{"slug": "nobody-searches-for-security-apps-so-i-made-mine-a-tool-for-ai-agents-instead", "title": "Nobody searches for security apps. So I made mine a tool for AI agents instead.", "summary": "A solo developer behind the Mac security app RoamSwitch has pivoted its discovery strategy by bundling an MCP server into the app, turning it into a tool for AI agents. The app now provides AI coding agents with real-time security reports, exposed port lists, and URL safety audits, and the developer has open-sourced the client library as RoamSwitchKit under MIT.", "body_md": "*A Japanese version of this is on Note.*\n\nIn my [previous post](https://dev.to/lafine_systemsdesign/the-app-was-the-easy-part-getting-anyone-to-trust-a-security-tool-from-a-solo-dev-wasnt-47h4), I wrote about the trust problem: how an unknown solo dev gets anyone to install a root-privileged Mac security app when they have no brand to hide behind.\n\nI published the security whitepaper, open-sourced the detection logic, built a verify script, and made license activation fully offline using Ed25519 signatures.\n\nAt the very end of that article, under \"What I still haven't solved,\" I left this note:\n\nJust being found at all.Unknown, near-zero ad budget. You can build something good and still not get discovered. Separate post.\n\nThis is that post. **How does an indie developer get a Mac security tool discovered when you can't be on the App Store, you have zero ad budget, and nobody is actively looking for what you built?**\n\nWith most indie apps — say, a Pomodoro timer or a Markdown notes app — there is a clear discovery path. People search \"best Mac timer,\" or you get featured on the App Store, or you tweet a nice UI screenshot and pick up organic interest.\n\nFor a network security app like [RoamSwitch](https://lafine.net/), none of those work:\n\n`pf`\n\n) and kills sharing daemons when you join an untrusted coffee-shop Wi-Fi. That requires a privileged helper (`SMAppService.daemon`\n\n), which Apple's sandbox rejects.Tweeting \"Hey, I built an app that automatically tightens your Mac firewall!\" produced the expected result: absolute silence.\n\nTrying to reach individual human users through conventional front-door marketing was structurally broken.\n\nI stopped and looked at what the app actually does.\n\nIt sits in the menu bar and continuously evaluates questions like:\n\n`0.0.0.0`\n\n, exposing internal ports to the whole coffee shop?Then it hit me: **The human at the keyboard doesn't want to babysit these questions. But the AI agent sitting next to them in Cursor or Claude Code desperately needs to know.**\n\nWhen an AI coding agent runs in your terminal, it spins up servers, hits local ports, and fetches external URLs autonomously. But the AI has zero sensory awareness of the physical environment. It doesn't know you just hopped onto an insecure airport network, or that `vite dev`\n\njust bound to all interfaces on a public LAN.\n\nWhat if, instead of asking humans to look at my menu bar UI, I turned the app into **the sensory organ for AI agents**?\n\nI bundled an open-standard **MCP server** directly inside the app binary.\n\nWith a single line in Claude Desktop or Cursor's config, the AI model gains direct access to local security tools:\n\n`get_security_report`\n\n: Overall posture score and passing/failing audit items.`get_exposed_ports`\n\n: List of listening ports exposed beyond localhost, with risk ratings.`get_guard_status`\n\n: Active security level (`open`\n\n/ `balanced`\n\n/ `lockdown`\n\n) and active guards.`audit_url_safety`\n\n: Real-time redirect chain expansion and safety scoring for URLs.Now, when a developer tells Claude, *\"Start the dev environment for this project,\"* the AI can call `get_exposed_ports`\n\nunder the hood and say:\n\n\"I started the development server on port 3000, but RoamSwitch reports it bound to\n\n`0.0.0.0`\n\non an untrusted public Wi-Fi network. Would you like me to reconfigure it to bind only to`127.0.0.1`\n\n?\"\n\nThe app moved from \"an annoying alert in the menu bar\" to \"invisible local infrastructure for AI workflows.