Sponsored by Deepsite.site

Tag

#work

440 results found

PQC Khepra MCP Server: Agentic Security Attestation Framework

KHEPRA MCP Server smithery badge MCP Registry License Container PQC Sovereign compliance engine with 36,195 STIG/CCI/NIST/CMMC mappings. Air-gappable. Zero token costs. Run ert_scan → get a Godfather Report with dollar-denominated business impact. The only MCP compliance server that runs on your metal — with the World's First DoD PQC STIG built in. PQC-01-STIG-V1R1 — Full Whitepaper → 17 controls covering CNSA 2.0, FIPS 203/204/205, and the NSA's May 2026 MCP security advisory. The world's first DoD-style Post-Quantum Cryptography STIG, including the first PQC controls for agentic AI and MCP deployments. Tiers Tier License Key Tools Telemetry Egress Community ❌ Not required pqc_stig + 12 core tools Opt-in Dark Crypto Intel Zero (sovereign mode) Sovereign ✅ Required All 34 tools Zero Zero Pharaoh ✅ Required All 34 tools + priority support Zero Zero Community tier is free. Run pqc_stig to assess your project's quantum readiness against PQC-01-STIG-V1R1 — the World's First DoD-style Post-Quantum Cryptography STIG — no license key needed. What It Does KHEPRA MCP connects your AI assistant directly to a hardened compliance engine. Ask Claude or any MCP client to scan a system, map findings to STIG/NIST/CMMC controls, and generate an executive-ready risk report — all without sending data to external APIs. Key capabilities: 36,195 STIG/CCI/NIST 800-53/800-171/CMMC mappings (offline, bundled) Post-quantum cryptographic attestation on every tool call (ML-DSA-65 / FIPS 204) World's First DoD PQC STIG — 17 controls covering CNSA 2.0 / FIPS 203/204/205 + agentic AI / MCP (PQC-01-STIG-V1R1) Godfather Report: dollar-denominated business impact per finding (FAIR model) Air-gap and SCIF compatible — sovereign/ironbank modes make zero egress calls Flat annual licensing — no per-token or per-query charges Runs on your metal: on-prem, DoD, IC, classified environments Installation There are two delivery methods: Docker (recommended, no build required) and compiled binary (fastest startup, required for air-gap). Both support the same environment variables and all MCP clients. Choose your path: Method Best For Startup Docker Most users, easiest setup ~2s Compiled Binary Air-gap, SCIF, performance ~300ms Option A: Docker (Recommended) Requires Docker Desktop or Docker Engine. The image is pre-built and ships the full compliance database — no additional downloads in sovereign mode. # Pull once docker pull ghcr.io/nouchix/pqc-khepra-mcp:latest # Test it (should print the initialize response and exit) echo '{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}},"id":0}' \ | docker run --rm -i -e KHEPRA_MODE=sovereign ghcr.io/nouchix/pqc-khepra-mcp:latest Option B: Compiled Binary Requires Go 1.21+ for building, or download a pre-built release from GitHub Releases. git clone https://github.com/nouchix/PQC-Khepra-MCP.git cd PQC-Khepra-MCP # Build (cross-compile for your OS) go build -o khepra-mcp ./cmd/khepra-mcp # Linux / macOS go build -o khepra-mcp.exe ./cmd/khepra-mcp # Windows # Test the binary echo '{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}},"id":0}' \ | KHEPRA_MODE=sovereign ./khepra-mcp Windows — using the batch launcher The repo ships a run-mcp.bat launcher for Windows. It uses the pre-built binary (fast path) and falls back to go run automatically: :: run-mcp.bat is already in the repo at the root of PQC-Khepra-MCP :: Point your MCP client to: cmd /c C:\path\to\PQC-Khepra-MCP\run-mcp.bat Adding to Your AI Client Claude Desktop Config file location: macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json Linux: ~/.config/Claude/claude_desktop_config.json Community tier — Docker (macOS / Linux) { "mcpServers": { "khepra": { "command": "docker", "args": [ "run", "--rm", "-i", "-e", "KHEPRA_MODE=sovereign", "-v", "/var/lib/khepra:/var/lib/khepra", "ghcr.io/nouchix/pqc-khepra-mcp:latest" ] } } } Community tier — Docker (Windows) { "mcpServers": { "khepra": { "command": "docker", "args": [ "run", "--rm", "-i", "-e", "KHEPRA_MODE=sovereign", "-v", "C:\\Users\\YourName\\.khepra:/var/lib/khepra", "ghcr.io/nouchix/pqc-khepra-mcp:latest" ] } } } Community tier — Binary (Windows, fastest startup) { "mcpServers": { "khepra": { "command": "C:\\path\\to\\PQC-Khepra-MCP\\khepra-mcp.exe", "args": [], "env": { "KHEPRA_MODE": "sovereign", "KHEPRA_NETWORK_POLICY": "lan", "MCP_PQC_ENABLED": "true", "KHEPRA_MANIFEST_PATH": "C:\\path\\to\\PQC-Khepra-MCP\\manifest.json" } } } } Community tier — Binary via batch launcher (Windows) { "mcpServers": { "khepra": { "command": "cmd", "args": ["/c", "C:\\path\\to\\PQC-Khepra-MCP\\run-mcp.bat"], "env": { "KHEPRA_MODE": "sovereign", "KHEPRA_NETWORK_POLICY": "lan", "MCP_PQC_ENABLED": "true" } } } } Sovereign / Pharaoh tier (with license key) { "mcpServers": { "khepra": { "command": "docker", "args": [ "run", "--rm", "-i", "-e", "KHEPRA_LICENSE_KEY", "-e", "KHEPRA_MODE=sovereign", "-v", "/var/lib/khepra:/var/lib/khepra", "-v", "/var/log/khepra:/var/log/khepra", "ghcr.io/nouchix/pqc-khepra-mcp:latest" ], "env": { "KHEPRA_LICENSE_KEY": "YOUR_LICENSE_KEY_HERE" } } } } After editing, restart Claude Desktop. Verify in Settings → Developer — you should see khepra with status running and all tools listed. Cursor Config file: .cursor/mcp.json in your project root, or ~/.cursor/mcp.json globally. Docker (macOS / Linux) { "servers": { "khepra": { "type": "stdio", "command": "docker", "args": [ "run", "--rm", "-i", "-e", "KHEPRA_MODE=sovereign", "-v", "/var/lib/khepra:/var/lib/khepra", "ghcr.io/nouchix/pqc-khepra-mcp:latest" ] } } } Binary (macOS / Linux) { "servers": { "khepra": { "type": "stdio", "command": "/path/to/khepra-mcp", "args": [], "env": { "KHEPRA_MODE": "sovereign", "KHEPRA_MANIFEST_PATH": "/path/to/PQC-Khepra-MCP/manifest.json" } } } } Binary (Windows) { "servers": { "khepra": { "type": "stdio", "command": "C:\\path\\to\\PQC-Khepra-MCP\\khepra-mcp.exe", "args": [], "env": { "KHEPRA_MODE": "sovereign", "KHEPRA_MANIFEST_PATH": "C:\\path\\to\\PQC-Khepra-MCP\\manifest.json" } } } } VS Code (with GitHub Copilot or Cline extension) Config file: .vscode/mcp.json in your project, or user settings. { "servers": { "khepra": { "type": "stdio", "command": "docker", "args": [ "run", "--rm", "-i", "-e", "KHEPRA_MODE=sovereign", "-v", "${env:HOME}/.khepra:/var/lib/khepra", "ghcr.io/nouchix/pqc-khepra-mcp:latest" ] } } } Or via user settings.json for the Cline extension: { "cline.mcpServers": { "khepra": { "command": "docker", "args": [ "run", "--rm", "-i", "-e", "KHEPRA_MODE=sovereign", "ghcr.io/nouchix/pqc-khepra-mcp:latest" ] } } } Windsurf Config file: ~/.codeium/windsurf/mcp_config.json { "mcpServers": { "khepra": { "command": "docker", "args": [ "run", "--rm", "-i", "-e", "KHEPRA_MODE=sovereign", "-v", "/var/lib/khepra:/var/lib/khepra", "ghcr.io/nouchix/pqc-khepra-mcp:latest" ] } } } Continue.dev Config file: ~/.continue/config.json — add to the experimental.modelContextProtocolServers array: { "experimental": { "modelContextProtocolServers": [ { "name": "khepra", "transport": { "type": "stdio", "command": "docker", "args": [ "run", "--rm", "-i", "-e", "KHEPRA_MODE=sovereign", "ghcr.io/nouchix/pqc-khepra-mcp:latest" ] } } ] } } Cloud / SaaS AI Tools (Claude.ai, ChatGPT, Gemini, etc.) Cloud-based AI tools cannot directly spawn local subprocesses — they need an HTTP/SSE bridge to reach your local KHEPRA server. There are two approaches: Approach 1 — mcp-remote proxy (easiest, no server required) mcp-remote tunnels a local stdio MCP server over HTTPS, making it accessible to any cloud tool. This is what the Kaggle MCP entry in the config above uses. # Install once npm install -g mcp-remote # Start the bridge (exposes your local KHEPRA server at https://localhost:3000) KHEPRA_MODE=sovereign mcp-remote \ --server "docker run --rm -i -e KHEPRA_MODE=sovereign ghcr.io/nouchix/pqc-khepra-mcp:latest" \ --port 3000 Then in Claude.ai (or any cloud tool that accepts MCP SSE URLs): MCP Server URL: http://localhost:3000/sse Security note: mcp-remote binds to localhost by default. Do not expose it to the public internet without TLS and authentication. In sovereign/ironbank mode, KHEPRA itself makes zero egress calls — only the bridge connection to the cloud tool carries data. Approach 2 — Self-hosted HTTP/SSE endpoint For teams running KHEPRA on a shared server (e.g., Hostinger VPS at IP_ADDRESS), start the server in HTTP mode: # On your server — start KHEPRA in HTTP/SSE mode docker run -d \ -e KHEPRA_MODE=hybrid \ -e KHEPRA_HTTP_PORT=8443 \ -e KHEPRA_LICENSE_KEY="${KHEPRA_LICENSE_KEY}" \ -p 8443:8443 \ ghcr.io/nouchix/pqc-khepra-mcp:latest # Point your cloud tool to: # https://your-server.com:8443/sse Then configure any cloud AI tool that supports MCP SSE: Cloud Tool Where to add MCP URL Claude.ai (Pro/Team) Settings → Integrations → MCP Servers OpenAI Assistants API tools field with type: "mcp" Gemini for Workspace Extensions → Custom MCP (preview) Glama.ai Workspace → MCP Servers Smithery.ai Catalog → Self-hosted server Note: HTTP/SSE mode (hybrid/edge) enables external connections. Always terminate TLS at a reverse proxy (nginx/Caddy) and restrict access by IP or API key. The sovereign mode refuses HTTP connections by design — air-gap integrity is preserved. Approach 3 — Smithery / MCP Registry (Community tier only) KHEPRA is listed on Smithery.ai and the MCP Registry. Cloud tools that support registry-based discovery can install it directly: Registry ID: io.github.nouchix/pqc-khepra-mcp This runs the Community tier via Smithery's managed infrastructure. For sovereign deployment (air-gap, your data stays on your metal), use Options A or B above. Validation — Test Your Installation Run this from your terminal to verify the server responds correctly: # Docker echo '{"jsonrpc":"2.0","method":"tools/list","params":{},"id":1}' \ | docker run --rm -i -e KHEPRA_MODE=sovereign ghcr.io/nouchix/pqc-khepra-mcp:latest # Binary (Linux / macOS) echo '{"jsonrpc":"2.0","method":"tools/list","params":{},"id":1}' \ | KHEPRA_MODE=sovereign ./khepra-mcp # Binary (Windows PowerShell) '{"jsonrpc":"2.0","method":"tools/list","params":{},"id":1}' \ | & ".\khepra-mcp.exe" Expected output: a JSON-RPC response listing all available tools. If you see "tools": [...] with 12+ entries — you're connected. Full protocol validation (Windows) # Runs the complete Claude Desktop handshake sequence and validates all responses .\scripts\test-mcp-handshake.ps1 -BinaryPath ".\khepra-mcp.exe" # Expected output: # [PASS] initialize | protocolVersion=2025-11-25 | listChanged=False # [PASS] tools/list | count=34 # TRL-10 READY - Server passes full Claude Desktop protocol validation MCP Tools Community Tier (Free — No License Key) pqc_stig — World's First DoD PQC STIG ⭐ Assesses a source code directory against PQC-01-STIG-V1R1: 12 controls covering CNSA 2.0 algorithm approval, ML-DSA-65 key strength, ML-KEM-768 encapsulation, hybrid cryptography, key storage, constant-time implementation, and certificate chain requirements. pqc_stig(scan_path?: string, profile?: "quick" | "full" | "executive") Example: "Run pqc_stig on my project and tell me if I'm CNSA 2.0 compliant" nist_map Map CCI identifiers or STIG findings to NIST 800-53 Rev 5 controls. khepra_query_stig Query the 36,195-row STIG/CCI/NIST/CMMC compliance database by control ID. dark_crypto_contribute (opt-in) Contribute anonymized cryptographic algorithm telemetry to the SouHimBou AI Dark Crypto Intelligence Network. No PII. Opt-in only — never fires without explicit invocation. Sovereign / Pharaoh Tier ert_scan Enterprise Risk & Threat scan across