{
  "markdown": "# ARCANE World-Sense — MCP Trust Artifacts\n\nThis repository is the **verifiable public surface** of the ARCANE World-Sense MCP server:\n\n> `https://mcp.arcaneforecasting.com/mcp` — a no-auth, read-only, streamable-HTTP MCP\n> server that hands an agent structured, pre-published readings of ARCANE's current\n> geopolitical-risk picture.\n\nThe sensing engine that *computes* those readings stays private. What is published here is\nonly the surface a cautious consumer needs to audit one question:\n\n> *If I wire this MCP server into my agent, can it take actions, exfiltrate anything, or\n> prompt-inject my model?*\n\nThe short answer is no — and these files are the source you can check it against.\n\n## Audit, don't reuse\n\nThese are **trust artifacts**, published so you can read them — not a framework to fork.\nRead them, compare them against the live server's behavior, and decide for yourself. If you\nwant the data, call the MCP server; you do not need to run any of this code.\n\nStart with **[SECURITY.md](./SECURITY.md)** — it walks the safety argument end to end.\n\n## What ARCANE does — and does not — claim\n\nARCANE **NOTICES the present**. It reports what the world is doing right now, and how fresh\nand how sure each reading is. It does **not act, predict, or advise**, and it never tells\nyour agent what to do. Every payload carries an in-band `as_of` timestamp, a `stale` flag,\nand a fixed NOTICE-not-advice note; treat any absent field as \"not available,\" never as zero.\n\n## File map — what each file is, and what it proves\n\n| File | What it is | What it proves |\n|------|-----------|----------------|\n| [`worker.js`](./worker.js) | The entire Cloudflare Worker request path. | A **read-only facade**: every tool reads one `pub_*` value from a single public KV namespace and returns it verbatim — no code execution, no outbound fetch, no access to your systems. Also shows the **kill switch**, the **Cache-API-fronted read path**, and the **rate-limit posture**. |\n| [`wrangler.toml`](./wrangler.toml) | The Worker's deployment config. | The **binding structure**: the Worker binds **only** the public KV namespace, so it *physically cannot address* ARCANE's private data. Account and namespace identifiers are redacted to placeholders; no secret is present. |\n| [`snapshot_public.py`](./snapshot_public.py) | The projection layer that builds the public `pub_*` values. | The **allow-list projection** (only named fields are copied forward), the **fail-closed leak guard** (any forbidden field, phrase, or excluded source blocks the whole publish), and the **instruction-injection neutralizer** that scrubs third-party free text. |\n| [`snapshot_public_text.py`](./snapshot_public_text.py) | The capability statement and per-stream notes served in-band. | Exactly the human-readable copy the server hands back — what it serves, what it never serves, and each stream's validation caveats. |\n| [`SECURITY.md`](./SECURITY.md) | The security & safety writeup. | The full argument, plus what the server logs and how to verify the limits yourself. |\n| [`LICENSE`](./LICENSE) | MIT. | — |\n\n## Honest limits of this repo\n\nBe clear on what this repo does and does not let you verify:\n\n- **`worker.js` is the externally verifiable part.** It is the actual request path. Anyone\n  can hit the live endpoint and compare behavior against this source; there is no in-band\n  deployment fingerprint, but the code is short enough to read and diff against in full.\n- **`snapshot_public.py` documents intent, not the live request path.** It runs in ARCANE's\n  private *publishing pipeline*, **not** in the Worker you call. It shows you the discipline\n  with which public payloads are built — allow-list, leak guard, neutralizer — but you are\n  trusting that the deployed pipeline matches this source. We say so plainly rather than\n  overstate it.\n- **Deployed ≠ published.** In both cases you are trusting that the running system matches\n  this code. The surface is deliberately small so that trust is cheap to check.\n\n## More\n\n- Live project: **https://arcaneforecasting.com**\n- Found a concern — a field that shouldn't be served, a neutralizer bypass? Open an issue or\n  reach the maintainer via the site. Responsible disclosure appreciated.\n",
  "bytes": 4227,
  "sha": "ec5196f29feba75b7fa39fd3f28f1ef58dbc7775a49fb6ffb11e5a3f73981637",
  "repo_slug": "griffin-the-arcanist/arcane-world-sense-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_com_arcaneforecasting_world_sense_4e5be457/readme"
}