@somacheck/vibecheck 0.6.10 → 0.6.11

package/recipes/great-question-research-reflection.md

@@ -0,0 +1,212 @@
+---
+title: Great Question + SomaCheck Research Reflection
+recipe_id: great-question-research-reflection-v1
+status: P1 researcher-private, read-only partner-sandbox validation
+audience: Researchers using Great Question with an MCP-capable agent
+updated: 2026-09-05
+required_mcp_servers:
+  - great-question
+  - vibecheck
+---
+
+# Great Question + SomaCheck Research Reflection
+
+This recipe gives a researcher one private SomaCheck check-in while reviewing a
+participant-free Great Question test artifact provisioned by a product or
+integration owner. The observable result is a copy-ready research plan informed
+by the artifact's safe structure. Great Question remains unchanged. No
+candidate, participant, transcript, response, session, highlight, or insight is
+read, assessed, or changed.
+
+The researcher interacting with the agent must hold the phone and be the subject
+of the proposition. A reading is context for reflection—not truth, diagnosis,
+authorization, evidence about another person, or a research decision.
+
+## Researcher experience
+
+The product or integration owner supplies a partner sandbox and names one
+participant-free test study. The researcher holds the phone and asks the agent
+to review only that artifact's safe study structure. The agent drafts two
+five-question framings, offers one optional SomaCheck check-in on the
+researcher's own intended direction, receives Aligned or Unaligned plus
+confidence, and uses that context with its judgment before asking what the
+researcher chooses. The agent returns a signal-free, copy-ready research plan.
+It does not create, update, launch, or delete anything in Great Question.
+
+## Starter prompt
+
+```text
+Use Great Question and SomaCheck to help me reflect on a five-question test
+survey plan without changing Great Question. I am the researcher and I am
+holding the phone. The product or integration owner has provisioned a partner
+sandbox and named this participant-free test study: [TEST STUDY NAME OR ID].
+Read only that study's safe title, purpose, and question structure with
+get_survey_study. Do not search or list the workspace, and do not read
+candidates, participants, screeners, responses, sessions, transcripts,
+recordings, highlights, insights, reels, or other workspace data. Propose two
+neutral study framings and show their exact questions. Then offer one short
+first-person proposition about my own preferred framing and wait for my
+acceptance before any proactive SomaCheck ask. Give the agent the Aligned or
+Unaligned result plus confidence as context and let it use that context with
+its judgment. Ask what I choose in words. Keep the proposition, reading,
+confidence, and my confirmation out of Great Question. Return a signal-free,
+copy-ready research plan only. Do not create, update, delete, recruit, invite,
+message, schedule, incentivize, launch, publish, or otherwise write to Great
+Question. Do not ask me to sign up, upgrade, purchase, administer access, or
+populate Great Question data.
+```
+
+## Prerequisites and account access
+
+1. A product or integration owner has provisioned an organization-authorized
+   Great Question connection or partner sandbox at
+   `https://greatquestion.co/api/mcp/v1`, with PII hiding enabled. Running this
+   recipe does not ask the researcher to sign up, upgrade, purchase, administer
+   access, or populate Great Question data.
+2. The owner has supplied one clearly named, participant-free test study and
+   granted read access to that exact artifact through `get_survey_study`.
+3. The client restricts the Great Question half to `get_survey_study` for that
+   owner-supplied ID. No discovery or mutation tool is approved.
+4. The `vibecheck` server is connected to the researcher's SomaCheck account
+   and exposes `request_vibecheck` and `get_vibecheck_result`.
+
+## Great Question tool policy
+
+Great Question exposes a broad read/write MCP. This recipe uses an exact
+allowlist.
