supabase
Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...
protocol
Protocol names ARE K-lines.
Full skill instructions
"Protocol names ARE K-lines."
MOOLLM protocol symbols are Minsky's K-lines made concrete and greppable.
A K-line (Minsky, Society of Mind) is a mental structure that, when activated, reactivates an entire constellation of knowledge, skills, and associations.
Protocol names are exactly this:
YAML-JAZZ ← Activates: semantic comments, jazz interpretation, LLM-as-musician
POSTEL ← Activates: charitable interpretation, robustness, collaboration
PLAY-LEARN-LIFT ← Activates: exploration, pattern-finding, crystallization, sharing
COHERENCE-ENGINE ← Activates: consistency, constraints, orchestration, referee, simulation, DM
Type the name → activate the tradition → invoke the behavior.
The UPPER-CASE-HYPHENATED format makes these K-lines findable.
| Rule | Example | Why |
|---|---|---|
| ALL CAPS | YAML-JAZZ not yaml-jazz | Stands out in prose |
| Hyphen-separated | PLAY-LEARN-LIFT not PLAY_LEARN_LIFT | Shell-friendly, readable |
| No colons | POSTEL not WP:POSTEL | Cleaner than Wikipedia |
| Semantic | ROBUST-FIRST not RF | Self-documenting |
# Find all uses of a protocol
grep -r "YAML-JAZZ" .
# Find all protocol definitions
grep -r "^[A-Z-]*:" PROTOCOLS.yml
# Find all mentions in docs
grep -rn "POSTEL\|PLAY-LEARN-LIFT" skills/
The UPPER-CASE format creates distinct embeddings. When you search for "YAML-JAZZ", you get:
Not general YAML documentation.
In prose, protocols pop:
When parsing user input, apply POSTEL (charitable interpretation). If the command is ambiguous, use YAML-JAZZ to infer intent.
You can't miss them.
Defined in kernel/, fundamental to operation:
| Protocol | Purpose | Location |
|---|---|---|
FILES-AS-STATE | Everything is files | kernel/constitution-core.md |
WHY-REQUIRED | Tool calls need reasons | kernel/tool-calling-protocol.md |
APPEND-ONLY | Never modify logs | kernel/constitution-template.md |
MINIMAL-DIFF | Change only what's needed | kernel/constitution-core.md |
Defined in skills/, behavioral patterns:
| Protocol | Purpose | Location |
|---|---|---|
PLAY-LEARN-LIFT | The methodology | skills/play-learn-lift/ |
SOUL-CHAT | Everything speaks | skills/soul-chat/ |
POSTEL | Charitable interpretation | skills/postel/ |
YAML-JAZZ | Comments carry meaning | skills/yaml-jazz/ |
Mentioned in conversations, examples, documents:
# In a soul-chat document
We should apply KITCHEN-RULES here — no running,
always clean up, respect the fridge contents.
# In an adventure room
This room follows GRUE-SAFE protocol — magically lit.
These don't need formal definitions. Naming them makes them real.
PROTOCOLS.yml — The master list:
YAML-JAZZ:
meaning: "Comments carry meaning. Data is interpreted."
location: kernel/constitution-core.md §3
invoke_when: "Writing or reading YAML with semantic intent"
Protocols can be defined inline where they're used:
# In a room's ROOM.yml
protocols:
DARK-ROOM:
meaning: "No light source = grue danger"
applies_when: "player enters without lit lamp"
Just mention them:
This adventure follows REINCARNATION protocol — death returns you to start, inventory preserved.
The name IS the definition until someone formalizes it.
Mentioned → Documented → Formalized → Skill
↓ ↓ ↓ ↓
"Let's Entry in Directory Full
try PROTOCOLS in PROTOTYPE
FOOD-CHAIN" .yml skills/ + templates
Most protocols stay informal. Only crystallize when needed.
