kodelyth-ecc 1.7.3 → 1.7.4

package/videos/video-03-devil-mode.md

@@ -1,294 +0,0 @@
-# VIDEO 3 — "Devil Mode: I audited my own codebase with 8 adversarial agents"
-
-**Duration:** 10–12 minutes  
-**Platform:** YouTube (security engineers, senior devs, indie hackers pre-launch)  
-**Hook:** Real adversarial findings on a real project — not a demo, an actual audit  
-**Goal:** Show that ECC's devil mode produces real security value, not theater  
-**Screen setup:** Terminal + code editor + Claude Code/Windsurf on right
-
----
-
-## FULL SCRIPT
-
----
-
-### [0:00–0:25] COLD OPEN — Start with a finding
-
-**[SCREEN: Claude Code showing a live devil-mode result]**
-
-**NARRATION:**
-> "This is a real finding."
-
-**[Show output — e.g., a secret in a config file, or a GPL dep, or a prompt injection vector]**
-
-**NARRATION:**
-> "I ran 8 adversarial agents on my own project. In parallel. They found this in under 3 minutes."
-> "And I had already done a 'security review' the week before."
-
-**[TITLE CARD: Devil Mode — 8 adversarial agents. Attacker mindset.]**
-
----
-
-### [0:25–1:30] WHY SECURITY REVIEWS FAIL
-
-**[SCREEN: Simple diagram]**
-
-**NARRATION:**
-> "Most security reviews fail for a simple reason."
-> "The person doing the review is the same person who wrote the code."
-> "You can't unsee what you built. You have blind spots in exactly the places that matter."
-
-**[Draw: developer → reviews own code → misses the thing they built]**
-
-**NARRATION:**
-> "An attacker has no such blind spot. They come in cold. They look at your code the way a stranger would."
-> "Devil mode is that stranger."
-
-**[SCREEN: List the 8 agents]**
-
-**NARRATION:**
-> "8 agents. Each one with a specific attack surface. All running in parallel."
-> "Let me walk you through each one — then we'll run them live."
-
----
-
-### [1:30–4:30] THE 8 AGENTS — QUICK TOUR
-
-**[Show each agent as a card — name + what it hunts + one real grep pattern]**
-
-**[AGENT 1: secret-hunter]**
-
-**NARRATION:**
-> "Secret hunter. This one looks for leaked credentials."
-> "Not just obvious API keys — it digs into git history. Leaked secrets don't disappear when you delete the file. They live in every commit before you noticed."
-
-**[SCREEN: Show bash pattern — `git log -p --all | grep -E 'AKIA|ghp_|sk-|SG\.'`]**
-
-**NARRATION:**
-> "AWS keys, GitHub tokens, Stripe secret keys, SendGrid API keys. All have distinctive prefixes. It knows them."
-
----
-
-**[AGENT 2: supply-chain-auditor]**
-
-**NARRATION:**
-> "Supply chain auditor. Your biggest attack surface is probably your node_modules."
-> "It checks for typosquats — packages named almost like popular ones. It checks lockfile drift — packages that changed without a lockfile update. It reads install scripts."
-
-**[SCREEN: Show a package with an install script that makes a network call]**
-
----
-
-**[AGENT 3: license-violation-finder]**
-
-**NARRATION:**
-> "License violation finder. If you're going open source, one GPL dependency contaminates your whole project under copyleft law."
-> "This agent maps your dependency tree, identifies AGPL and GPL licenses, and flags anything that creates legal risk before you flip the repo public."
-
----
-
-**[AGENT 4: prompt-injection-hunter]**
-
-**NARRATION:**
-> "Prompt injection hunter. This one is for AI-powered features."
-> "If your app takes user input and feeds it to an LLM — a chatbot, a RAG pipeline, a tool-calling agent — that input path is an attack surface."
-> "Indirect injection. System prompt leak. Tool hijacking. This agent reads every LLM integration looking for those patterns."
-
----
-
-**[AGENT 5: jailbreak-tester]**
-
-**NARRATION:**
-> "Jailbreak tester. This one red-teams your AI features live."
-> "It doesn't just read code — it sends adversarial inputs to your running AI and checks if your guardrails hold."