+
+| Purpose | Tool | Rule |
+| --- | --- | --- |
+| Read the supplied test artifact | `get_survey_study` | Read only the exact owner-supplied study ID and use only safe title, purpose, and question structure |
+| Private reflection | `request_vibecheck`, optional `get_vibecheck_result` | One decision, one request, stable pending handle |
+| Study discovery | `list_studies`, `search_studies`, `list_survey_studies`, `search_survey_studies` | Not needed; do not call |
+| Candidates and recruitment | All candidate, participant, segment, screener-invitation, scheduling, moderator, and message tools | Prohibited |
+| Human research data | All response, session, transcript, highlight, insight, reel, file, and recording tools | Prohibited |
+| All mutations | Create, update, delete, template-apply, screener, recruitment, and unmoderated/interview tools | Prohibited |
+
+Do not grant “always allow” to Great Question's whole server. Client-side tool
+approval or an allowlist should restrict this test to `get_survey_study` for the
+owner-supplied artifact.
+
+## Exact cross-MCP workflow
+
+1. **Confirm subject and scope.** State that the researcher is the phone holder
+   and proposition subject. Name the owner-supplied test study.
+2. **Read only the supplied artifact.** Call `get_survey_study` only for the
+   exact owner-supplied ID. Use only safe title, purpose, and question structure.
+   Do not search Great Question or retrieve any participant-bearing source.
+3. **Draft two options.** Provide two neutral framings, each with exactly five
+   questions, and explain the tradeoff. Label source facts, agent
+   interpretation, and suggestions separately.
+4. **Choose one proposition.** It must be short, first-person, and about the
+   researcher's own current direction, such as “I want this study to focus on
+   the moment a user decides whether to continue.” It must not include
+   participant claims, Great Question identifiers, or questionnaire text copied
+   from the platform.
+5. **Establish one-ask consent.** If the researcher requested SomaCheck in the
+   current message, use `consent_basis: "user_requested_vibecheck"`. Otherwise
+   display the exact proposition and wait for acceptance before using
+   `consent_basis: "user_approved_statement"`.
+6. **Request once.** Call `request_vibecheck` with the approved statement and a
+   fresh UUID `idempotency_key`. Reuse that key only after an ambiguous request
+   failure for the exact same statement.
+7. **Handle lifecycle accurately.** `request_vibecheck` reports a terminal
+   answer as `state: "completed"`; a later `get_vibecheck_result` reports it as
+   `status: "answered"`. If pending, keep the `live:<uuid>` handle and read it
+   once later. If still pending, expired, cancelled, or errored, continue
+   without a result. Never issue a replacement ask.
+8. **Use the signal as context.** Give the agent only the proposition, Aligned
+   or Unaligned reading, and confidence. Let it combine that context with the
+   conversation and its judgment. Keep observation, interpretation,
+   confirmation, and choice distinct.
+9. **Ask the researcher to choose in words.** Their typed answer controls what
+   follows and may differ from the signal.
+10. **Return a copy-ready plan.** Include only a test title, goal/purpose,
+    language, and the five questions. Do not attach an incentive, consent form,
+    screener, candidates, recruitment settings, or send settings.
+11. **End without a partner write.** State that Great Question remained
+    unchanged and name the single Great Question read tool called.
+
+## Proposition examples
+
+Allowed:
+
+- “I want this study to focus on initial comprehension.”
+- “I want these two research questions kept separate.”
+- “This wording reflects what I am trying to learn.”
+- “I am ready to save this as a test study.”
+
+Not allowed:
+
+- “This candidate is suitable for the study.”
+- “These participants will answer honestly.”
+- “This response is high quality.”
+- “This study proves users want the feature.”
+
+## Visible success condition
+
+The end-to-end test passes only when:
+
+- the researcher receives at most one optional SomaCheck request on their phone;
+- the agent uses Aligned or Unaligned plus confidence as context and asks the
+  researcher for their choice;
+- `get_survey_study` reads only the exact owner-supplied test artifact;
+- the agent returns a signal-free, copy-ready five-question plan;
+- Great Question remains unchanged; and
+- no candidate, participant, response, transcript, scheduling, messaging,
+  incentive, invitation, or recruitment action occurred.