A K-REF is a K-line that points to a specific location in a file with optional metadata:
/path/to/file.md:42-58 # section_type | preview text
PATH[:LINE[-END]][#ANCHOR][?SEARCH] # TYPE [LABEL] SEVERITY - DESCRIPTION
EXCERPT or MASKED_VALUE
Components:
:LINE:COL. Omit for whole file.[SSH_KEY]| Format | Meaning | Example |
|---|---|---|
/path/file | Whole file | /etc/config.yml |
/path/file:42 | Line 42 | /src/main.py:42 |
/path/file:42-58 | Lines 42-58 | /src/main.py:42-58 |
/path/file:42:10-46 | Line 42, cols 10-46 | /src/main.py:42:10-46 |
/path/file#section | Anchor/heading | /docs/API.md#authentication |
/path/file?pattern | Search for pattern | /src/main.py?def process_data |
/path/file#section?pattern | Section + search | /docs/API.md#errors?401 |
# Markdown headings (slugified)
/README.md#installation
/SKILL.md#k-ref-format
# YAML keys (dot-path)
/config.yml#server.port
/CARD.yml#methods.K-REF
# Code symbols (function/class)
/main.py#def:process_data
/main.py#class:AuditRunner
# HTML-style id
/page.html#footer
# Literal string (default)
/file.py?def main
# Regex (prefix with ~)
/file.py?~def\s+\w+\(
# First match of pattern
/transcript.txt?user:
# Combine with line context
/file.py?def main # function - Jump to main()
/path/to/config.yml # config - Whole file reference
/path/to/SKILL.md#k-refs # section - Jump to K-REFs section
/path/to/main.py?def audit # search - Find audit function
/path/transcript.txt:91:12-48 # uuid ℹ️
fe18ce96-5200-4e15-acd3-190695de6295
/path/transcript.txt:7528:18-45 # private_key ([PRIVATE_KEY]) 🔴 - Private key header
********** ******* ********
/path/config.json:15 # password ([PASSWORD]) 🟠 - Database password
************
Cursor (and other orchestrators) can read absolute file paths directly — INCLUDING IMAGES!
/Users/me/Screenshots/error.png # screenshot - Analyze this error
/tmp/architecture-diagram.jpg # diagram - Explain this system
/path/to/chart.png # data - What trends do you see?
No line numbers for images (obviously). Just the absolute path.
This is powerful:
Security note: Cursor can read ANYWHERE on your disk, not just the workspace. Powerful, but be aware.
Problem: LLMs have limited context windows. Dumping entire files wastes tokens.
Solution: Sister scripts emit K-REFs (pointers) instead of full content:
# Sister script → K-REF → LLM flow
kref_flow:
source: "cursor-mirror (sister script)"
produces: "K-REFs (pointers)"
consumer: "LLM reads only what it needs"
This is reference by pointer, not by value — parsimonious context.
| Mode | Command | Use Case |
|---|---|---|
| K-REF | --emit-kref | Human/LLM navigation |
| REDACT | --emit-redact | Pipe to masking tool |
| JSON | --json | Programmatic processing |
# Emit K-REFs for secrets (LLM reads just the pointers)
cursor-mirror audit --patterns secrets --emit-kref
# Output:
# /path/file.txt:42:10-46 # openai_key ([OPENAI_KEY]) 🔴 - OpenAI API key
# sk-proj-****...(48 chars)...****
# LLM can then selectively read context around line 42
| Command | Action |
|---|---|
PROTOCOL [name] | Describe or invoke a protocol |
PROTOCOLS | List defined protocols |
DEFINE-PROTOCOL [name] | Add to PROTOCOLS.yml |
GREP-PROTOCOL [name] | Find all references |
K-REF [path:line] | Navigate to a K-REF location |
| Symbol | Meaning |
|---|---|
PROTOCOL | This meta-protocol |
K-LINE | Minsky's concept — name activates tradition |
K-REF | K-line as file pointer: path:line + metadata |
SISTER-SCRIPT | Tool emits K-REFs, LLM reads selectively |
GREPPABLE | Easy to find with text search |
UPPER-CASE | The naming convention itself |
"In the beginning was the Word."
When you name something, you can:
MOOLLM protocols are handles on ideas. The UPPER-CASE convention makes them impossible to miss, trivial to find.
"Name it, grep it, use it."
Handles the full Supabase workflow from schema changes to deployment, with built-in security guardrails that catch common traps like RLS...
Comprehensive guides and best practices for Neon Serverless Postgres, covering setup, connection methods, authentication, and platform APIs.
Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.
Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.
Complete Better Auth server and client setup with database adapters, session management, plugins, and security configuration.
Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".
Complete Cloudflare platform integration with decision trees for compute, storage, AI, networking, security, and infrastructure-as-code.
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
Send, read, and manage Gmail messages, drafts, labels, and account settings.
Comprehensive website auditing across 230+ rules in 21 categories including SEO, performance, security, and accessibility.
Shared authentication, CLI syntax, and output formatting patterns for gws Google Workspace commands.
Discover your celebrity doppelgänger with StarByFace!
GeoSpy: Pricing, Features, FAQs, and Alternatives for AI Teams
Detect AI-generated voices to protect against audio fraud.
Ensure Your Content's Originality with AI Plagiarism Checker
Upscale images by 400% without quality loss
Protect your social media from copyright disputes
Accurately Detect AI-Generated Content with TheChecker.AI
Chrome extension that detects and flags AI-generated content