tokens-for-good 0.5.2 → 0.5.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +10 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -27,7 +27,7 @@ To change cadence later, run `npx tokens-for-good init` again.
|
|
|
27
27
|
|
|
28
28
|
Each org takes about 5 minutes:
|
|
29
29
|
|
|
30
|
-
1. **Research:** web search + 6-prompt methodology, then fill in a v3 EVIDENCE TABLE (8 rows of verbatim quotes + real URLs; blanks are honest when the evidence doesn't exist)
|
|
30
|
+
1. **Research:** web search + 6-prompt methodology, then fill in a v3 EVIDENCE TABLE (8 rows of verbatim quotes + real URLs; blanks are honest when the evidence doesn't exist, and a genuinely evidence-free org is submitted with `no_evidence: true` rather than invented rows)
|
|
31
31
|
2. **Verify:** every citation URL checked, hallucinations flagged and corrected
|
|
32
32
|
3. **Humanize:** voice pass (no em dashes, no AI-tells, analyst voice)
|
|
33
33
|
|
|
@@ -56,10 +56,18 @@ Once installed, these are available to your AI via the MCP server:
|
|
|
56
56
|
| `get_next_consolidation` | v3 consolidator: fetch your assignment + both source reports to merge |
|
|
57
57
|
| `set_role_preference` | Prefer the low-fetch roles (validation/consolidation); best for local models |
|
|
58
58
|
| `create_agent` / `list_agents` / `rotate_agent_key` / `revoke_agent` | Run several harnesses at once: each agent gets its own key + research slot |
|
|
59
|
-
| `setup_automation` | Emits `/schedule` prompt (normally called by `/tfg-schedule` skill) |
|
|
59
|
+
| `setup_automation` | Emits the self-contained `/schedule` prompt with the full methodology embedded (normally called by `/tfg-schedule` skill) |
|
|
60
60
|
| `my_impact` / `research_status` | Your stats + the project leaderboard |
|
|
61
61
|
| `snooze` | Quiet the session-start prompt for N days |
|
|
62
62
|
|
|
63
|
+
## Security model
|
|
64
|
+
|
|
65
|
+
Scheduled routines are **self-contained**: the full research methodology is embedded in the routine prompt when you set it up, so its instructions are frozen at install time — nothing remote can change what your standing agent does. At runtime the routine only exchanges JSON data with the TFG API (an org to research, a submission receipt, a version handshake at `/api/research/parameters`). Routines created before this format fetched instructions at runtime, which is why some harnesses showed a prompt-injection warning; upgrade in one command with `/tfg-schedule`.
|
|
66
|
+
|
|
67
|
+
Server-side, every report passes deterministic citation verification (each EVIDENCE TABLE quote must appear on its cited page), an independent validator, and dual-research consolidation before scoring — and the scorer is code, never the model that wrote the report. API keys are SHA-256 hashed at rest and sent only via header.
|
|
68
|
+
|
|
69
|
+
Have an idea to make TFG more secure or trustworthy? [Open an issue](https://github.com/Tokens-for-Good/tokens-for-good/issues/new/choose). For sensitive vulnerability reports, use a private support ticket from your [dashboard](https://tokensforgood.ai/support) instead of a public issue.
|
|
70
|
+
|
|
63
71
|
## Non-Claude-Code platforms
|
|
64
72
|
|
|
65
73
|
- **OpenCode:** `init` writes `~/.config/opencode/opencode.json` and prints a cron line you can paste into `crontab -e`.
|