# Reported issues for life. scored. Pod holds 9 of 9 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user. Back to [life. scored.](/mcp/life-scored). ## Most discussed ### List MCP server in the official MCP registry Publish the remote MCP server (`https://lifescored.com/mcp`) to registry.modelcontextprotocol.io under the domain namespace `com.lifescored/mcp`. - Domain ownership proven via HTTP file auth: `/.well-known/mcp-registry-auth` (Ed25519 public key). - Private signing key minted into Keychain via the secrets skill (`mcp-registry-signing-key`), never printed. - `server.json` declares the streamable-http remote. Registry currently returns count:0 for 'lifescored' — we were never actually published. [Read the thread](https://github.com/royashbrook/lifescored/issues/26) · 2026-06-17 · closed · 2 comments ### Narrative levers should be allowlisted against real rule ids narrative.ts validate() accepts any string <40 chars as a lever; buildPrompt interpolates them raw into the Gemini prompt (prompt injection, low blast: self-targeted). Same root cause lets arbitrary lever strings vary the cache key so every request misses cache and burns the 200/day budget (availability). Fix: filter levers to known RULES ids. (adversarial review) [Read the thread](https://github.com/royashbrook/lifescored/issues/21) · 2026-06-17 · closed · 2 comments ### No timeout on the Gemini narrative fetch src/lib/server/narrative.ts fetch has no signal; a hung upstream holds the Worker invocation until the runtime kills it, and budget counters are incremented before the call so repeated stalls waste the daily budget. Fix: AbortSignal.timeout(8000), abort -> existing fallback. (adversarial review) [Read the thread](https://github.com/royashbrook/lifescored/issues/20) · 2026-06-17 · closed · 2 comments ### MCP: crashes on null / non-object JSON-RPC message POST /mcp with body `null` or a batch `[null]` reaches handle(msg) which reads msg.id -> TypeError -> unhandled 500 (only request.json() is in the try; messages.map(handle) is not). Public unauthenticated endpoint. Also: an empty batch `[]` returns 202 instead of a single -32600 per JSON-RPC. Fix: guard non-object messages -> -32600; empty batch -> -32600. (adversarial review) [Read the thread](https://github.com/royashbrook/lifescored/issues/18) · 2026-06-17 · closed · 2 comments ### Agent/LLM access: llms.txt + rules.json + discovery MCP Make the score usable as a skill by any LLM/agent, while keeping the privacy promise: nothing computed server-side, no PII received. **Step 1 (this):** the PII-free data layer. - `/rules.json` — complete machine-readable rulebook (weights, bounds, evidence, sources, formulas), input schema, and engine constants, so an agent computes on its own side. - `/llms.txt` — LLM-facing manifest: what it is, privacy stance, how to compute, how to give feedback. - `CONTRIBUTING.md` — feedback funnel for ag [Read the thread](https://github.com/royashbrook/lifescored/issues/11) · 2026-06-15 · closed · 2 comments ### Add AGENTS.md + CLAUDE.md for agents working on the repo The repo has no agent-instruction file. Add a vendor-neutral AGENTS.md (the agents.md standard) covering: how to USE lifescored as an agent (skill / rules.json / MCP), and how to WORK ON the repo (setup, the full gate, commit-#N hook, PR-then-merge, single-source export, the rulebook, privacy invariants, hush for secrets, infra ownership). Add a one-line CLAUDE.md pointing to it so Claude Code picks it up natively. [Read the thread](https://github.com/royashbrook/lifescored/issues/44) · 2026-06-18 · closed · 1 comment ### Create a companion lifescored skill (pairs with the MCP) We shipped an MCP server but not a skill. A skill is a second consumption/distribution channel: a SKILL.md that teaches any agent to compute a life score from the published rulebook — ask the user only for unknown inputs, compute the breakdown locally per the position tables/constants in rules.json, and present it with the ethos (breakdown > composite, every rule cited, nothing sent anywhere). Design decisions to confirm: - Where it lives / how it's distributed (in-repo shippable artifact linke [Read the thread](https://github.com/royashbrook/lifescored/issues/39) · 2026-06-17 · closed · 1 comment ### [decision] rules.json over-promises exact reproduction for 31/35 rules Only the 4 finance rules ship machine-readable formulas (in constants); the other 31 publish prose logic only, so an agent cannot recover e.g. life-table ((81|76)-age)/60 or smoking {never:1,former:0.6,current:0}, yet the published instruction says to compute position from the formulas. DECISION: publish a machine-readable position spec per rule (fully honors the promise, more work) vs soften the wording (quick, honest). (adversarial review) [Read the thread](https://github.com/royashbrook/lifescored/issues/23) · 2026-06-17 · closed · 1 comment ## Most recent ### Migrate infra/MCP secrets to hush + fix dead 'secret run' runbooks The old 'secret' skill was removed (cleanup agent), so its keychain-backed runbooks are dead commands. Migrated the lifescored infra + MCP secrets from the old roy-secret: keychain into hush (value-preserving via security|hush set, validated: tofu plan = No changes, MCP pubkey matches proof), and updated the docs: - infra/.hush manifest (CLOUDFLARE_API_TOKEN + AWS_* -> lifescored-* secrets) so it's `hush exec -- tofu plan`. - infra/providers.tf + infra/README.md: `secret run` -> `hush exec`. - d [Read the thread](https://github.com/royashbrook/lifescored/issues/50) · 2026-06-18 · closed · 0 comments The remaining reports are on [the project's issue tracker](https://github.com/royashbrook/lifescored/issues).