Hacker News: tomjwxf

Token spend is not token capital

tomjwxf — Wed, 17 Jun 2026 03:23:09 +0000

Article URL: https://twitter.com/TJWXF3/status/2067080353081356313

Comments URL: https://news.ycombinator.com/item?id=48565311

Points: 3

# Comments: 0

Token Capital Needs Receipts

tomjwxf — Tue, 16 Jun 2026 13:11:54 +0000

Article URL: https://twitter.com/TJWXF3/status/2066863679212331467

Comments URL: https://news.ycombinator.com/item?id=48554772

Points: 2

# Comments: 0

New comment by tomjwxf in "Show HN: A Karpathy-style LLM wiki your agents maintain (Markdown and Git)"

tomjwxf — Sat, 25 Apr 2026 11:14:04 +0000

Re classifier routing: text-shape signals (token count, syntactic markers) underspecify the boundary, especially for agent-generated queries. The signal that worked better in our policy-gated tool-call setting was the surrounding intent context the agent was operating under, not the query string itself. An agent in a "fact-check" context emits long, well-formed sentences that actually want exact-match retrieval; an agent in an "open research" context emits surprisingly short queries that need narrative retrieval. If the runtime can read the tool or skill context at query time, routing on that is less ambiguous than text shape. Doesn't help if the wiki is a black-box MCP server with no caller-side context, but it's worth offering an optional context hint in the lookup payload.

New comment by tomjwxf in "Show HN: Cq – Stack Overflow for AI coding agents"

tomjwxf — Sat, 28 Mar 2026 00:43:54 +0000

my core thesis is that AGI is here, it just needs accountability and efficient frameworks to navigate our arbitrary world

New comment by tomjwxf in "MCP Security 2026: 30 CVEs in 60 Days"

tomjwxf — Fri, 27 Mar 2026 06:08:54 +0000

The gateway approach (OAuth + RBAC) solves the perimeter problem — who can connect. protect-mcp solves a different layer — what can they do once connected, and how do you prove it.

It wraps any MCP server as a stdio proxy. Per-tool policies (block, rate-limit, require human approval). Every decision gets an Ed25519-signed receipt that's verifiable offline — no callbacks, no accounts.

The two layers stack: your gateway authenticates the caller, protect-mcp constrains which tools they can call and signs the evidence.

npx protect-mcp -- node your-server.js

MIT licensed. The receipts protocol has an IETF Internet-Draft: https://datatracker.ietf.org/doc/draft-farley-acta-signed-re...

npm: https://npmjs.com/package/protect-mcp

New comment by tomjwxf in "Show HN: Automate your workflow in plain English"

tomjwxf — Wed, 25 Mar 2026 23:37:29 +0000

The staged autonomy pattern ("trust is earnable") maps directly to what we built with protect-mcp — shadow mode first (log everything, block nothing), then enforce when you've seen enough data to trust the policies.

For the prompt injection concern: protect-mcp wraps MCP tool calls with per-tool policies. Even if the agent gets injected, it can't call tools outside the policy. Every decision is optionally Ed25519-signed and verifiable offline.

npmjs.com/package/protect-mcp

New comment by tomjwxf in "Show HN: Cq – Stack Overflow for AI coding agents"

tomjwxf — Wed, 25 Mar 2026 23:36:34 +0000

This is exactly right. We implemented delegation receipts — Agent A grants scoped authority to Agent B, producing a signed receipt. B's subsequent actions reference A's delegation receipt. An auditor can trace the full chain from human principal to agent action.

The fiduciary analogy is spot on. Every receipt in the chain is independently verifiable: npx @veritasacta/verify --self-test

Signed receipts for MCP tool calls – prove what your agent did

tomjwxf — Wed, 25 Mar 2026 12:37:57 +0000

Article URL: https://www.npmjs.com/package/protect-mcp

Comments URL: https://news.ycombinator.com/item?id=47516528

Points: 2

# Comments: 0