-
----
-
-**[AGENT 6: code-stealer-detector]**
-
-**NARRATION:**
-> "Code stealer detector. If you're shipping commercial software, you need to know if any block of code was copy-pasted from somewhere with a license that conflicts with yours."
-> "This is especially critical for AI-generated code — Copilot and similar tools sometimes reproduce licensed training data."
-
----
-
-**[AGENT 7: backdoor-hunter]**
-
-**NARRATION:**
-> "Backdoor hunter. This one looks for malicious code patterns."
-> "Obfuscated eval. Suspicious base64. Functions that encode URLs at runtime. Unexplained outbound connections."
-> "If you received code from a contractor or vendored a library — this is the scan you run first."
-
----
-
-**[AGENT 8: chaos-engineer]**
-
-**NARRATION:**
-> "Chaos engineer. Not a security agent in the traditional sense — an adversarial reliability agent."
-> "It asks: what happens when your database goes down? When your message queue fills up? When a downstream API times out at the worst moment?"
-> "It maps your hidden assumptions and turns them into fault injection scenarios before your users find them."
-
----
-
-### [4:30–7:30] LIVE AUDIT — REAL PROJECT
-
-**[SCREEN: Terminal — running on a real sample project]**
-
-**NARRATION:**
-> "Let's run it. I'm going to use a real project — a Next.js SaaS starter I've been building."
-
-**[TYPE in Claude Code / Windsurf chat:]**
-```
-/devil-mode --pre-public
-```
-
-**[Show the agents firing — show output appearing in real time]**
-
-**NARRATION:**
-> "Watch the agents fan out in parallel. Each one is running its own playbook simultaneously."
-
-**[Wait for results — narrate as they come in:]**
-
-**[Finding 1: secret-hunter]**
-
-**NARRATION:**
-> "Secret hunter flagged something. Let's look."
-
-**[Show: a .env.example file that was committed with a real key accidentally]**
-
-**NARRATION:**
-> "Committed 3 months ago. I removed it, but it's in git history. Anyone who clones this repo can find it with `git log -p`."
-> "This would have been a problem if I went public. Now it's not."
-
-**[REMEDIATION shown: `git filter-branch` or BFG Repo Cleaner command]**
-
----
-
-**[Finding 2: supply-chain-auditor]**
-
-**NARRATION:**
-> "Supply chain flagged a package. Let me check."
-
-**[Show: a dep with an install script that makes a network call to a third-party analytics service]**
-
-**NARRATION:**
-> "This package phones home on install. I had no idea. It's not malicious but it's not something I want happening silently."
-
----
-
-**[Finding 3: license-violation-finder]**
-
-**NARRATION:**
-> "License finder flagged one. LGPL-2.1 in a transitive dependency."
-> "For my use case — commercial SaaS — this is fine if I keep it as a library. It's flagging for awareness, not as a blocker."
-> "But if I was statically linking it, different story."
-
----
-
-**[Summary]**
-
-**[Show the aggregated report:]**
-
-```
-CRITICAL (1):  Leaked secret in git history — rotate STRIPE_SECRET_KEY immediately
-HIGH     (1):  Dependency phones home on install — audit or replace
-MEDIUM   (1):  LGPL transitive dep — review linking model
-LOW      (2):  Two advisory items
-```
-
-**NARRATION:**
-> "Three real findings I would have missed. The most important one — the leaked key — would have been a serious problem post-launch."
-> "This took 3 minutes. Not 3 hours. Not a contractor invoice."
-
----
-
-### [7:30–8:30] THE THREE FLAGS
-
-**[SCREEN: Terminal]**
-
-**NARRATION:**
-> "Devil mode ships with three flags for different situations."
-
-**[TYPE and explain each:]**
-
-```bash
-/devil-mode               # Default: 4 agents (secret, supply-chain, backdoor, prompt-injection)
-/devil-mode --pre-public  # Before going open source: adds license + code-stealer
-/devil-mode --pre-launch  # Before production launch: adds jailbreak-tester + chaos-engineer
-/devil-mode --all         # All 8 agents simultaneously
-```
-
-**NARRATION:**
-> "I recommend --pre-public every time you plan to open-source something. Non-negotiable."