+
+## Failure and degraded paths
+
+- **MCP access or owner-supplied artifact missing:** Do not ask the researcher to
+  sign up, upgrade, purchase, administer access, or populate Great Question.
+  Return a copy-ready plan from the supplied brief, tell the product or
+  integration owner what is missing, and label the platform half untested.
+- **Permission denied:** Do not broaden workspace permissions. Preserve the
+  copy-ready plan and stop.
+- **Runtime exposes only broad or write tools:** Do not call them. Return the
+  copy-ready plan and label the platform half untested.
+- **SomaCheck unresolved:** Use the same handle once later, then proceed without
+  a reading if unresolved.
+- **Unreadable capture:** Offer a retry only if the researcher wants it.
+- **The researcher's words differ from the reading:** Follow their typed choice
+  without reconciliation or repetition.
+
+## Privacy boundary
+
+- Raw phone motion never reaches Great Question or the agent.
+- Great Question receives no proposition, reading, confidence, confirmation,
+  or gesture metadata.
+- SomaCheck receives no Great Question study ID, questions, participant data,
+  transcript, recording, response, or credential.
+- No participant or candidate data is read into the agent conversation.
+- The copy-ready plan contains only researcher-approved, signal-free research
+  copy and is not written to Great Question.
+
+## Test checklist
+
+- [ ] The researcher is the phone holder and proposition subject.
+- [ ] A product or integration owner provisioned the partner sandbox, exact
+      participant-free test artifact, OAuth connection, and PII hiding.
+- [ ] Client approval is limited to `get_survey_study` for the exact
+      owner-supplied artifact.
+- [ ] No workspace discovery, candidate, participant, response, transcript,
+      other-artifact, scheduling, message, or invitation tool is called.
+- [ ] The proposition is first-person and contains no platform or participant
+      content.
+- [ ] At most one SomaCheck request is created for the choice.
+- [ ] Observation, interpretation, confirmation, and choice remain separate.
+- [ ] The researcher states a choice and receives a copy-ready, signal-free
+      five-question plan.
+- [ ] No create, update, delete, publish, launch, or other partner write occurs.
+- [ ] No incentive, screener, candidate, recruitment, invitation, session, or
+      participant contact exists.
+- [ ] No SomaCheck field or text is present in Great Question.
+
+## Sources
+
+- [Great Question MCP overview](https://greatquestion.co/support/integrations/mcp)
+- [Great Question MCP setup](https://greatquestion.co/support/integrations/mcp-setup)
+- [Great Question MCP tools and data handling](https://greatquestion.co/support/integrations/mcp-available-tools)
+- [SomaCheck MCP setup and tool behavior](../README.md)
+- [SomaCheck immediate-request contract](../LIVE-ASK-CONTRACT.md)

package/recipes/maze-research-reflection.md

@@ -0,0 +1,325 @@
+---
+title: Maze + SomaCheck Research Reflection
+recipe_id: maze-research-reflection-v1
+status: P1 researcher-side read-only reflection; authenticated Maze MCP capability required
+audience: Researchers using Maze with an MCP-capable agent
+updated: 2026-09-05
+required_mcp_servers:
+  - maze
+  - vibecheck
+---
+
+# Maze + SomaCheck Research Reflection
+
+This recipe gives a Maze researcher one private SomaCheck check-in while
+shaping the researcher's own interpretation plan for one named Maze study.
+The researcher stays the only person who reads, decides, or acts. The recipe
+reads only study metadata or aggregate summary and performs no Maze write.
+
+Maze is a hosted read-only MCP surface (`https://connect.maze.co/mcp`,
+OAuth 2.1). Setup happens in the AI host rather than through a toggle in the
+Maze product UI. Maze's current help pages are inconsistent about Maze-plan
+eligibility, so the authenticated MCP capability response is authoritative for
+the connected account. A team reporting `mcpAccess: true` is an eligible live
+connection regardless of its displayed plan label.
