{
  "finding": "Sizing runs small, and buyers only discover it after delivery",
  "corroboration": { "records": 31, "channels": 5 },
  "receipts": ["rc_8f2a1", "rc_44b0e", "rc_91c37"],
  "confidence": "finding"
}

GET /v1/evidence/rc_8f2a1 returns the actual comment, its score, where it was posted, when, and its permalink. A customer of your customer can click a claim and read the human who said it.

The hosted API lives at https://quorum-api-j15n.onrender.com, on a free tier instance that sleeps when idle, so the first request after a quiet spell waits a few seconds for it to wake.

The hosted instance is keyed while the API is early. The API root says how to request a key, and always says which mode the instance you are talking to is in. The health endpoint needs no key, so you can check it is alive right now:

curl https://quorum-api-j15n.onrender.com/v1/healthz

Self hosting supports open mode or per key auth, quotas, tenancy and webhook secrets, all self served from GET /v1/usage.

Contents

• What it does
• Use cases
• Status
• Requirements
• Quick start
• Usage
  • CLI
  • HTTP API
  • JavaScript SDK
  • Python SDK
  • MCP server
  • Webhooks
  • Running the API yourself
  • Postgres
• What the API does
• Why this is different
• Documentation
• Contributing
• License
• Acknowledgements

What it does

Voice of customer from public archives, competitor ads ranked by how long they have actually been running, and a video versus static verdict computed as arithmetic rather than opinion. It keeps everything it reads, so the second question about a market is nearly free and the archive can be asked about the past.

Key capabilities

• Receipts, not links. A stable id into a retained corpus, which resolves identically forever, including after the source deletes the original.
• Corroboration as arithmetic. A claim needs at least three independent records before it prints as a finding, and the count travels with it.
• Ten sources behind one interface, from a volunteer Reddit archive and GitHub issue search to four government safety regulators, each degrading rather than failing when unconfigured.
• A corpus that compounds. Cold retrieval measured 596 seconds and about 500 throttled requests. The same category answers in half a second once warm.
• Offline mode that touches no network and costs nothing.
• Fifteen HTTP operations, a typed SDK, an MCP server and a CLI, all the same pipeline.

What it looks like

Real output, excerpted from a cold npx quorum "espresso machine" run on 2026-08-24: 401 records in 227 seconds for $0.00.

EVIDENCE  a claim needs 3 independent receipts to be stated as a finding
          the percentage is share of all 401 records held for this category

  quality     88 receipts /  64 channels  21.9%  A0 B3 C85 D0   [finding]
      "I often hear the priority list being 1. Quality of beans 2. Quality
       of the grinder 3. Quality of the espresso machine..."
         hackernews Why a spritz of water before grinding coffee yields
         better results   rc_4d6d444821b0044f

ATTESTED  7 records from 6 named parties   [finding]
  A named party stated this to a regulator, on the record, with consequences
  for lying. Two of these are a finding on their own.

      "CPSC And Krups Announce Action On Espresso Makers..."
         cpsc Krups   rc_a4883bfb1b04d1c1

RECEIPTS  195 cited, 195 resolved back to real records

COST      $0.0000 in 227.3s

Every id in that output is fetchable from the corpus that run wrote. If an id does not resolve, the run exits non zero and says which one.

Use cases

• Product and brand research. What buyers actually complain about, with the comment behind every claim, rather than a summary you have to trust.
• Competitive teardown. One full retrieval per rival, so shares are compared instead of counts, and co-occurrence is never mistaken for a signal.
• Ad creative decisions. Video versus static judged by how long real campaigns ran, from dated observations rather than from a platform's own label.
• Agent tooling that can be audited. An MCP server whose every claim the calling model can independently resolve, which is the one thing a research tool cannot fake.
• Diligence and monitoring. Attested records a named party filed with a regulator, and a diff against the last report for the same subject.