STIG, NIST 800-53, NIST 800-171, CMMC, and FedRAMP. Returns Godfather Report with dollar-denominated business impact. ert_scan(target: string, frameworks?: string[], output_format?: "godfather" | "json" | "csv") Example: "Run ert_scan on /etc and generate a Godfather Report" stig_check Automated RHEL-09-STIG-V1R3 compliance scan against a live system or configuration path. cmmc_assess Full CMMC Level 1, 2, or 3 assessment with gap analysis and POA&M generation. godfather_report Generate an executive Godfather Report from prior scan results: top 10 findings ranked by dollar exposure, remediation ROI, and FAIR model business impact. + 20 additional tools agent_record, dag_attestation, flight_export, khepra_get_dag_chain, nhi_inventory, acp_status, owasp_agent_assess, khepra_export_attestation, khepra_export_poam, khepra_get_compliance_score, ert_crypto, ert_readiness, stig_benchmark, ir_analysis, vuln_hunter, sbom_generate, threat_model, khepra_query_threat_intel, discover_assets, and more. The Godfather Report Unlike compliance scanners that output a wall of CVEs, KHEPRA translates findings into the language executives care about: Finding: RHEL-09-212030 — No FIPS-validated crypto on /etc/ssh Severity: CAT I (HIGH) Business Impact: $2.4M estimated breach exposure (FAIR model) Remediation Cost: $800 (4 hours engineer time) ROI: 3,000x Every finding includes control ID, framework mapping, business impact in dollars, remediation cost estimate, and ROI. Deployment Modes Mode Air-Gap Egress Telemetry Use Case sovereign ✅ Yes Zero Zero On-prem, SCIF, classified (DEFAULT) ironbank ✅ Yes Zero Zero DoD/IC production, FIPS-only hybrid ❌ No LAN Zero Edge + cloud coordination edge ❌ No Unrestricted Zero Fully stateless SaaS Set via KHEPRA_MODE environment variable. Unknown values are rejected at startup and fall back to sovereign (fail-closed). Environment Variables Variable Required Default Description KHEPRA_LICENSE_KEY Sovereign/Pharaoh only — License key. Community tier runs without one. Get at nouchix.com KHEPRA_MODE No sovereign Deployment mode: sovereign, ironbank, hybrid, edge KHEPRA_MANIFEST_PATH No manifest.json Path to signed tool manifest file KHEPRA_HOME No /var/lib/khepra Data and compliance DB directory KHEPRA_LOG_DIR No /var/log/khepra Log directory KHEPRA_DAG_PATH No ~/.khepra/dag DAG audit chain storage path KHEPRA_AUDIT_LOG_PATH No ~/.khepra/audit.ndjson Signed audit log path KHEPRA_MAX_CONCURRENT No 5 Max concurrent tool calls per agent KHEPRA_NETWORK_POLICY No lan Network scope: lan, none, unrestricted MCP_PQC_ENABLED No true Enable ML-DSA-65 PQC attestation on all responses Air-Gap & SCIF Deployment KHEPRA makes zero external network calls in sovereign and ironbank modes: License validated offline via ML-DSA-65 signed license.adinkhepra file Compliance databases (36,195 mappings) bundled in container — no external downloads No telemetry, no heartbeat, no egress — verified at the transport layer # Transfer image to air-gapped network docker save ghcr.io/nouchix/pqc-khepra-mcp:latest | gzip > khepra-mcp.tar.gz # On air-gapped host: docker load < khepra-mcp.tar.gz Note on telemetry: The dark_crypto_contribute tool (Community tier) sends anonymized cryptographic algorithm telemetry to the SouHimBou AI intelligence network only when explicitly invoked by the user. It is never triggered automatically. In sovereign/ironbank mode, all network calls are blocked at the transport layer regardless. Compliance Coverage Framework Version Mappings STIG (RHEL 9) V1R3 Automated scanning NIST 800-53 Rev 5 2,120 CCIs NIST 800-171 Rev 2 320 controls CMMC Level 3 Full practice set FedRAMP High Baseline scanning PQC-01-STIG-V1R1 V1R1 17 PQC controls (CNSA 2.0) Total 36,195+ mappings Licensing Flat annual licensing — no per-token or per-query charges. Tier Cost License Key Tools Community Free Not required pqc_stig + 12 core tools Sovereign Annual flat fee Required All 34 tools, air-gap, on-prem Pharaoh Annual flat fee Required All 34 tools + priority support + SLA Community tier is permanently free — contribute to open-source PQC adoption Sovereign/Pharaoh: contact contact@nouchix.com or visit nouchix.com Security Reporting Vulnerabilities Do not open public issues for security vulnerabilities. Report privately via GitHub Security Advisories or email support@nouchix.com. SLA Target Acknowledgement 24 hours Initial assessment 5 business days Patch / mitigation (Critical) 30 days We accept encrypted reports via PGP (keys/security_contact.asc) and Post-Quantum channels (Dilithium / ML-DSA-65 keys in keys/). See SECURITY.md for the full disclosure policy and ASAF event taxonomy. Security Posture Deploying advanced post-quantum cryptography, air-gapped isolation, and comprehensive STIG mappings — built in direct alignment with NSA & ASD Model Context Protocol guidelines. NSA & ASD MCP Security Alignment The NSA and Australian Signals Directorate (ASD) have published specific threat vectors for AI systems interacting with local environments. KHEPRA MCP is explicitly designed to mitigate every identified vector: NSA/ASD Requirement KHEPRA Implementation Cryptographic validation of tool responses ML-DSA-65 (Dilithium) signatures on all JSON-RPC 2.0 payloads Input validation & sanitization Parameter injection resistance via strict JSON Schema validation Principle of least privilege credentials Short-lived ephemeral tokens tied to specific task execution windows Comprehensive audit logging Tamper-evident events compiled into an immutable DAG structure Resource consumption limits Rate limiting + backpressure for LLM request loops Authorization gates for sensitive actions Human-in-the-loop gate for destructive state changes Environment isolation Containerized execution with zero-egress sovereign mode Software supply chain integrity Manifest pinning for all loaded