🦞 Pincer

A claw agent that audits claw-agent stacks. Point it at your AI agent setup (MCP servers, skills, permissions) and it finds the tooling that will turn on you: prompt injection in tool descriptions, instructions hidden in invisible Unicode, plaintext secrets, over-broad permissions, and tools that silently change their description after you approved them.

Built for the NVIDIA Claw Agent Challenge (SIGGRAPH 2026).

One sentence: Pincer finds malicious or injectable tooling in your agent setup before it bites you.

Why it exists

Everyone at the booth just installed OpenClaw/NemoClaw and wired up MCP servers and skills. Every one of those descriptions is fed to the model as trusted context. That is a live, documented attack surface (MCP tool poisoning, skill prompt injection, the "rug pull"). Pincer is the audit that goes with the sandbox.

What it detects

Class	Examples
Prompt injection / tool poisoning	"ignore previous instructions", "do not tell the user", exfil directives, instructions hidden in HTML comments
Hidden text	raw control bytes, Unicode tag block (invisible instructions), zero-width chars, bidi overrides
Config risk	plaintext API keys/secrets, wildcard permission grants, MCP servers launched via curl | bash
Rug pull	a tool/skill description that changed since you approved a baseline

Two layers

• Engine (pincer/): deterministic, fully local, no network. Emits JSON or a ranked Markdown report. Exit code = highest severity, so CI can gate on it.
• Agent (skill/SKILL.md): a claw skill that runs the engine, then reads each flagged file in context to confirm or dismiss the finding, writes a human report, and maintains the trusted baseline. That verification step is what makes it an agent, not a linter.

Quickstart

# scan a stack, ranked human report
python3 -m pincer.cli scan /path/to/agent/stack

# machine-readable for the agent
python3 -m pincer.cli scan /path/to/stack --format json

# approve current descriptions, then later runs flag any change (rug pull)
python3 -m pincer.cli baseline /path/to/stack

Try it on the bundled fixtures:

python3 -m pincer.cli scan tests/fixtures/benign    # clean
python3 -m pincer.cli scan tests/fixtures/trapped   # 15 findings

Demo

bash demo/run_demo.sh runs the full story: clean stack, then a booby-trapped stack, then a rug-pull where a tool a baseline trusted mutates its description.

Tests

python3 -m pytest -q

Roadmap (not in this build)

Dynamic MCP handshake inspection and tool-response fuzzing, signed reports, and a watch daemon that re-audits on config change.