Status

Requirements

Node 22.18 or newer. The engine has one runtime dependency, pg, and only in the hosted server: no framework, no ORM, no HTTP client, no test runner, and nothing at all in the CLI or the corpus. That is a deliberate constraint rather than a boast, because every dependency in a tool that fetches untrusted text from the public internet is another thing that can reach the network on your behalf. pg earned its place by being a connection pool that survives a database restart, which is not a thing worth hand writing.

No key is required for anything. Reddit through a public archive, Hacker News, the App Store, the CFPB consumer complaint database and four government safety archives are all free and keyless. Keys only ever ADD sources (YouTube comments with a free API key, Amazon reviews and the Meta ad library through Apify), and a missing one degrades a run rather than failing it.

Quick start

Requires Node 22.18 or newer, and nothing else.

npx quorum-api "running shoes"

That is the whole install. Five packages come down from npm, about 240 KB with zero external dependencies, and the first report starts.

Working on Quorum itself is the clone path:

git clone https://github.com/Godzilla-lab/Quorum-API && cd Quorum-API
npm install
npm run build
npm test          # 1,330 tests, offline, no keys

Then research something. The input is a subject, not a URL. Plain text works, a product URL works, and a product URL the store refuses still works, which matters because four of four real store pages blocked a server side fetch when this was measured.

npx quorum "running shoes" --offline    # corpus only, no network, no cost
npx quorum "running shoes" --offline --corpus ./mine.db   # somewhere else

Usage

CLI

The whole engine on your machine, against a corpus you own.

# A subject in plain words
npx quorum "running shoes" --communities running,runningshoegeeks

# A product url, including one a store refuses to serve to a server
npx quorum "https://allbirds.com/products/mens-wool-runners"

# Corpus only. No network, no cost, and it says so
npx quorum "running shoes" --offline

# Machine readable. Progress goes to stderr, so this pipes cleanly
npx quorum "running shoes" --json | jq '.findings[].term'

# Versus what: one full retrieval per rival
npx quorum "wool runner" --compare "brooks ghost"

# Skip the one metered source explicitly
npx quorum "running shoes" --no-ads

--compare is one full retrieval per rival, and it has to be. Counting records in one corpus that happen to mention a rival measures co-occurrence: a comment saying "these run smaller than my Brooks" names a rival and a complaint and attributes the complaint to neither. So every side is a corpus of its own, shares are compared rather than counts, and a gap inside the sampling noise for those corpus sizes is reported as no difference rather than as a result.

Every claim it prints is either a finding, meaning at least three independent receipts stand behind it, or a weak signal, which is shown so it can be chased and is never stated as a market pattern. Before anything is printed, every cited receipt is fetched back out of the corpus, and the run exits non zero if one of them does not resolve.

quorum --help lists the flags. Every command above works through npx quorum-api with nothing cloned, or through the quorum bin inside a checkout; they are the same binary.

HTTP API

Start a report, poll it, then resolve the ids it cites.

# Start one. Returns 202 immediately with an id
curl -sX POST http://localhost:8787/v1/reports \
  -H "authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{"subject":"wool runner","terms":["sizing","durability"]}'

{ "id": "rep_3568995af829290a", "status": "running", "coalesced": false,
  "category": "wool runner", "queuePosition": 1, "estimatedSeconds": 60 }

# Poll it. Honours Retry-After while running, and ETags so polling costs nothing
curl -s http://localhost:8787/v1/reports/rep_3568995af829290a \
  -H "authorization: Bearer $KEY" -H 'if-none-match: "rep_3568995af829290a-7"'

# Watch it instead of polling
curl -N http://localhost:8787/v1/reports/rep_3568995af829290a/stream \
  -H "authorization: Bearer $KEY"

# Resolve one receipt. This is the endpoint everything else rests on
curl -s http://localhost:8787/v1/evidence/rc_a8697befab91e873 \
  -H "authorization: Bearer $KEY"

# Resolve up to 200 at once, because a report cites more than one
curl -sX POST http://localhost:8787/v1/evidence/batch \
  -H "authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{"receiptIds":["rc_8f2a1","rc_44b0e","rc_91c37"]}'