tools and dependencies Network exposure reduction Air-gappable — zero internet transit in sovereign/ironbank modes Post-quantum resilience PQC-signed DAG trail protecting against harvest-now-decrypt-later Compliance Certifications Framework Status Coverage CMMC Level 2 ✅ Automates evidence collection for AU, CM, SI, SC domains NIST SP 800-171 Rev 2 ✅ Logging, accountability, system integrity NIST SP 800-53 Rev 5 ✅ Continuous monitoring (AU-2, SI-4) FIPS 203 (ML-KEM) ✅ Key encapsulation for secure transit FIPS 204 (ML-DSA) ✅ Digital signatures for payload authentication NSM-10 PQC Mandate ✅ National Security Memorandum 10 compliance DFARS 252.204-7012 ✅ Immutable forensic trails for cyber incident reporting NSA MCP Security Guidelines ✅ Direct mapping to all published AI agent threat mitigations Live Deployment — Physical Edge Running continuously on constrained edge hardware since May 12, 2026 to prove efficiency in sovereign environments: Hardware: Raspberry Pi 2 · 1 GB RAM · 900 MHz ARM · Live Spectrum Router SCADA Pod: STM32U585 / QRB2210 · Modbus TCP · MQTT · Zephyr RTOS 3.4+ · Live Dilithium Signature Verification Controls active: 3 open ports secured · 12 STIG violations detected · 100% file integrity monitoring (AIDE) · 24/7 continuous operation Academic Validation Event Date Institution UAlbany AI Plus Symposium 2026 — "KHEPRA Protocol: Quantum-Resilient Agentic

Ghl Command

GoHighLevel MCP server for Claude. 212 tools across 43 modules, including the only programmatic GHL workflow builder (private API, reverse-engineered), funnel + page editor, form builder, pipeline builder, pre-deploy validator, multi-sub-account switching, bulk operations, and full account export. $97 one-time, lifetime updates. GHL Command gives Claude full programmatic control of GoHighLevel through 212 tools across 43 modules. Built for GoHighLevel agency operators who manage many client sub-accounts and want to onboard new clients in minutes instead of days. Exclusive capabilities (none of the free GHL MCPs have these): - Programmatic workflow builder. Create, edit, clone, publish, and validate complete GHL workflows from a single prompt. GHL's public API has no workflow write endpoints; this uses their internal API (the same one their UI calls). - Funnel + page editor and form builder (also private API). - Pipeline builder, goal event builder, full 57-native-trigger registry. - Pre-deploy validator that catches GHL's silent invalid-ID failure (a common workflow-breaking bug GHL never warns you about). - Multi-sub-account token registry. Switch between any client account mid-conversation; API keys swap automatically. - Bulk operations: tag, update, enroll, delete hundreds of contacts in one command. - Full account export and side-by-side location diff for audit or migration. Works with Claude Desktop App, Claude Code (terminal), and headless on a Linux server or droplet. $97 one-time, 3 machines, no subscription, lifetime updates. 30-day time-back guarantee: save 5+ hours on one real client build or full refund.

Spf Smart Gate rust binary mcp server with built in local tools. preconfigured

README.md--- license: apache-2.0 language: - en tags: - mcp-server - ai-gateway - security - rust - agent-framework - tool-enforcement - lmdb - rag - transformer - mesh-network - voice - android - termux - self-hosted - ai-safety - memory-system - flint - build-anchor - complexity-formula - agent-memory - p2p - quic - heed - self-learning - harness - ai-memory - persistent-memory - online-learning - agent-tools - tool-gateway - web-automation - browser-automation - social-media - p2p-communication - voice-synthesis - tts - embedded-database - zero-copy - code-search - filesystem - git - database pipeline_tag: text-generation --- ``` _____ _____ ______ _____ __ __ _____ _______ _____ _______ ______ / ____| __ \| ____| / ____| \/ | /\ | __ \__ __| / ____| /\|__ __| ____| | (___ | |__) | |__ | (___ | \ / | / \ | |__) | | | | | __ / \ | | | |__ \___ \| ___/| __| \___ \| |\/| | / /\ \ | _ / | | | | |_ | / /\ \ | | | __| ____) | | | | ____) | | | |/ ____ \| | \ \ | | | |__| |/ ____ \| | | |____ |_____/|_| |_| |_____/|_| |_/_/ \_\_| \_\ |_| \_____/_/ \_\_| |______| ``` # SPF Smart Gateway v3.0.0 **MCP Server Gateway with Multi-Layer Security Enforcement, Agent Memory, FLINT Transformer, Mesh Network, and 81 Gated Tools** > **NOTE: Full system upload still in progress.** Not all files are present yet. Repository is actively being populated — some modules may be missing until upload completes. Copyright (C) 2026 Joseph Stone — All Rights Reserved --- ## Quick Start ```bash # Clone into home folder git clone <repo-url> ~/SPFsmartGATE # Or for clones/SWARMagents: # ~/SWARMagents/1/SPFsmartGATE cd SPFsmartGATE cargo build --release # Copy optimized binary cp ~/SPFsmartGATE/target/release/spf-smart-gate ~/SPFsmartGATE/LIVE/BIN/spf-smart-gate # Configure MCP server filepath nano ~/SPFsmartGATE/LIVE/LMDB5/.mcp.json # Install Claude CLI in project directory # Use included configs, deny native Claude CLI tools # ~/SPFsmartGATE/LIVE/LMDB5/.claude.json # ~/SPFsmartGATE/LIVE/LMDB5/.claude/settings.json # Boot into flat-file agent runtime cd ~/SPFsmartGATE/LIVE/LMDB5 && claude # Boot into LMDB-backed agent runtime cd ~/SPFsmartGATE/LIVE/LMDB5.DB && claude ``` ### Route Other Models Through Claude CLI Adjust `~/SPFsmartGATE/LIVE/LMDB5/.claude/settings.local.json` with your model choice and API key. Uses OpenRouter for API and agent selection. Swap agents without changing sessions or losing project data. ### Build Notes - Cross-compiles on **Android** and **Linux** with minimal installation - Only rebuild on first boot or after system modifications - Binary: `~/SPFsmartGATE/LIVE/BIN/spf-smart-gate/spf-smart-gate` --- ## Overview SPF Smart Gateway is a **Rust-based MCP (Model Context Protocol) server** that acts as a security gateway for AI tool calls. Every file operation, bash command, brain query, and mesh call routes through compiled Rust enforcement logic. **No AI hallucination gets past the gate.