ARCANE World-Sense — MCP Trust Artifacts
This repository is the verifiable public surface of the ARCANE World-Sense MCP server:
https://mcp.arcaneforecasting.com/mcp — a no-auth, read-only, streamable-HTTP MCP
server that hands an agent structured, pre-published readings of ARCANE's current
geopolitical-risk picture.
The sensing engine that computes those readings stays private. What is published here is
only the surface a cautious consumer needs to audit one question:
If I wire this MCP server into my agent, can it take actions, exfiltrate anything, or
prompt-inject my model?
The short answer is no — and these files are the source you can check it against.
Audit, don't reuse
These are trust artifacts, published so you can read them — not a framework to fork.
Read them, compare them against the live server's behavior, and decide for yourself. If you
want the data, call the MCP server; you do not need to run any of this code.
Start with SECURITY.md — it walks the safety argument end to end.
What ARCANE does — and does not — claim
ARCANE NOTICES the present. It reports what the world is doing right now, and how fresh
and how sure each reading is. It does not act, predict, or advise, and it never tells
your agent what to do. Every payload carries an in-band as_of timestamp, a stale flag,
and a fixed NOTICE-not-advice note; treat any absent field as "not available," never as zero.
File map — what each file is, and what it proves
| File | What it is | What it proves |
|---|
worker.js | The entire Cloudflare Worker request path. | A read-only facade: every tool reads one pub_* value from a single public KV namespace and returns it verbatim — no code execution, no outbound fetch, no access to your systems. Also shows the kill switch, the Cache-API-fronted read path, and the rate-limit posture. |
wrangler.toml | The Worker's deployment config. | The binding structure: the Worker binds only the public KV namespace, so it physically cannot address ARCANE's private data. Account and namespace identifiers are redacted to placeholders; no secret is present. |
snapshot_public.py | The projection layer that builds the public pub_* values. | The allow-list projection (only named fields are copied forward), the fail-closed leak guard (any forbidden field, phrase, or excluded source blocks the whole publish), and the instruction-injection neutralizer that scrubs third-party free text. |
snapshot_public_text.py | The capability statement and per-stream notes served in-band. | Exactly the human-readable copy the server hands back — what it serves, what it never serves, and each stream's validation caveats. |
SECURITY.md | The security & safety writeup. | The full argument, plus what the server logs and how to verify the limits yourself. |
LICENSE | MIT. | — |
Honest limits of this repo
Be clear on what this repo does and does not let you verify:
worker.js is the externally verifiable part. It is the actual request path. Anyone
can hit the live endpoint and compare behavior against this source; there is no in-band
deployment fingerprint, but the code is short enough to read and diff against in full.snapshot_public.py documents intent, not the live request path. It runs in ARCANE's
private publishing pipeline, not in the Worker you call. It shows you the discipline
with which public payloads are built — allow-list, leak guard, neutralizer — but you are
trusting that the deployed pipeline matches this source. We say so plainly rather than
overstate it.- Deployed ≠ published. In both cases you are trusting that the running system matches
this code. The surface is deliberately small so that trust is cheap to check.
More
- Live project: https://arcaneforecasting.com
- Found a concern — a field that shouldn't be served, a neutralizer bypass? Open an issue or
reach the maintainer via the site. Responsible disclosure appreciated.