También en español: rosmarops.com/es/blog/rosmarops-ya-se-puede-descargar/
A few days ago I wrote that my machine scored 18 out of 100. Today the tool that gave me that number is public, for anyone on Windows.
RosmarOps reads the configuration of your AI coding agents on your computer and shows what each one can reach: which keys it can read without asking you, whether it can send them out and who decides that (you, another AI model, or nobody), and which agents can change another agent’s configuration or instructions.
What’s in it
- Claude Code and Cursor, each with its own Agent Posture Score out of 100. Cline, GitHub Copilot and Continue are detected, without a score yet.
- A visual report in English or Spanish, in three steps: your situation, what to do first with the exact change, and what’s left.
- Keys saved in git, including in past commits.
- Memory between runs: findings that are new, still observed or no longer observed.
- A text you can paste into your own agent so it helps you apply the changes, asking you at each step.
What it doesn’t do
It reads only, writes only to its own folders, and contains no networking code. No telemetry either, not even opt-in: there is no switch, because there is no code that could send anything.
This matters to me more than any feature. A program that reads your agents’ configuration and your keys has, from a permissions standpoint, the same shape as malware. So the only honest thing to do is let you check what it does.
Check it before you run it
Every release comes with a SHA-256 checksum, a GitHub attestation and a build anyone can reproduce: how to check it. The program isn’t signed with a code-signing certificate yet, so Windows SmartScreen may warn you the first time.
Its limits
It reads configuration at rest. It doesn’t see what an agent does while it runs, settings kept only inside an app’s database or on a vendor’s servers, or anything set only in one terminal session. The report says what it assumes and lists what it couldn’t read. What wasn’t read doesn’t count as clean.
Try it
Download it for Windows from GitHub: download rosmarops.exe from the latest release and double-click it. It finds your projects on its own; if it finds none, it asks you to choose the folder where you keep them. The report opens in your browser when it finishes (up to 5 minutes), in your Windows language, with a link to the other language.
It’s free and open source (AGPL-3.0), and the whole method behind the score is public.
If you see it do something it shouldn’t, above all connect to the network or write outside its folders, report it privately on GitHub: Security → Report a vulnerability. And if the report gets something wrong about your setup, I’d like to know.
I wrote this with AI assistants. The machine, the findings and the decision to publish are mine.