public keys, see the Attestation docs.

AI ecosystem filtering

The bot doesn't scan every package on PyPI and npm — it targets the AI agent supply chain. Packages are matched if their name, description, or keywords contain any of these terms:

Frameworks:    langchain, crewai, autogen, llamaindex, haystack, dspy
LLM providers: openai, anthropic, cohere, mistral, groq, together
MCP / agents:  mcp, model-context-protocol, agentic, tool-use
RAG:           rag, retrieval, vector, embedding, pinecone, chroma
ML:            transformers, huggingface, diffusers, torch, tensorflow
Skills:        skill, plugin, extension, chatgpt-plugin, copilot-extension

Bot identity

The bot operates under a dedicated sigil-bot account, separate from NOMARK staff activity. Automated outputs are clearly labeled as automated.

• GitHub: The GitHub App acts as sigil-bot[bot]
• Scan database: Report pages show “Scanned by Sigil Bot” with timestamp
• Threat feed: RSS and API entries attributed to the bot identity

Dispute a result

Packages are scanned automatically from public registries without author consent. If you believe a scan result is incorrect, you can:

• Use the “Request a review” link on any scan report page
• Email security@sigilsec.ai directly

Disputes are acknowledged within 48 hours. See the full dispute process in our Terms of Service.

See also

• •Scan Database — browse all published scan results
• •Methodology — how scans work, eight phases, detection criteria
• •API Reference — consume scan data programmatically
• •Scan Attestations — verification steps and public keys
• •Agent Discovery — A2A agent card, WebMCP, structured data for AI agents
• •Terms of Service — automated scanning, badge usage, dispute process