-> "--all for post-incident sweeps or high-stakes launches."
-
----
-
-### [8:30–9:30] INDIVIDUAL AGENTS
-
-**[SCREEN: Claude Code]**
-
-**NARRATION:**
-> "You can also call individual agents if you only need one angle."
-
-**[TYPE:]**
-```
-use secret-hunter
-```
-
-**[Show it running]**
-
-**NARRATION:**
-> "Same agent, just one of them."
-> "Useful when you added a new feature and only need the prompt injection sweep."
-
----
-
-### [9:30–10:00] HOW IT'S DIFFERENT FROM A LINTER
-
-**NARRATION:**
-> "A question I get: how is this different from running a security linter?"
-
-**[SCREEN: Split — linter output vs devil-mode output]**
-
-**NARRATION:**
-> "Linters catch syntax-level issues. SQL injection patterns. Known unsafe API calls. Static analysis."
-> "Devil mode catches semantic issues. Why is this code making an outbound call? Why does this install script exist? Is this base64 innocent or suspicious? What happens to this system under adversarial conditions?"
-> "Different tool. Different attack surface. You want both."
-
----
-
-### [10:00–10:30] CTA
-
-**NARRATION:**
-> "If you're shipping software and you haven't run something like this — run it today."
-
-**[TYPE:]**
-```bash
-npx kodelyth-ecc
-```
-
-**[Then in chat:]**
-```
-/devil-mode --pre-public
-```
-
-**NARRATION:**
-> "github.com/sifxprime/kodelyth-ecc — zero telemetry, everything local, MIT license."
-> "Next video: the MCP server — how to give LangGraph, AutoGen, or Claude Desktop access to all 70 agents and local memory. In one command."
-
-**[END CARD]**
-
----
-
-## B-ROLL / EDITING NOTES
-
-- **USE A REAL PROJECT** — the credibility of this video depends on real findings, not demo setups
-- If you don't want to show your own project, create a realistic sample project with planted issues
-- Plant: one expired/rotated key in git history, one dep with install script, one GPL dep
-- Record the `/devil-mode` run uncut — the waiting time builds tension and authenticity
-- Show the `git log -p | grep` command for the secret finding
-- Show BFG Repo Cleaner remediation or `git filter-branch` command
-- Diagram for "attacker mindset vs author mindset" — 30-second simple animation
-- Thumbnail: red background + "I ran 8 attackers on my own code" + devil emoji or adversarial icon
-- This video will get shared in security communities — keep it technically precise

package/videos/video-04-mcp-server.md

@@ -1,391 +0,0 @@
-# VIDEO 4 — "MCP Server: Give LangGraph access to 70 agents in one command"
-
-**Duration:** 10–12 minutes  
-**Platform:** YouTube (AI/ML engineers, agent framework builders, Claude Desktop users)  
-**Hook:** Live wiring of ECC MCP into Claude Desktop + LangGraph  
-**Goal:** Drive adoption from the agentic AI engineering community  
-**Screen setup:** Terminal + code editor + browser (Claude Desktop or LangGraph notebook)
-
----
-
-## FULL SCRIPT
-
----
-
-### [0:00–0:20] COLD OPEN
-
-**[SCREEN: Claude Desktop — chat open, typing]**
-
-**[TYPE in Claude Desktop:]**
-```
-route this task for me: our checkout flow is broken in production
-```
-
-**[Show response from ECC MCP route_intent tool:]**
-```json
-{
-  "suggestions": [
-    { "agent": "incident-commander", "score": 0.94, "reason": "production + broken = P0 pattern" },
-    { "agent": "debug-detective",    "score": 0.81, "reason": "checkout flow + broken = active bug" },
-    { "agent": "silent-failure-hunter", "score": 0.62, "reason": "checkout failures often have no error" }
-  ]
-}
-```
-
-**NARRATION:**
-> "That's Claude Desktop calling an ECC tool to route a task to the right specialist."
-> "No plugins. No cloud. Just one command on your machine and MCP handles the rest."