** ### Web Agent Feature SPF agents can directly interact with the web and social media platforms through `spf_web_api` — a full HTTP client supporting GET, POST, PUT, DELETE, PATCH with custom headers and JSON body. Tested and working. **What agents can do:** - Post to X/Twitter, Facebook, Instagram, Reddit via their APIs - Reply to comments, send messages, manage accounts - Make authenticated API calls to any platform with stored API keys - Search, fetch, and download web content All web API calls pass through the 6-step gate pipeline with rate limiting (30-120 calls/min), content inspection, and full audit logging. Agents never touch the open web unmonitored. ### Why Heed + LMDB All persistent storage — config, agent state, brain vectors, session logs, gate training data — runs through **[heed](https://github.com/meilisearch/heed)**, a safe Rust wrapper over LMDB. This is what makes SPF extremely fast with a low memory footprint: - **Zero-copy reads** — heed maps LMDB pages directly into memory, no serialization overhead - **No server process** — LMDB is a memory-mapped B-tree library, not a database daemon - **ACID transactions** — single-writer, multi-reader with no lock contention on reads - **Sub-millisecond lookups** — B-tree index, not hash scanning - **Tiny footprint** — entire 138K+ memory store runs in-process with minimal RAM - **Phone-friendly** — designed for Android from day one; heed compiles cleanly on ARM64 Every tool call, brain search, and memory promotion goes through heed → LMDB. No network hops, no subprocess calls, no SQL parsing. The gate, brain, agent state, and FLINT training all share the same embedded database engine. Two agent runtimes: - **Flat files** — `LIVE/LMDB5/` (session state in markdown) - **LMDB database** — `LIVE/LMDB5.DB/` (session state in LMDB for persistence) Twin folder architecture: flat-file data uploaded via SPF CLI fs tools (user-only access). All agent tool calls are gated, validated, and audited. --- ## Architecture ``` ┌─────────────────────────────────────────────────────────────────┐ │ SPF Smart Gateway v3.0.0 │ │ 42 Rust modules │ ├─────────────────────────────────────────────────────────────────┤ │ MCP Server (JSON-RPC 2.0 over stdio) │ │ 81 tools │ tool alias map │ Qwen/LLM compatibility │ ├─────────────────────────────────────────────────────────────────┤ │ GATE (6-Step Pipeline) │ │ Step 0: Source logging │ │ Step 1: Rate limiting │ │ Step 2: Complexity calculation (SPF formula) │ │ Step 3: Validation (per-tool: paths, commands, Build Anchor) │ │ Step 4: Content inspection (credentials, injection) │ │ Step 5: Max mode escalation │ ├──────────┬──────────┬──────────┬──────────┬─────────────────────┤ │ FLINT │ Brain │ Mesh │ Voice │ Browser/RAG │ │ (encoder-│ (vectors │ (P2P QUIC│ (TTS/STT │ (reverse proxy │ │ decoder │ LMDB + │ Ed25519 │ espeak- │ search, fetch, │ │ ~5M │ MiniLM) │ iroh) │ ng FFI) │ RSS, web tools) │ │ params) │ │ │ │ │ ├──────────┴──────────┴──────────┴──────────┴─────────────────────┤ │ LMDB Storage Layer (heed) │ │ SPF_CONFIG │ TMP_DB │ AGENT_STATE │ Brain │ Gate Training │ │ All zero-copy reads via heed safe Rust bindings │ └─────────────────────────────────────────────────────────────────┘ ``` ### Module Inventory (42 modules) `paths`, `calculate`, `config`, `gate`, `inspect`, `mcp`, `session`, `storage`, `validate`, `web`, `http`, `dispatch`, `identity`, `mesh`, `fs`, `config_db`, `tmp_db`, `agent_state`, `tensor`, `tokenizer`, `framing`, `attention`, `ffn`, `encoder`, `decoder`, `transformer`, `checkpoint`, `gate_training`, `transformer_tools`, `train`, `learning`, `pipeline`, `worker`, `network`, `chat`, `voice`, `utf8_safe`, `brain_local`, `flint_memory`, `browser`, `orchestrator`, `channel` --- ## The SPF Formula ### Complexity Calculation ``` C = (basic ^ 1) + (dependencies ^ 7) + (complex ^ 10) + (files × 10) ``` ### Dynamic Analysis Allocation ``` a_optimal(C) = W_eff × (1 - 1/ln(C + e)) ``` Where `W_eff = 40,000` tokens and `e = Euler's number` ### Tier Allocation | Tier | C Range | Analyze | Build | Verify Passes | Approval | |------|---------|---------|-------|---------------|----------| | SIMPLE | < 500 | 40% | 60% | 1 | No | | LIGHT | < 2,000 | 60% | 40% | 1 | No | | MEDIUM | < 10,000 | 75% | 25% | 2 | No | | CRITICAL | > 10,000 | 95% | 5% | 3 | **Required** | ### Master Equation (Subtask Success) ``` P(success) = 1 - PRODUCT(1 - P_i) for i=1..D subtasks P_i = Q(a) × L(m) × V(v) × B(b) Q(a) = 1 - e^(-0.00004 × a) — Quality from analysis depth L(m) = 1 - 0.20^(m/2000) — Lookup from external memory V(v) = 1 - (1 - 0.75)^v — Verification accuracy B(b) = checks_done / checks_required — Build Anchor compliance ``` --- ## Security ### Gate Enforcement (6 Steps) Every tool call passes through `gate::process()` — compiled Rust, no runtime bypass. | Step | What | How | |------|------|-----| | 0 | Source logging | Identifies caller (Stdio, Transformer, Mesh, HTTP) | | 1 | Rate limiting | Per-tool limits (30–120 calls/min) | | 2 | Complexity calc | SPF formula → C value, tier, allocation | | 3 | Validation | Per-tool validator (paths, commands, anchors) | | 4 | Content inspection | Credential patterns, shell injection, path traversal | | 5 | Max mode | Escalation to CRITICAL tier on warnings | ### Build Anchor Protocol Files must be **read before they can be edited or overwritten**. Prevents AI hallucinations from blindly modifying files without understanding contents. - `Read` tracks files in `session.files_read` - `Edit` and `Write` check against this list - `Bash` write-class commands check target file reads - Violations: blocked (Max mode) or warned (Soft mode) ### Content Inspection Scans written/stored content for: - **Credential patterns**: API keys (sk-), AWS keys (AKIA), GitHub tokens (ghp_), Slack tokens, private keys, hardcoded passwords - **Shell injection**: Command substitution `$()`, backticks, eval/exec - **Path traversal**: `../` sequences - **Blocked path references**: Content mentioning system paths ### Blocked Paths Default blocked: `/tmp`, `/etc`, `/usr`, `/system`, `/data/data/com.termux/files/usr` ### Command Whitelist (Stage 0) Bash commands checked against sandbox and user-filesystem whitelists. Each command segment validated independently. Destructive commands (rm, chmod 777) blocked even if whitelisted. ### Default Deny Unknown tools blocked until explicitly added to the gate allowlist. --- ## MCP Tools (81 Total) ### Core Gate Tools | Tool | Description | |------|-------------| | `spf_calculate` | Calculate complexity score without executing. Returns C value, tier, allocation | | `spf_status` | Gateway status: session metrics, enforcement mode, complexity budget | | `spf_session` | Full session state: files read/written, action history, anchor ratio | ### Gated File Operations | Tool | Description | |------|-------------| | `Read` | Gated file read. Tracks for Build Anchor Protocol. Binary-safe | | `Write` | Gated file write. Validates Build Anchor, blocked paths, file size | | `Edit` | Gated file edit. Validates Build Anchor, blocked paths, change size | | `Bash` | Gated bash execution. Validates dangerous commands, /tmp access, git force | | `Glob` | Fast file pattern matching. Supports `**/*.rs`, `src/**/*.ts` | | `Grep` | Search file contents using regex. Built on ripgrep | ### Brain / Memory Tools | Tool | Description | |------|-------------| | `spf_brain_search` | Semantic vector search across collections (MiniLM-L6-v2, 384d) | | `spf_brain_recall` | Full document retrieval by semantic query | | `spf_brain_context` | Bounded context retrieval for prompt injection | | `spf_brain_store` | Store document in brain (FLINT-internal, source-gated) | | `spf_flint_store` | Agent memory store — bypasses brain write gate. Brain vectors + Working tier | | `spf_brain_index` | Index a file or directory into a brain collection | | `spf_brain_list` | List all indexed collections with document counts | | `spf_brain_status` | Brain system status: model state, storage size, collections | | `spf_brain_list_docs` | List stored documents in a collection | | `spf_brain_get_doc` | Retrieve a specific document by ID | ### Agent State Tools | Tool | Description | |------|-------------| | `spf_agent_stats` | AGENT_STATE LMDB statistics: memory count, sessions, state keys, tags | | `spf_agent_memory_search` | Search agent memories by content | | `spf_agent_memory_by_tag` | Get agent memories by tag | | `spf_agent_session_info` | Most recent session info | | `spf_agent_context` | Context summary for session continuity | ### FLINT Transformer Tools | Tool | Description | |------|-------------| | `spf_transformer_status` | FLINT transformer status: loaded, params, checkpoint, role | | `spf_transformer_infer` | Run inference: prompt → response. Returns generated tokens | | `spf_transformer_chat` | Multi-turn conversation with FLINT | | `spf_transformer_train` | Trigger manual training batch from accumulated gate signals | | `spf_transformer_metrics` | Learning metrics: loss, accuracy, gate alignment, training step | | `spf_flint_train_evil` | Mark a tool call as evil/harmful. Negative training signal | | `spf_flint_train_good` | Mark a tool call as good/safe. Positive training signal | | `spf_flint_execute` | Execute any SPF tool through FLINT worker mode (delegation) | ### Web Browser Tools **API tools (tested):** | Tool | Description | |------|-------------| | `spf_web_search` | Search the web (Brave API or DuckDuckGo) | | `spf_web_fetch` | Fetch URL and return clean readable text | | `spf_web_api` | Make HTTP API requests (GET/POST/PUT/DELETE/PATCH). Supports custom headers and JSON body — agents can directly interact with social media APIs (X/Twitter, Facebook, Instagram, Reddit, etc.) using stored API keys | | `spf_web_download` | Download a file from URL and save to disk | **Browser automation tools (in development — proxy starts, WebSocket bridge needs browser connection):** | Tool | Description | Status | |------|-------------|--------| | `spf_web_connect` | Initialize reverse proxy browser engine | Tested — works | | `spf_web_navigate` | Navigate browser to a URL (SSRF-validated) | Tested — works | | `spf_web_click` | Click a page element by CSS selector | In development — WebSocket timeout | | `spf_web_fill` | Type text into a form field by CSS selector | In development — WebSocket timeout | | `spf_web_select` | Query page elements by CSS selector | In development — WebSocket timeout | | `spf_web_eval` | Execute JavaScript on the current page | In development — WebSocket timeout | | `spf_web_screenshot` | Capture a screenshot of the current page | In development | | `spf_web_design` | Extract design brief: colours, fonts, spacing, components | In development | | `spf_web_page` | Structured page overview: title, headings, links, forms | In development | ### RAG Collector Tools | Tool | Description | |------|-------------| | `spf_rag_collect_web` | Search web and collect documents. Optional topic filter | | `spf_rag_collect_file` | Process a local file into brain | | `spf_rag_collect_folder` | Process all files in a folder | | `spf_rag_collect_drop` | Process files in DROP_HERE folder | | `spf_rag_index_gathered` | Index all documents in GATHERED to brain | | `spf_rag_dedupe` | Deduplicate a brain collection | | `spf_rag_status` | Collector status and stats | | `spf_rag_list_gathered` | List documents in GATHERED folder | | `spf_rag_bandwidth_status` | Bandwidth usage stats and limits | | `spf_rag_fetch_url` | Fetch a single URL with bandwidth limiting | | `spf_rag_collect_rss` | Collect from RSS/Atom feeds | | `spf_rag_list_feeds` | List configured RSS feeds | | `spf_rag_pending_searches` | Get pending SearchSeeker vectors (gaps needing fetch) | | `spf_rag_fulfill_search` | Mark a SearchSeeker as fulfilled after RAG fetch | | `spf_rag_smart_search` | Smart search with completeness check — triggers SearchSeeker if <80% | | `spf_rag_auto_fetch_gaps` | Automatically fetch data for all pending SearchSeekers | ### Mesh Network Tools | Tool | Description | |------|-------------| | `spf_mesh_status` | Mesh network status: role, team, identity | | `spf_mesh_peers` | List known/trusted mesh peers | | `spf_mesh_call` | Call a peer agent's tool via P2P mesh (Ed25519 authenticated) | ### Voice Tools | Tool | Description | |------|-------------| | `spf_voice_mode` | Voice pipeline control: start/stop audio, TTS (espeak-ng), mic capture | | `spf_voice_call` | Peer-to-peer voice calls: start, accept, reject, end, status | | `spf_voice_team` | Group voice channels: create, join, leave, add peers | ### Chat Tools | Tool | Description | |------|-------------| | `spf_chat_send` | Send text message to mesh peer via QUIC | | `spf_chat_history` | Chat message history (all conversations or specific) | | `spf_chat_rooms` | List active chat conversations with participant info | ### Network Pool Tools | Tool | Description | |------|-------------| | `spf_pool_status` | Pool status: worker roles, idle/busy counts, active tasks | | `spf_pool_assign` | Assign task to idle worker (NetAdmin only) | | `spf_pool_release` | Release worker and record proof of work receipt | ### Configuration Tools | Tool | Description | |------|-------------| | `spf_config_paths` | List all path rules (allowed/blocked) from SPF_CONFIG | | `spf_config_stats` | SPF_CONFIG LMDB statistics | ### Project Management Tools | Tool | Description | |------|-------------| | `spf_tmp_list` | List all registered projects with trust levels | | `spf_tmp_stats` | TMP_DB statistics: project count, access logs, resources | | `spf_tmp_get` | Get project info by path | | `spf_tmp_active` | Get the currently active project | ### Communication Hub | Tool | Description | |------|-------------| | `spf_channel` | Universal agent channel: create, join, leave, send, listen, history, list, connect (WS), disconnect, status | ### Notebook Tools | Tool | Description | |------|-------------| | `spf_notebook_edit` | Edit a Jupyter notebook cell (replace, insert, delete) | ### User-Only Tools (AI agents blocked) These tools are **hard-blocked** from AI agents at the gate level. User/system access only via SPF CLI: `spf_fs_exists`, `spf_fs_stat`, `spf_fs_ls`, `spf_fs_read`, `spf_fs_write`, `spf_fs_mkdir`, `spf_fs_rm`, `spf_fs_rename` --- ## FLINT Transformer Built-in encoder-decoder transformer for gate-aligned learning. | Property | Value | |----------|-------| | Architecture | Encoder-decoder | | Dimensions | 256d | | Heads | 8 | | Layers | 6 | | Parameters | ~5M | | Embeddings | all-MiniLM-L6-v2 (384d, in-process) | | Online learning | ON | | EWC lambda | 0.4 | | Learning rate | 1e-4 | | Replay buffer | 10,000 slots | | Checkpoint interval | 1,000 steps | | Training signal | Gate decisions (evil/FP labels) | ### Learning Pipeline | Phase | When | What | |-------|------|------| | PRE | Startup | init_brain() + index_knowledge_docs() + index_spf_sources() | | DURING | 30s loop | GateTrainingCollector → FLINT scores → route_signals → brain_store() | | AFTER | 1hr loop | Expire → Working→Fact → Fact→Pinned → auto-train (16+ tlog or 1hr) | ### Memory Lifecycle (Tiered Promotion) ``` Agent stores → Working (24hr) → Fact (7-day) → Pinned (permanent) ↓ ↓ ↓ Expire old Top 20% promote Never auto-expire ``` --- ## Brain System In-process vector memory using stoneshell-brain (Candle + LMDB + MiniLM-L6-v2). | Property | Value | |----------|-------| | Model | all-MiniLM-L6-v2 | | Embedding dim | 384 | | Chunk size | 512 | | Chunk overlap | 64 | | Storage | LMDB (vectors) + LIVE/BRAIN/DOCS/ (data files) | ### Collections | Collection | Purpose | |------------|---------| | `default` | General knowledge, web research, project docs | | `spf_source` | All src/*.rs modules indexed at boot | | `flint_results` | Tool call results (>2000 chars, before compression) | | `flint_training` | Gate decision signals, evil/FP labels | | `flint_knowledge` | User-dropped knowledge files (.md/.txt/.rs/.json) | | `flint_episodic` | Past FLINT Q+A pairs, behavioral patterns | | `session_state` | Current session metadata | ### Memory Triad (Redundant Persistence) Three systems — if any ONE fails, the other TWO recover: 1. **Brain** (vectors) — Semantic search, chunked knowledge 2. **STATUS** (sequential) — Current state, phase, next step 3. **Work Blocks** (structural) — Tasks, dependencies, confidence, progress 4. **Twin Folders** (evidence) — Data served for low-confidence work blocks --- ## Mesh Network P2P agent communication over QUIC (iroh library) with Ed25519 identity. **In development and testing.** | Feature | Status | |---------|--------| | P2P QUIC transport | In development | | Ed25519 identity | In development | | Peer discovery | In development | | Tool call proxying | In development | | Voice over mesh | In development | | Chat over mesh | In development | | Multi-agent coordination | In development | --- ## Voice Pipeline **Not yet tested.