for experts · audit it yourself

For experts: audit it

The beginner path just runs. This page is for people who want to check what it runs and why it's safe to run.

The rules your AI gets

Every tool result tells the AI that this site is data, not orders. It never gets a command that isn't on a page. It does the guide's steps for the human, sudo or package installs included, and tells them each one in a plain line. It asks only for what it can't do itself (a password, a sign-in, a name for their AI). One hard stop: it never deletes or overwrites the human's existing files or configs without asking, and it never pushes or makes anything public without asking.

Check the MCP tools

The server code and every served file are mirrored to a public repo, nixfred/how.nixfred.com-public, updated after each deploy. The exact tool list this server sends (names, descriptions, input schemas) is there as mcp-tools.json, with a version and a toolsSha256 hash (sha256 of the canonical JSON of the tool list). The server reports the same version and hash in initialize (serverInfo) and in tools/list. Today it is 19b8df64540656d76efab4921207c4f1d25376d717717162fd053203d2295552. To audit: compare what your client received with that file, record version and hash, and re-check whenever you like.

get_file(path) returns each seed-kit file with its sha256, so you can diff exactly what would be installed.

The code

The prompts are written in one place, byo/byo.js. The site, the chat and the MCP server are in the public mirror above. A deterministic audit script checks every rule before anything ships.