-
-**[TITLE CARD: Kodelyth ECC MCP Server — Universal Adapter]**
-
----
-
-### [0:20–1:30] WHAT IS MCP AND WHY IT MATTERS
-
-**[SCREEN: Simple diagram — MCP architecture]**
-
-**NARRATION:**
-> "Model Context Protocol is Anthropic's open standard for connecting AI applications to external tools and data."
-> "Think of it like USB-C for AI. Any MCP client can plug into any MCP server."
-
-**[Draw: Claude Desktop → MCP → ECC server]**
-**[Draw: LangGraph → MCP → ECC server]**
-**[Draw: AutoGen → MCP → ECC server]**
-
-**NARRATION:**
-> "ECC v1.7.0 ships a full MCP server. One command starts it."
-> "Any framework that speaks MCP now has access to 70 agents, 194 skills, 97 commands, and your local memory store."
-
----
-
-### [1:30–2:30] WHAT THE SERVER EXPOSES
-
-**[SCREEN: Diagram — three columns: Tools / Prompts / Resources]**
-
-**NARRATION:**
-> "The ECC MCP server exposes three categories of content."
-
-**[COLUMN 1: TOOLS (16)]**
-
-**NARRATION:**
-> "16 tools. These are callable functions your AI can invoke."
-
-**[Show each with one line:]**
-```
-route_intent        → suggest the right ECC agent for a message
-list_agents         → catalog of all 70 agents
-list_skills         → catalog of all 194 skills
-get_agent           → full markdown body of any agent
-get_skill           → full markdown body of any skill
-get_command         → full slash command body
-recall_memory       → BM25 search of your local memory
-capture_memory      → store a new memory entry
-memory_stats        → stats on your memory store
-catalog_stats       → counts of agents/skills/commands
-audit_skill_match   → which skills are relevant to a task
-```
-
----
-
-**[COLUMN 2: PROMPTS (6)]**
-
-**NARRATION:**
-> "6 prompts. Canonical ECC context blocks you can summon by name."
-
-```
-routing-rule      → the full 10-tier intent routing system
-agents-overview   → all 70 agents, one-line each
-skills-overview   → all 194 skills compact
-handoff-chains    → standard multi-agent chain protocols
-devil-mode        → the adversarial parallel sweep command
-commands-overview → all 97 slash commands
-```
-
----
-
-**[COLUMN 3: RESOURCES (377)]**
-
-**NARRATION:**
-> "377 resources. Every agent, skill, command, rule, and bundle is addressable as a kodelyth:// URI."
-
-```
-kodelyth://agents/debug-detective
-kodelyth://skills/kodelyth-memory
-kodelyth://commands/devil-mode
-kodelyth://rules/agent-intent-routing
-kodelyth://bundles/indie-hacker
-```
-
-**NARRATION:**
-> "Any MCP client can do `resources/list` to discover everything, then `resources/read` to fetch any of it as markdown."
-
----
-
-### [2:30–4:00] DEMO 1 — CLAUDE DESKTOP IN 30 SECONDS
-
-**[SCREEN: macOS → finder → ~/Library/Application Support/Claude/]**
-
-**NARRATION:**
-> "Let's wire it into Claude Desktop. 30 seconds."
-
-**[SCREEN: Open claude_desktop_config.json]**
-
-**[TYPE the config:]**
-```json
-{
-  "mcpServers": {
-    "kodelyth-ecc": {
-      "command": "npx",
-      "args": ["-y", "kodelyth-ecc", "mcp"]
-    }
-  }
-}
-```
-
-**NARRATION:**
-> "Save. Restart Claude Desktop."
-
-**[Restart Claude Desktop — show the server appearing in the tools panel]**
-
-**NARRATION:**
-> "ECC is now available. Claude Desktop can call all 16 tools, use all 6 prompts, and read all 377 resources."
-
-**[DEMO in Claude Desktop:]**
-
-**[TYPE:]**
-```
-Use the routing-rule prompt, then route this: 
-"I've been debugging this race condition for 3 days, nothing works"
-```
-
-**[Show: ECC routing-rule prompt loaded → route_intent called → response suggests /debug-blitz]**
-
-**NARRATION:**
-> "Claude used the ECC routing rule — the full 10-tier system — to decide that 3 days of frustration on a race condition means debug-blitz, not a single debug-detective."