** Components built, awaiting integration testing. | Component | Technology | |-----------|-----------| | TTS | espeak-ng FFI (in-process) | | Codec | Opus (libopus.a) | | Audio | cpal + oboe-ext | | STT | Pending (JNI via Stone Shell Terminal) | --- ## Result Compression (FL-2) Three tiers based on result size: | Tier | Size | Behavior | |------|------|----------| | FULL | < 500 chars | Pass through unchanged | | SUMMARY | 500–5,000 | First 8 lines + last 3 lines + stats | | DIGEST | > 5,000 | First 200 chars + last 100 chars + stats + recall hint | Originals always preserved in brain (>2000 chars threshold) before compression. File reads never truncated (preserves non-Claude LLM compatibility). --- ## Build ```bash cd SPFsmartGATE cargo build --release # Deploy binary cp target/release/spf-smart-gate LIVE/BIN/spf-smart-gate/spf-smart-gate ``` ### Dependencies - Rust (stable) - **[heed](https://github.com/meilisearch/heed)** — safe Rust LMDB bindings. All persistent storage (config, agent state, brain vectors, training data) runs through heed → LMDB. Zero-copy reads, no server process, sub-millisecond lookups. The core reason SPF runs fast on a phone. - stoneshell-brain (Candle + MiniLM-L6-v2) - espeak-ng (TTS) - libopus (audio codec) - iroh (QUIC mesh) --- ## Configuration ### MCP Server Config `~/SPFsmartGATE/LIVE/LMDB5/.mcp.json` — points Claude CLI to the binary. ### Claude CLI Config `~/SPFsmartGATE/LIVE/LMDB5/.claude.json` — blocks native Claude CLI tools (26 tools denied). `~/SPFsmartGATE/LIVE/LMDB5/.claude/settings.json` — deny list for native tools. `~/SPFsmartGATE/LIVE/LMDB5/.claude/settings.local.json` — model routing (OpenRouter). ### SPF Config Enforcement mode (`soft` or `max`), blocked paths, allowed paths, formula weights — all in LMDB SPF_CONFIG database. --- ## File Structure ``` SPFsmartGATE/ ├── Cargo.toml # Rust project manifest (42 modules) ├── LICENSE # Apache-2.0 ├── README.md # This file ├── src/ │ ├── main.rs # CLI entry point │ ├── lib.rs # Library exports (42 pub mod) │ ├── gate.rs # Primary enforcement (6-step pipeline) │ ├── calculate.rs # SPF complexity formula │ ├── validate.rs # Rules validation (stages 0-6) │ ├── inspect.rs # Content inspection (creds, injection) │ ├── mcp.rs # MCP server (JSON-RPC 2.0, 81 tools) │ ├── dispatch.rs # Unified dispatch (all transports) │ ├── session.rs # Session state management │ ├── storage.rs # LMDB persistence │ ├── config.rs # Configuration types │ ├── brain_local.rs # In-process brain singleton │ ├── flint_memory.rs # Memory router + tiered promotion │ ├── agent_state.rs # Agent memory (LMDB5) │ ├── transformer.rs # FLINT model (encoder-decoder) │ ├── transformer_tools.rs # FLINT tool handlers │ ├── gate_training.rs # Training signal collection │ ├── train.rs # AdamW optimizer │ ├── tokenizer.rs # Tokenizer │ ├── tensor.rs # Tensor operations │ ├── attention.rs # Multi-head attention │ ├── ffn.rs # Feed-forward network │ ├── encoder.rs # Encoder stack │ ├── decoder.rs # Decoder stack │ ├── framing.rs # Message framing │ ├── checkpoint.rs # Model checkpoint save/load │ ├── learning.rs # Learning rate + EWC │ ├── pipeline.rs # Batch pipeline + API sessions │ ├── worker.rs # Worker pool │ ├── network.rs # Network pool + NetAdmin │ ├── mesh.rs # P2P QUIC mesh (iroh) │ ├── identity.rs # Ed25519 identity │ ├── chat.rs # Chat engine │ ├── voice.rs # Voice pipeline (TTS/STT) │ ├── web.rs # Web client │ ├── http.rs # HTTP server + reverse proxy │ ├── browser.rs # Browser automation │ ├── channel.rs # Universal channel hub │ ├── orchestrator.rs # Multi-agent orchestrator │ ├── config_db.rs # SPF_CONFIG LMDB │ ├── tmp_db.rs # TMP_DB LMDB │ ├── fs.rs # Virtual filesystem (LMDB) │ ├── paths.rs # Path utilities │ └── utf8_safe.rs # UTF-8 safe truncation ├── LIVE/ │ ├── BIN/spf-smart-gate/ # Deployed binary │ ├── BRAIN/DOCS/ # Brain data files │ ├── MODELS/ # FLINT checkpoints │ ├── SESSION/ # Session logs │ ├── LMDB5/ # Flat-file agent runtime │ └── LMDB5.DB/ # LMDB-backed agent runtime └── PROJECTS/PROJECTS/ └── DEPLOY/ # Agent workspace ``` --- ## Current Status | Component | Status | |-----------|--------| | MCP Server | 81 gated tools | | Gate Security | 6-step pipeline, compiled Rust enforcement | | Build Anchor | Read-before-write enforced | | Content Inspection | Credential + injection scanning | | FLINT Transformer | ~5M params, online learning, gate-aligned | | Brain | 7 collections, MiniLM-L6-v2, in-process | | Memory Triad | Brain + STATUS + Work Blocks + Twin Folders | | Tiered Promotion | Working → Fact → Pinned lifecycle | | Mesh Network | P2P QUIC, Ed25519, iroh — **in development and testing** | | Voice | TTS built (espeak-ng) — **not yet tested**, STT pending | | Chat | P2P messaging over mesh — **in development** | | RAG | Web search, RSS, file/folder indexing | | Web Agent | **Working** — spf_web_api tested (GET/POST with auth headers). Agents can interact with social media APIs | | Browser | API tools working (web_api, search, fetch). Browser automation (navigate/click/fill/select/eval) in development — proxy starts but WebSocket bridge needs browser connection | | Network Pool | Worker pool with proof of work | --- ## Notes - **1 developer** — not all features complete - **Gateway security**: approaching 100% - **All core tools**: 100% working - **Cross-compiles** on Android and Linux with minimal installation - **Agent cloning and specialization** supported - **50+ day continuous session** tested on Android phone - **Open source** — entire source code refreshes into transformer RAG system every reboot - Install in home folder, ensure file paths are correct in `.mcp.json` and `settings.local.json` - **Not all files have been uploaded yet** — repository is still being populated. Some modules may not be present until upload completes. --- ## License Licensed under the **Apache License 2.0**. See [LICENSE](LICENSE) for full terms. You are free to use, modify, and distribute this software, including for commercial purposes, provided you include the original copyright and license notice. **Author**: Joseph Stone **Email**: joepcstone@gmail.com *SPF (StoneCell Processing Formula), Build Anchor Protocol, and FLINT are proprietary designs of Joseph Stone.*