+
+The SomaCheck reading is context for the researcher's own interpretation
+plan. It is not truth, diagnosis, authorization, evidence about a Maze
+participant, or a research decision. The researcher remains the authority.
+
+## Capability and access boundary
+
+Maze documents the hosted MCP as read-only and OAuth 2.1 authenticated at
+`https://connect.maze.co/mcp`. The product or integration owner provisions it
+in a supported MCP host and makes an authorized organization connection or
+partner sandbox available to the researcher. Verify the provisioned access by
+calling the runtime account/team-details capability and requiring
+`mcpAccess: true` for the selected team. Do not infer access from a plan name
+or look for a Maze-side MCP toggle. Running this recipe never asks the
+researcher to sign up, upgrade, administer access, or populate Maze data.
+
+This P1 recipe is researcher-side only. Do not use it to:
+
+- ask a Maze participant, respondent, tester, employee, candidate, patient,
+  or student to complete a SomaCheck;
+- retrieve transcripts, session recordings, heatmaps, click maps, mission
+  answers, participant identifiers, contact fields, demographic exports,
+  free-text fields, or any row-level Maze data;
+- use a reading for participant recruitment, targeting, eligibility,
+  payment, ranking, stress detection, truth detection, deception
+  detection, preference quality, survey validity, research validity,
+  employee engagement, performance, mental health state, authenticity,
+  or quality scoring;
+- write a SomaCheck reading, confidence, gesture, confirmation, or hidden
+  score into Maze, a hidden field, a webhook payload, a comment, a tag, a
+  highlight, an insight, an automation, or any analytics record;
+- create, edit, publish, delete, archive, export, share, duplicate, or
+  otherwise mutate any Maze study, block, mission, prototype, folder,
+  report, insight, or theme; or
+- run a live participant workflow.
+
+Participant-facing use stays blocked until a `respondent_private`
+architecture prevents researcher or platform access to individual readings,
+methodology and ethics review is complete, and Sensie gives explicit
+privacy/legal approval. Maze MCP access, plan status, or participant consent
+alone does not satisfy these gates.
+
+## Experience a researcher can run
+
+The researcher holds the phone and selects one existing study supplied by the
+workspace owner. The agent reads only that study's safe metadata (name,
+description, status, mission list, block list, settings) or one aggregate
+summary (mission completion rates, time on task, success-rate aggregate,
+summary counts). It does not open transcripts, response rows, participant
+identifiers, recordings, or free-text fields. The agent offers two defensible
+interpretation framings and one short first-person proposition about the
+researcher's own interpretation plan. After the researcher's typed choice,
+the agent stops. There is no Maze write.
+
+## Starter prompt
+
+```text
+Use Maze and SomaCheck to help me reflect on my own interpretation plan
+for one named Maze study. I am the researcher and I am holding the phone.
+The study is: [STUDY NAME OR ID PROVIDED BY THE WORKSPACE OWNER]. Use only
+the preconfigured official hosted read-only Maze MCP at
+https://connect.maze.co/mcp. Read only that study's safe metadata (name,
+description, status, mission list, block list, settings) or one aggregate
+summary (mission completion rates, time on task, success-rate aggregates,
+summary counts). Do not retrieve
+transcripts, session recordings, heatmaps, click maps, mission answers,
+participant identifiers, contact fields, demographic exports, free-text
+fields, themes, highlights, or any row-level Maze data. Propose two
+defensible interpretation framings. Then offer one short first-person
+proposition about my own interpretation plan and wait for my acceptance
+before any proactive SomaCheck ask. Treat Aligned or Unaligned plus
+confidence as context, not truth, diagnosis, authorization, or evidence
+about a Maze participant. Ask what I choose in words. Keep the
+proposition, reading, confidence, and my confirmation out of Maze. Do
+not create, edit, publish, delete, archive, export, share, tag, comment,
+or write to Maze, a hidden field, a webhook, or any analytics record.
+Continue when the authenticated selected team reports `mcpAccess: true`.
