RuView is a WiFi sensing platform that uses disturbances in radio signals, captured by low-cost ESP32 sensors, to detect presence, movement, breathing, and heart rate without cameras or wearables. It is intended for spatial monitoring and smart-home integrations. The catalogue add-ons support workflows for operating and integrating RuView.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ruvnet/RuView --skill cognitum-spacesgit clone --depth 1 https://github.com/ruvnet/RuViewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ruvnet/ruview/cognitum-spaces)<a href="https://agentmods.dev/skills/ruvnet/ruview/cognitum-spaces"><img src="https://agentmods.dev/badge/skills/ruvnet/ruview/cognitum-spaces.svg" alt="Measured on agentmods" height="20"></a>- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 58 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium MCP Rug Pull · line 36 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 37 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 38 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 59 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00657 |
| Opus 5 | $0.00000 | $0.00329 |
| Sonnet 5 | $0.00000 | $0.00131 |
| Haiku 4.5 | $0.00000 | $0.00066 |
Grade A, and why
cognitum-spaces scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cognitum Spaces OAuth activation
Use this playbook to activate and inspect the tenant-scoped Cognitum Spaces projection without giving an agent a bearer token or API key.
Boundary
- This is a read-only P2/P3 semantic projection. HomeCore Edge remains authoritative.
- Raw CSI, CIR, RF tensors, recordings, pose frames, vital waveforms, and identity observations are prohibited.
spaces:readgrants no pairing, publication, write, command, policy approval, spending, or actuator authority.- A read may refresh an expiring OAuth session and atomically rotate the local credential file.
Activate OAuth explicitly
Install or build the wifi-densepose CLI, then request the additional scope:
wifi-densepose login --spaces
For a terminal without a browser:
wifi-densepose login --spaces --no-browser
Confirm that the account reports spaces:read, then list through the
metaharness:
wifi-densepose whoami
npx @ruvnet/ruview spaces
npx @ruvnet/ruview spaces --resource sites
npx @ruvnet/ruview spaces --resource events --limit 25
The versioned collections are sites, buildings, floors, spaces,
zones, entities, events, and alerts. Continue a page with the returned
opaque nextCursor; do not decode or reuse a cursor for another collection.
Use --credentials-path <private-file> only from the human-invoked CLI when a
non-default credential store is intentional. Never put a bearer token or API
key on the command line.
MCP
The tool is ruview_spaces_list. It is denied by default even though the cloud
operation is read-only, because it consumes a local identity credential and
contacts an external service. The MCP server operator must grant that capability
and may bind the credential path in the server environment:
RUVIEW_MCP_GRANTS=credential-use \
RUVIEW_CREDENTIALS_PATH=/private/ruview/credentials.json \
npx @ruvnet/ruview mcp start
MCP calls cannot choose a credential path and the tool schema has no token or
API-key, workspace override, or base-URL field. The API origin is fixed to
https://api.cognitum.one, the adapter requires an installed
wifi-densepose binary, and the child environment excludes
COGNITUM_SPACES_API, so this
surface verifies the OAuth path rather than silently taking the compatibility
API-key path.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 78 lines · 0 tokens per session scan A 96ae42cc72ad
cognitum-spaces is a skill published in the GitHub repository ruvnet/RuView (92,761 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 657 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
meraki-wireless-ops
Cisco Meraki wireless (read-only) — SSID configuration, RF profiles, Air Marshal, channel utilization, signal quality, client connectivity events via Cisco's official Meraki MCP. Use when inspecting Meraki SSIDs, auditing RF configuration, or investigating WiFi connectivity.
frontmcp-observability
Use when adding tracing, structured logging, metrics, or monitoring to a FrontMCP server. Covers zero-config OpenTelemetry distributed tracing across all flows; the this.telemetry API for custom spans, events, and attributes in tools, plugins, agents, and skills; structured JSON logging with trace correlation and…
openstatus-api
Call the openstatus public API (ConnectRPC, JSON over HTTP) to manage monitors, status pages, status reports, and maintenance windows. Use when building integrations, automating monitoring as code, or driving openstatus from a script outside an MCP client.
bunjs-production
Use when deploying Bun.js to production, containerizing with Docker, setting up AWS ECS/Fargate, implementing Redis caching, hardening security, or configuring CI/CD pipelines. See bunjs for basics, bunjs-architecture for patterns.
cap_http_request
Call allowlisted HTTP or HTTPS endpoints directly and return response status plus body text, or stream the response body to a file.
http_server_lua_demo
Start a small Lua-hosted web page that shows Hello World and logs switch toggles from the browser.