@nodatachat/mcp 1.3.17 → 1.3.18

package/README.md

@@ -215,7 +215,15 @@ Three more rules:
 - **Code the last scan flagged.** Source code normally passes. A code file your latest scan flagged critical or high (a customer's ID typed into a script) is held like a data file. Change the file or re-scan and it drops off the list.
 - **NoData's own keys are refused, never asked.** No agent can read `~/.nodata/device-key.json`, the vault login or the org credential, whichever tool it uses, even with approval. Whoever holds the device key opens every sealed file.
 
-Back the device key up yourself: copy `~/.nodata/device-key.json` to a USB stick or a password manager, then run `npx -y @nodatachat/mcp@latest key-backed-up`. NoData reminds you until you do.
+Back the device key up with one command, in a terminal and never in the chat: `npx -y @nodatachat/mcp@latest key-backup E:` (E: is your USB drive). It copies the key, checks that the copy is identical, and records the backup. NoData holds no copy of this key and cannot recover it, so this backup is the only recovery. NoData keeps reminding you until the backup is done.
+
+At every start NoData checks this machine — version (and whether a newer one exists), organisation connection, terms, language, read gate, key backup, PDF readers — and the agent walks you through whatever is off, one step at a time. Anytime: ask "what is missing?", or run `npx -y @nodatachat/mcp@latest doctor` in a terminal.
+
+Questions about NoData are answered from one answer bank: the agent passes the question to `nodata_get_started` and relays only what comes back — what NoData gives, with the tool that does it. Each answer is recorded in `~/.nodata/answers.log` (entry ids and bank version, never the question), each line chained to the one before by hash.
+
+Run a command with a project's secrets without a `.env` on disk: `npx -y @nodatachat/mcp@latest secrets-login --project <label>` once (the token is typed in the terminal, never in the chat), then `npx -y @nodatachat/mcp@latest secrets-run -- npm run dev`. The secrets live only in that command's memory. An agent does the same through `nodata_run`, with your approval per command.
+
+PDFs are read by NoData's own reader. Two free tools make it read more, on this computer only (NoData never sends a document anywhere to read it): Poppler's `pdftotext` reads every PDF a second time and reads some the built-in reader cannot, and Tesseract reads scanned pages (OCR, in the folder scan). Install them once with `winget install oschwartz10612.Poppler` and `winget install UB-Mannheim.TesseractOCR` (tick Hebrew in its installer), then check with `npx -y @nodatachat/mcp@latest pdf-tools`. `NODATA_PDF_TOOLS=off` turns them off.
 
 ## Available tools