-
----
-
-**[DEMO 2 in Claude Desktop — get agent body:]**
-
-**[TYPE:]**
-```
-Get me the full debug-detective agent instructions
-```
-
-**[Show: get_agent tool called → full debug-detective.md loaded → Claude adopts the persona]**
-
-**NARRATION:**
-> "Claude fetched the full agent playbook on demand. Now it's running as debug-detective — with the real methodology, not a made-up persona."
-
----
-
-### [4:00–6:30] DEMO 2 — LANGGRAPH INTEGRATION
-
-**[SCREEN: VS Code with a Python file open]**
-
-**NARRATION:**
-> "Now let's wire it into LangGraph. This is for developers building multi-agent workflows in Python."
-
-**[SCREEN: Show minimal LangGraph code with MCP client]**
-
-```python
-from langchain_mcp import MCPToolkit
-from langchain_anthropic import ChatAnthropic
-from langgraph.prebuilt import create_react_agent
-
-# Connect to ECC MCP server
-async with MCPToolkit("npx kodelyth-ecc mcp") as toolkit:
-    tools = await toolkit.get_tools()
-    
-    llm = ChatAnthropic(model="claude-sonnet-4-5")
-    agent = create_react_agent(llm, tools)
-    
-    # Now the agent can call any ECC tool
-    result = await agent.ainvoke({
-        "messages": [
-            {"role": "user", "content": "Route this task and get me the right agent's instructions: our API is throwing 500s"}
-        ]
-    })
-```
-
-**NARRATION:**
-> "The ECC server spawns as a subprocess. LangGraph connects via stdio. The agent now has all 16 ECC tools in its tool belt."
-
-**[RUN the script — show output:]**
-
-```
-> Calling tool: route_intent
-  input: "our API is throwing 500s"
-  
-> Result: incident-commander (score 0.91), debug-detective (0.78)
-
-> Calling tool: get_agent
-  input: "incident-commander"
-
-> Loaded: incident-commander.md (7920 bytes)
-
-[Agent now follows incident-commander playbook...]
-```
-
-**NARRATION:**
-> "The orchestrator called route_intent, got a recommendation, fetched the full agent body, and is now executing the incident-commander playbook."
-> "Your LangGraph workflow just got 70 specialists."
-
----
-
-**[MEMORY ROUNDTRIP]**
-
-**NARRATION:**
-> "The memory tools are the most valuable part for long-running workflows."
-
-```python
-# Store a solution during a session
-await agent.ainvoke({
-    "messages": [{
-        "role": "user",
-        "content": "capture_memory: problem=API rate limiting, approach=exponential backoff with jitter, tags=[api, rate-limiting, retry]"
-    }]
-})
-
-# Recall it later, in any workflow
-result = await agent.ainvoke({
-    "messages": [{
-        "role": "user", 
-        "content": "I'm building retry logic for an API client. recall_memory first."
-    }]
-})
-```
-
-**NARRATION:**
-> "Your LangGraph workflow can now persist solutions to your local BM25 memory and recall them on future runs."
-> "The memory survives process restarts. It's a JSONL file. Your agent learns across runs."
-
----
-
-### [6:30–8:00] DEMO 3 — CLI INSPECTION TOOLS
-
-**[SCREEN: Terminal]**
-
-**NARRATION:**
-> "You don't have to write code to explore the server. ECC ships CLI commands for everything."
-
-```bash
-# Register a server
-npx kodelyth-ecc mcp-add kodelyth -- npx kodelyth-ecc mcp
-
-# List registered servers
-npx kodelyth-ecc mcp-list
-
-# See all 16 tools
-npx kodelyth-ecc mcp-tools kodelyth
-
-# Call a tool directly
-npx kodelyth-ecc mcp-call kodelyth route_intent \
-  --json '{"message":"production is down","top_k":3}'
-
-# List resources
-npx kodelyth-ecc mcp-resources kodelyth
-
-# Read a specific resource
-npx kodelyth-ecc mcp-call kodelyth get_agent \
-  --json '{"name":"debug-detective"}'
-```
-
-**NARRATION:**
-> "The mcp-call command is especially useful for testing integrations before you wire them into code."
