Reported issues for life. scored.
Pod holds 9 of 9 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.
Back to life. scored..
Most discussed
List MCP server in the official MCP registry
Publish the remote MCP server (https://lifescored.com/mcp) to registry.modelcontextprotocol.io under the domain namespace com.lifescored/mcp.
- Domain ownership proven via HTTP file auth:
/.well-known/mcp-registry-auth(Ed25519 public key). - Private signing key minted into Keychain via the secrets skill (
mcp-registry-signing-key), never printed. server.jsondeclares the streamable-http remote.
Registry currently returns count:0 for 'lifescored' — we were never actually published.
Read the thread · 2026-06-17 · closed · 2 comments
Narrative levers should be allowlisted against real rule ids
narrative.ts validate() accepts any string <40 chars as a lever; buildPrompt interpolates them raw into the Gemini prompt (prompt injection, low blast: self-targeted). Same root cause lets arbitrary lever strings vary the cache key so every request misses cache and burns the 200/day budget (availability). Fix: filter levers to known RULES ids. (adversarial review)
Read the thread · 2026-06-17 · closed · 2 comments
No timeout on the Gemini narrative fetch
src/lib/server/narrative.ts fetch has no signal; a hung upstream holds the Worker invocation until the runtime kills it, and budget counters are incremented before the call so repeated stalls waste the daily budget. Fix: AbortSignal.timeout(8000), abort -> existing fallback. (adversarial review)
Read the thread · 2026-06-17 · closed · 2 comments
MCP: crashes on null / non-object JSON-RPC message
POST /mcp with body null or a batch [null] reaches handle(msg) which reads msg.id -> TypeError -> unhandled 500 (only request.json() is in the try; messages.map(handle) is not). Public unauthenticated endpoint. Also: an empty batch [] returns 202 instead of a single -32600 per JSON-RPC. Fix: guard non-object messages -> -32600; empty batch -> -32600. (adversarial review)
Read the thread · 2026-06-17 · closed · 2 comments
Agent/LLM access: llms.txt + rules.json + discovery MCP
Make the score usable as a skill by any LLM/agent, while keeping the privacy promise: nothing computed server-side, no PII received.
Step 1 (this): the PII-free data layer.
/rules.json— complete machine-readable rulebook (weights, bounds, evidence, sources, formulas), input schema, and engine constants, so an agent computes on its own side./llms.txt— LLM-facing manifest: what it is, privacy stance, how to compute, how to give feedback.CONTRIBUTING.md— feedback funnel for ag
Read the thread · 2026-06-15 · closed · 2 comments
Add AGENTS.md + CLAUDE.md for agents working on the repo
The repo has no agent-instruction file. Add a vendor-neutral AGENTS.md (the agents.md standard) covering: how to USE lifescored as an agent (skill / rules.json / MCP), and how to WORK ON the repo (setup, the full gate, commit-#N hook, PR-then-merge, single-source export, the rulebook, privacy invariants, hush for secrets, infra ownership). Add a one-line CLAUDE.md pointing to it so Claude Code picks it up natively.
Read the thread · 2026-06-18 · closed · 1 comment
Create a companion lifescored skill (pairs with the MCP)
We shipped an MCP server but not a skill. A skill is a second consumption/distribution channel: a SKILL.md that teaches any agent to compute a life score from the published rulebook — ask the user only for unknown inputs, compute the breakdown locally per the position tables/constants in rules.json, and present it with the ethos (breakdown > composite, every rule cited, nothing sent anywhere).
Design decisions to confirm:
- Where it lives / how it's distributed (in-repo shippable artifact linke
Read the thread · 2026-06-17 · closed · 1 comment
[decision] rules.json over-promises exact reproduction for 31/35 rules
Only the 4 finance rules ship machine-readable formulas (in constants); the other 31 publish prose logic only, so an agent cannot recover e.g. life-table ((81|76)-age)/60 or smoking {never:1,former:0.6,current:0}, yet the published instruction says to compute position from the formulas. DECISION: publish a machine-readable position spec per rule (fully honors the promise, more work) vs soften the wording (quick, honest). (adversarial review)
Read the thread · 2026-06-17 · closed · 1 comment
Most recent
Migrate infra/MCP secrets to hush + fix dead 'secret run' runbooks
The old 'secret' skill was removed (cleanup agent), so its keychain-backed runbooks are dead commands. Migrated the lifescored infra + MCP secrets from the old roy-secret: keychain into hush (value-preserving via security|hush set, validated: tofu plan = No changes, MCP pubkey matches proof), and updated the docs:
- infra/.hush manifest (CLOUDFLARE_API_TOKEN + AWS_* -> lifescored-* secrets) so it's
hush exec -- tofu plan. - infra/providers.tf + infra/README.md:
secret run->hush exec. - d
Read the thread · 2026-06-18 · closed · 0 comments
The remaining reports are on the project's issue tracker.