+Otherwise label the Maze half untested, return the copy-ready plan, tell the
+integration owner what capability is missing, and stop. Do not ask me to sign
+up, upgrade, administer access, or populate Maze data.
+```
+
+## Prerequisites and account access
+
+1. The researcher can complete a normal SomaCheck request through the connected
+   `vibecheck` MCP server (`request_vibecheck` and
+   `get_vibecheck_result`).
+2. A product or integration owner has provisioned an authorized organization
+   connection or partner sandbox. Its authenticated Maze MCP reports
+   `mcpAccess: true` for the selected team. Do not reject an authenticated team
+   because its returned plan label is `Personal`, and do not claim access
+   merely from documentation or UI.
+3. The provisioned MCP client is connected to exactly
+   `https://connect.maze.co/mcp` and authenticated through the OAuth 2.1 flow
+   Maze publishes. Do not substitute a different host, path, or non-Maze
+   endpoint.
+4. The workspace owner supplies one named existing Maze study (by name or ID)
+   that does not require row-level participant data, transcripts, recordings,
+   contact fields, or free-text fields for the reflection task. The researcher
+   is not responsible for creating or populating it.
+5. No credential, OAuth token, study ID containing PII, or participant
+   identifier appears in chat, logs, prompts, or the SomaCheck
+   proposition.
+
+## Maze tool policy
+
+Maze publishes a hosted, OAuth 2.1, read-only MCP. The recipe uses the
+smallest tools that answer the researcher's request. Treat the live tool
+list as runtime-discovered; do not assume undocumented tool names.
+
+| Purpose | Allowed surface | Rule |
+| --- | --- | --- |
+| Resolve the named study | runtime-discovered study lookup or list | Read only the named study; never list every workspace study or participant row |
+| Read study metadata | runtime-discovered study detail / mission list / block list / settings | Read only the named study's metadata; treat status, description, mission list, and block list as metadata |
+| Read one aggregate summary | runtime-discovered aggregate or summary tool, if exposed | One aggregate read (counts, completion rates, time-on-task aggregates, success-rate aggregates); never row-level data |
+| Create, edit, publish, delete, share, archive, export, duplicate, tag, comment | any mutation tool | Prohibited in this recipe |
+| Transcripts, recordings, heatmaps, click maps, mission answers, participant identifiers, contact fields, demographics, free-text fields, themes, highlights, insights | any row-level or participant-bearing tool | Prohibited in this recipe |
+| Webhooks, automations, exports, analytics writes | any write side-effect tool | Prohibited in this recipe |
+| Private reflection | `request_vibecheck`, optional `get_vibecheck_result` | One decision, one request, one stable pending handle |
+
+Do not broaden a connection to a root or all-tools endpoint to make this
+recipe work. If the runtime does not expose a study-metadata or aggregate
+read, label the Maze half untested and stop.
+
+## Exact cross-MCP workflow
+
+1. **Confirm the subject and scope.** State that the researcher is the phone
+   holder and the subject of the proposition. Name the one existing Maze study
+   supplied by the workspace owner (by name or ID).
+2. **Verify Maze access honestly.** Call the authenticated account/team-details
+   capability. Continue only when the selected team reports `mcpAccess: true`.
+   Treat the runtime capability as authoritative rather than inferring access
+   from the plan label or searching for a Maze-side settings toggle.
+3. **Read only metadata or one aggregate summary.** Call the smallest
+   runtime tool that returns the named study's metadata (name,
+   description, status, mission list, block list, settings) or one
+   aggregate summary (counts, completion-rate aggregates, time-on-task
+   aggregates, success-rate aggregates). Do not call any tool that
+   returns transcripts, recordings, heatmaps, click maps, mission
+   answers, participant identifiers, contact fields, demographic
+   exports, free-text fields, themes, highlights, or insights.
+4. **Separate evidence from interpretation.** Label what the Maze study
+   literally contains, what the agent infers, and what the researcher's
+   own judgment must still decide.