-
-**[Show route_intent output formatted with jq:]**
-
-```bash
-npx kodelyth-ecc mcp-call kodelyth route_intent \
-  --json '{"message":"I need to refactor my auth module"}' \
-  | jq '.content[0].text | fromjson | .suggestions[:3]'
-```
-
----
-
-### [8:00–9:30] DESIGN PRINCIPLES
-
-**[SCREEN: Diagram]**
-
-**NARRATION:**
-> "A few things I want to be explicit about in the design."
-
-**[PRINCIPLE 1: No LLM calls]**
-
-**NARRATION:**
-> "The ECC MCP server adds zero LLM calls of its own. It reads files and passes through memory. Your client's model decides what to do with the content. No hidden API costs."
-
-**[PRINCIPLE 2: Local only]**
-
-**NARRATION:**
-> "stdio transport. No network port. No HTTP server. The MCP server is a subprocess — it dies when your client disconnects. No background process lingering."
-
-**[PRINCIPLE 3: Optional dependency]**
-
-**NARRATION:**
-> "The MCP SDK is in optionalDependencies. `npx kodelyth-ecc` installs without it. The MCP subcommand prints a helpful message if you try to use it without the SDK."
-
-```bash
-npx kodelyth-ecc mcp
-# → "Kodelyth MCP server requires @modelcontextprotocol/sdk"
-# → "Run: npm install @modelcontextprotocol/sdk"
-```
-
-**[PRINCIPLE 4: Cached catalog]**
-
-**NARRATION:**
-> "Agent and skill lists are cached in-process after first read. Sub-millisecond for subsequent calls. Heavy workflows that call list_agents repeatedly don't hit the filesystem every time."
-
----
-
-### [9:30–10:00] WHAT'S COMING
-
-**[SCREEN: Simple roadmap card]**
-
-**NARRATION:**
-> "The MCP server opens up a second direction: ECC as an MCP client."
-
-**[Show code snippet:]**
-```bash
-npx kodelyth-ecc mcp-add stripe -- npx -y @modelcontextprotocol/server-stripe
-npx kodelyth-ecc mcp-add github -- npx -y @modelcontextprotocol/server-github
-npx kodelyth-ecc mcp-add postgres -- npx -y @modelcontextprotocol/server-postgres
-```
-
-**NARRATION:**
-> "ECC agents will be able to consume external MCP servers — Stripe, GitHub, Postgres, Redis — making ECC the hub that routes between your specialists and your data sources."
-> "That's the agentic layer I'm building toward."
-
----
-
-### [10:00–10:30] CTA
-
-**NARRATION:**
-> "If you're building with LangGraph, AutoGen, CrewAI, or Claude Desktop — ECC's MCP server is a one-command addition to any workflow."
-
-**[SCREEN: Terminal]**
-
-```bash
-npx kodelyth-ecc mcp
-```
-
-**NARRATION:**
-> "github.com/sifxprime/kodelyth-ecc — full MCP docs at docs/mcp.md"
-> "If this was useful, subscribe — I'll be covering the ECC-as-MCP-client direction next."
-
-**[END CARD: subscribe, github link, docs link]**
-
----
-
-## B-ROLL / EDITING NOTES
-
-- Run the REAL MCP server — don't fake responses
-- Claude Desktop wiring must be recorded live — the UX of it connecting is persuasive
-- The LangGraph demo should be in a Jupyter notebook OR a clean Python file, not a cluttered repo
-- Show the actual tool call logs from LangGraph (the `> Calling tool:` lines)
-- For the CLI commands: use --color=always and record with terminal that shows nice colors
-- Diagram for MCP architecture: keep it simple — three boxes (Client → MCP → ECC)
-- This is the most technical video — don't cut corners on accuracy
-- Thumbnail: "npx kodelyth-ecc mcp" in terminal + "LangGraph ← 70 agents" graphic
-- Consider publishing a companion GitHub Gist with the LangGraph code snippet for the description