# Is this category warm? Free, and worth asking before paying for a cold report
curl -s http://localhost:8787/v1/categories/running%20shoes \
  -H "authorization: Bearer $KEY"

# Check somebody's claims, ours or a competitor's
curl -sX POST http://localhost:8787/v1/verify \
  -H "authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{"claims":[{"text":"sizing runs small","receipts":["rc_8f2a1"]}]}'

JavaScript SDK

Typed, zero dependency, written against spec/openapi.yaml. Every method is one operationId from that file.

import { createClient } from '@quorum/sdk-js';

const quorum = createClient({ baseUrl: 'https://quorum-api-j15n.onrender.com', apiKey: process.env.QUORUM_KEY });

const found = await quorum.searchEvidence({ query: 'sizing', category: 'running shoes' });
if (!found.ok) throw new Error(found.error.message);

for (const record of found.data.records) console.log(record.receiptId, record.text);

Errors are values, never thrown, the same rule the engine follows anywhere a vendor can be down. A caller gets { ok: false, error } carrying the server's type, its requestId and any retryAfterSeconds, because a 429, a 503 and a report that is simply not finished yet are all normal and none of them is exceptional.

It honours the server's pacing. waitForReport polls to completion using Retry-After when the server sends one, and treats a 503 as the load shedder rather than a failure. A client that gives up on the first refusal reports a busy service as a broken one, which is exactly what the shedder exists to prevent.

const started = await quorum.createReport({ subject: 'wool runner', offline: true });
if (started.ok) {
  const report = await quorum.waitForReport(started.data.id, {
    onPoll: (r) => console.log(r.status),
  });
}

streamReport returns the same run as an async iterable of server sent events, parsed by hand because there is no EventSource in Node that accepts an Authorization header.

Python SDK

The same client in Python, in packages/sdk-py, written against the same spec with the same two decisions: errors are values, never raised, and wait_for_report honours Retry-After so a busy service is not reported as a broken one. Standard library only, no dependencies, and the transport is injectable so its tests run with no network.

pip install quorum-api

from quorum_api import QuorumClient

quorum = QuorumClient("https://quorum-api-j15n.onrender.com", api_key="qk_...")
started = quorum.create_report("wool runner", offline=True)
if started.ok:
    report = quorum.wait_for_report(started.data["id"])

MCP server

Five tools spoken as JSON-RPC with no dependency, over two transports.

Remote, for connector forms that want a URL. The hosted instance answers Streamable HTTP at:

https://quorum-api-j15n.onrender.com/mcp

Open without a key: the read tools spend nothing and serve public data, and anonymous callers share one rate allowance so they cannot crowd out keyed customers. On a subject nothing is held for, research_product starts a harvest and returns at once; records are searchable as they land, so search_evidence and category_warmth answer while the run continues and say so. The public door runs one harvest at a time and at most three an hour; a key gets the ordinary report allowance. Ads and synthesis never run from it.

Local, over stdio, for clients that launch a command:

QUORUM_CORPUS=./quorum.db node packages/mcp/src/bin.ts

{
  "mcpServers": {
    "quorum": {
      "command": "node",
      "args": ["packages/mcp/src/bin.ts"],
      "env": { "QUORUM_CORPUS": "./quorum.db" }
    }
  }
}

Three decisions worth knowing, because the tool schema is the expensive part to change later:

Five tools, not one per endpoint. A tool definition costs 100 to 500 tokens on every turn, so a server mirroring ten routes spends the context window before the model has done anything.

Aggregated, never a row dump. search_evidence returns counts and a handful of quotes. A research tool that streams a corpus into a context window has spent the budget it was meant to save.

Markdown, not JSON, at roughly 60% of the tokens for the same content.

research_product is off by default because a report is minutes of throttled retrieval against volunteer archives, and an agent should not be able to start one by accident. The other four answer from what is already held and touch no network.

The payoff is a thing no other research server can offer: the calling agent can independently verify every claim. search_evidence cites ids and get_receipt resolves them, so an id that does not resolve is a claim that was never real, and it is the loudest line in the response when it happens.