+5. **Propose two framings.** Offer two defensible interpretation
+   framings the researcher could choose from, with the tradeoff for each.
+6. **Choose one first-person proposition.** It must be short,
+   first-person, and about the researcher's own interpretation plan. Do not include
+   Maze IDs containing PII, participant data, transcript text, contact
+   fields, free text, themes, or highlights.
+7. **Establish one-ask consent.** If the researcher explicitly requested a
+   SomaCheck check-in in the current message, use
+   `consent_basis: "user_requested_vibecheck"`. Otherwise show the
+   exact proposition, wait for acceptance, and use
+   `consent_basis: "user_approved_statement"`.
+8. **Request once.** Call `request_vibecheck` with the approved statement
+   and a fresh UUID `idempotency_key`. Reuse it only to retry the
+   identical request after an ambiguous create failure.
+9. **Handle the real lifecycle.** A terminal response from
+   `request_vibecheck` uses `state: "completed"`; a later read uses
+   `status: "answered"`. If the initial response is `pending`, retain the
+   returned `live:<uuid>` handle and call `get_vibecheck_result` with
+   it once later. If it is still `pending`, `expired`, `cancelled`, or
+   errors, continue without a result. Never issue a replacement ask.
+10. **Return authority.** Separate observation (a valid gesture was
+    captured), interpretation (`aligned` or `unaligned` plus model
+    confidence), confirmation (what the researcher says), and choice (what the researcher
+    decides). `unaligned` may indicate possible inner conflict relative
+    to the proposition; it does not name a cause, choose an interpretation,
+    or justify a research claim.
+11. **Ask for words.** Ask the researcher which framing they choose, whether they
+    want a third option, or whether they want to stop. Follow their typed
+    choice.
+12. **Keep the signal out of Maze.** Do not call any Maze write, mutation,
+    export, webhook, comment, tag, highlight, insight, analytics, or
+    hidden-field tool. Do not store the proposition, reading,
+    confidence, confirmation, or gesture metadata in Maze.
+13. **End the test.** Report the exact Maze tool names used and the
+    exact metadata or aggregate fields returned, or report the
+    copy-ready plan when the Maze half is untested. Do not create,
+    edit, publish, delete, archive, export, share, duplicate, or
+    otherwise mutate any Maze object.
+
+## Proposition examples
+
+Allowed:
+
+- "I can interpret this Maze study without reading individual
+  transcripts."
+- "I have a clear interpretation plan for the aggregate success-rate
+  summary."
+- "I am ready to use only metadata and one aggregate summary for this
+  study."
+- "I want to keep the participant data out of my interpretation
+  decision."
+- "I can explain what this Maze study is showing without overclaiming."
+
+Not allowed:
+
+- "This Maze participant is telling the truth."
+- "These Maze testers are engaged."
+- "This mission result is high quality."
+- "These respondents should be paid or rejected."
+- "This Maze study proves my hypothesis."
+
+## Visible success condition
+
+The test passes when:
+
+- the researcher selects one existing Maze study supplied by a workspace owner
+  in a team whose authenticated MCP response reports `mcpAccess: true`;
+- the agent reads only that study's metadata or one aggregate summary
+  through the hosted read-only Maze MCP and reports the exact tool
+  names used;
+- the agent never calls a row-level, transcript, recording, heatmap,
+  click map, mission-answer, participant-identifier, contact, free-text,
+  theme, highlight, insight, automation, or write tool;
+- the researcher receives at most one optional SomaCheck check-in on their phone
+  on an exact first-person proposition about their own interpretation plan;
+- the agent presents the result as context, asks the researcher to state their
+  choice in words, and follows the typed choice;
+- the agent makes no Maze write, mutation, export, share, tag,
+  comment, or analytics call; and
+- no Maze participant, respondent, or employee data enters the
+  cross-MCP flow.