\"\n\nNext, I extracted the client layer into a standalone Swift package, [RoamSwitchKit](https://github.com/lafine1211/RoamSwitchKit), and open-sourced it under MIT.\n\nAny Mac utility, status bar tool, or CLI can query RoamSwitch with a few lines of Swift Concurrency:\n\n``` python\nimport RoamSwitchKit\n\ndo {\n    let client = try RoamSwitchClient()\n    let ports = try await client.exposedPorts()\n    if !ports.isFirewallShielded {\n        // Handle unshielded network state\n    }\n} catch RoamSwitchClientError.appNotInstalled {\n    // Gracefully degrade if the user doesn't have RoamSwitch\n}\n```\n\nThe architectural rule here was strict: **Zero write APIs.**\n\nThere is intentionally no method to lower security levels, disable guards, or unblock ports. If the SDK had mutation endpoints, it would become an attack vector for other local processes. By making it 100% read-only diagnostic data, integrating it carries zero liability for third-party developers.\n\nI also added an [ AGENTS.md](https://github.com/lafine1211/RoamSwitchKit/blob/main/AGENTS.md) file to the repository so AI coding tools don't hallucinate non-existent write methods when generating integration code.\n\nIf you can't pay for ads, your only currency is primary source knowledge.\n\nNobody wants to read \"Why our security app is great.\" But engineers *love* reading about weird edge cases, packet-level breakdowns, and embarrassing development mistakes:\n\n`JSONSerialization`\n\n.`tcpdump`\n\nunder full lockdown to prove that zero bytes leave the machine.When you publish deep-dive technical logs, you aren't \"marketing.\" You're documenting real work. And the developers reading those articles think: *“Okay, this person isn't cutting corners. Let me try their tool.”*\n\nAsking someone to trust a solo developer's app as their primary security shield is a huge psychological barrier. But offering an MCP tool for Claude, or an open-source Swift package for diagnostics, turns it into a useful component. Developers are much more willing to test-drive a piece of tooling than an all-or-nothing security suite.\n\nTurning the app into AI infrastructure solved the discovery problem. People find the repo, try the MCP server, and read the articles.\n\nHowever, bridging the gap between *\"I use the free MCP integration during dev\"* and *\"I will pay $19.99 for the standalone Pro automation features\"* is still a significant hurdle. When you give away the diagnostic tools for free, some users will naturally stop there — and that's the tradeoff of building on open standards.\n\nWhen you can't rely on the App Store and have no money for ads, trying to push a standalone security product is an uphill battle.\n\nThe alternative is to **open up the interfaces, embed yourself into the tools developers already use every day (like AI agents), and let your engineering transparency do the talking.**\n\nIt's not an overnight viral hack. But for an indie hacker in the security space, building genuine infrastructure and proving your work is the only sustainable way forward.\n\n*The app is RoamSwitch. The Swift SDK is on GitHub (RoamSwitchKit), and the security whitepaper is here.*", "url": "https://wpnews.pro/news/nobody-searches-for-security-apps-so-i-made-mine-a-tool-for-ai-agents-instead", "canonical_source": "https://dev.to/lafine_systemsdesign/nobody-searches-for-security-apps-so-i-made-mine-a-tool-for-ai-agents-instead-195g", "published_at": "2026-08-29 15:08:29+00:00", "updated_at": "2026-08-29 15:18:58.594130+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-products", "ai-infrastructure"], "entities": ["RoamSwitch", "RoamSwitchKit", "Claude", "Cursor", "Apple", "MCP"], "alternates": {"html": "https://wpnews.pro/news/nobody-searches-for-security-apps-so-i-made-mine-a-tool-for-ai-agents-instead", "markdown": "https://wpnews.pro/news/nobody-searches-for-security-apps-so-i-made-mine-a-tool-for-ai-agents-instead.md", "text": "https://wpnews.pro/news/nobody-searches-for-security-apps-so-i-made-mine-a-tool-for-ai-agents-instead.txt", "jsonld": "https://wpnews.pro/news/nobody-searches-for-security-apps-so-i-made-mine-a-tool-for-ai-agents-instead.jsonld"}}