Webhooks

A report is minutes long, so POST /v1/reports can call you back instead of being polled. Set a signing secret and delivery turns on:

QUORUM_WEBHOOK_SECRET=$(openssl rand -base64 32) npm start

curl -sX POST http://localhost:8787/v1/reports \
  -H "authorization: Bearer $KEY" -H 'content-type: application/json' \
  -d '{"subject":"wool runner","webhookUrl":"https://your-app.example/hooks/quorum"}'

When the report reaches a terminal state you receive a POST whose body is byte identical to GET /v1/reports/{id}, plus three headers following the Standard Webhooks specification, so you can verify with an off the shelf library rather than with code we invented:

The signed content is {webhook-id}.{webhook-timestamp}.{body}, and the key is the base64 body of your secret, not the whsec_ label. Your secret is the webhookSecret field on GET /v1/usage: scoped to your key, stable, and derived rather than stored, so it rotates exactly when the operator rotates the instance secret and never behind your back.

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(secret, headers, body, toleranceSeconds = 300) {
  const id = headers['webhook-id'];
  const timestamp = Number(headers['webhook-timestamp']);
  /* A signature alone is replayable forever, so bound the age first. */
  if (!Number.isFinite(timestamp)) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > toleranceSeconds) return false;

  const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
  const expected = createHmac('sha256', key).update(`${id}.${timestamp}.${body}`).digest();

  /* The header is a list so a secret can be rotated. Any one match is enough. */
  return String(headers['webhook-signature']).split(' ').some((part) => {
    const [version, value] = part.split(',');
    if (version !== 'v1') return false;
    const offered = Buffer.from(value ?? '', 'base64');
    return offered.length === expected.length && timingSafeEqual(offered, expected);
  });
}

Delivery is at least once, and retried for about 75 hours. A 2xx is success. A 5xx, a 429, a timeout or a network failure is retried on the Standard Webhooks schedule (immediately, 5s, 5m, 30m, 2h, 5h, 10h, 14h, 20h, 24h, with jitter). Any other 4xx is not retried, because a receiver rejecting the body will reject it again. Deliveries are held in the database, so a restart does not lose them.

Running the API yourself

The hosted API is one process and a corpus. It is the same engine the CLI runs.

QUORUM_CORPUS=./quorum.db \
QUORUM_API_KEYS=$(openssl rand -hex 32) \
QUORUM_WEBHOOK_SECRET=$(openssl rand -base64 32) \
PORT=8787 npm start

Set QUORUM_API_KEYS or the instance is open, which it will tell you on boot. Callers then authenticate with a bearer token:

curl -H "Authorization: Bearer $KEY" localhost:8787/v1/categories/running%20shoes

One instance serves everybody, and that is deliberate. The corpus is global because a category one caller warmed answers instantly for the next, which is the whole point of keeping one. Reports and webhook deliveries are the exception: they are tenant owned and row level security enforces it, verified against a real PostgreSQL server.

Postgres

Set QUORUM_PG_URL and the server uses Postgres instead of SQLite. Nothing else changes.

npm run migrate -w packages/corpus     # applies the schema, refuses to re-run one

QUORUM_PG_URL='postgres://user:pass@host:5432/db?sslmode=require' \
QUORUM_PG_CA=./provider-ca.pem \
QUORUM_API_KEYS=$(openssl rand -hex 32) npm start

Set QUORUM_PG_CA. sslmode=require means encrypt and not verify, and a managed provider signs with its own CA so the public root store rejects it. Download the provider's CA and the connection is verified rather than merely encrypted. The server says which of the two you got on boot.

pg is the only runtime dependency in this repo, and it lives in packages/server alone. The corpus package still has none, which is why its driver takes an injected client: somebody using the CLI with SQLite never installs a Postgres driver. See docs/postgres.md.

What the API does

Ten endpoints. The full contract, with schemas, is spec/openapi.yaml.

Reports, the slow path

A report is minutes of throttled retrieval when a category is cold and about half a second when it is warm, so it is a job rather than a request.