+
+## Failure and degraded paths
+
+- **Authenticated team lacks MCP access:** Label the Maze half untested. Return
+  the copy-ready interpretation plan and stop. Never substitute a plan label,
+  documentation walkthrough, static/local fixture, or non-Maze endpoint for an
+  authenticated organization or partner-sandbox pass.
+- **OAuth 2.1 failure or absent scope:** Report the missing capability to the
+  product or integration owner; never request a token in chat or ask the
+  researcher to sign up, upgrade, or administer access. Return the copy-ready
+  plan and stop.
+- **Runtime exposes only row-level or participant-bearing tools:** Do
+  not call them. Label the Maze half untested and stop. Do not broaden
+  the connection to make this recipe work.
+- **MCP returns row-level data, participant identifiers, transcripts,
+  recordings, free-text fields, themes, highlights, or insights:** Stop
+  immediately. Discard the row-level content from the agent context.
+  Report the exact fields received and ask the product or integration owner to
+  revoke or limit the scope. Do not use the row-level content in any
+  proposition, framing, or interpretation.
+- **SomaCheck unresolved:** Use the same `live:<uuid>` handle once
+  later, then proceed without a reading if still unresolved.
+- **Unreadable capture:** Offer a retry only if the researcher wants it;
+  unreadable is not a third interpretation.
+- **Researcher disagrees with the reading:** Follow the researcher's typed choice
+  without reconciliation or repetition.
+
+## Privacy boundary
+
+- Raw phone motion never reaches Maze or the agent.
+- Maze receives no proposition, reading, confidence, confirmation,
+  gesture metadata, or row-level participant data through this recipe.
+- SomaCheck receives no Maze study ID containing PII, mission text,
+  participant data, transcript, recording, contact field, free-text
+  field, theme, highlight, or insight.
+- No Maze participant, respondent, or employee data is read into the
+  agent conversation, prompt, proposition, framing, or memory.
+- The Maze workspace remains unchanged. No mutation, write, export,
+  share, tag, comment, automation, webhook, or analytics call occurs.
+
+## Test checklist
+
+- [ ] The researcher is the phone holder and the subject of the proposition.
+- [ ] The authenticated Maze team reports `mcpAccess: true`; its plan label is
+      recorded only as context and is not used to override the capability.
+- [ ] The MCP client is connected to exactly
+      `https://connect.maze.co/mcp` through Maze's OAuth 2.1 flow; no
+      other host, path, or non-Maze endpoint is used.
+- [ ] No Maze credential or OAuth token appears in chat, logs, or the
+      SomaCheck proposition.
+- [ ] The agent reads only metadata or one aggregate summary of the
+      named study and reports the exact runtime tool names used.
+- [ ] The agent does not call any transcript, recording, heatmap,
+      click map, mission-answer, participant-identifier, contact,
+      free-text, theme, highlight, insight, automation, or write tool.
+- [ ] The proposition is first-person and contains no Maze IDs
+      containing PII, participant data, transcripts, contact fields,
+      free-text fields, themes, or highlights.
+- [ ] At most one SomaCheck request is created for the choice.
+- [ ] Observation, interpretation, confirmation, and choice remain
+      separate.
+- [ ] The researcher states a choice in words and the agent follows the typed
+      choice.
+- [ ] The agent makes no Maze mutation, write, export, share, tag,
+      comment, or analytics call.
+- [ ] No Maze participant, respondent, or employee data enters the
+      cross-MCP flow.
+
+## Sources
+
+- [Maze MCP support article](https://help.maze.co/articles/3603930517-maze-mcp)
+- [Set up Maze MCP](https://help.maze.co/articles/8675970764-set-up-maze-mcp)
+- [Maze product help](https://help.maze.co/)
+- [SomaCheck MCP setup and tool behavior](../README.md)
+- [SomaCheck immediate-request contract](../LIVE-ASK-CONTRACT.md)
+- [MCP Customer-Testable Experience Catalog](../../../docs/agent-adoption/customer-experience-catalog.md)