Evidence, the fast path

Every number a report prints resolves here. This is the half that makes a claim checkable, and it answers in single digit milliseconds against a warm corpus.

Verification

Limits

Two quotas per key, not one, because a report is minutes of throttled upstream retrieval and an evidence lookup is one indexed read. A single shared limit either starves the lookups or leaves the reports unprotected.

Every metered answer carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, success or refusal alike, so a caller can pace itself before being refused rather than after. GET /v1/healthz is exempt from the limit and therefore sends none: an instance has to be able to say it is alive while it is busy. A refusal is a 429 with Retry-After, and a refused request is not counted against the window, or a client in a retry loop could never get back in.

Limits are on even when auth is off. An instance with no keys has one caller by definition, so the allowance is shared rather than absent. The one thing a limit has to survive is somebody forgetting to configure it.

Metered sources, and the money

Competitor ads come from a paid vendor, so includeAds is available to every caller and bounded by a budget rather than by a rate limit. A rate limit bounds how often, never how much: twenty reports a minute with ads on is twenty metered vendor runs a minute, which a rate limit permits happily.

The third is the one that matters when ads are open to everyone. Without it the real ceiling is the per key figure multiplied by however many keys exist, which is not a ceiling.

All three default to zero, which leaves ads off. An operator who has not set a budget has not agreed to a bill, so forgetting produces a report without ads rather than an invoice. The server says which state it is in on boot.

Running out is not an error. The report still runs and still answers, it just answers without the metered leg, and the degradation list says exactly why. Failing a whole report over an optional extra would throw away minutes of free retrieval.

A coalesced run is paid for by whoever started it, and callers who join it ride free. That is what coalescing is for, and splitting a bill across joiners who arrived at different moments would be arbitrary in a way nobody could check. Spend is charged from what the cost meter actually recorded, never from an estimate, and GET /v1/usage reports it.

Why this is different

Three properties, none of which is a matter of opinion.

A receipt does not rot. Every other research API returns a URL captured against a live index at query time, and it dies when the page does. A receipt is a stable id into a retained corpus. It resolves identically forever, including after the source deletes the original.

Corroboration is arithmetic. A claim needs at least three independent records before it prints as a finding, and the count travels with it. "31 records across 5 channels" is a sentence no search API can produce, because none of them keep a corpus to count against. It is also the prompt injection defence: a planted comment cannot corroborate itself.

The archive can be asked about the past. Because records are kept rather than fetched, the corpus answers questions a live index structurally cannot:

• Trend, as share of conversation over time, not raw counts. Counting records per month reports everything as rising, because it measures our harvesting rather than the market.
• As of, answering what the market said in March, filtered on when each record was written rather than when we found it. The archive is allowed to know more about March than we did in March.
• Diff, what changed since the last report for the same subject, naming the new receipts rather than counting them.
• Comparison, one full retrieval per rival, because counting records in one corpus that mention a competitor measures co-occurrence and attributes nothing.
• Attested evidence, records a named party filed with a regulator, which outranks any forum comment and which no listening tool holds.

And the thing that is easy to miss: Meta does not archive inactive commercial ads. Once a campaign stops, the record that it ran for 94 days is gone and no amount of money brings it back. Shopify drops delisted products from /products.json the day they are pulled. For those sources the corpus is not a cache, it is the only copy that will ever exist, and only because something was recording on the day.

Documentation

Contributing

Adding a source is the main way to help, and it touches only its own directory: one adapter behind the Source interface, one fixture, one conformance case. See CONTRIBUTING.md.

npm run build          # tsc, declarations only, node runs the source directly
npm test               # node:test, offline, no keys required
npm run verify         # build, test, copy style, security, drift, spec

Two house rules that will fail your build if you miss them: no em dashes or en dashes anywhere, enforced by npm run lint:copy, and named exports only.

Found a vulnerability? SECURITY.md, not an issue.

Development

npm run build          # tsc across workspaces
npm test               # node:test, all packages, offline, no keys
npm run lint:copy      # house style
npm run check:security # secrets, SSRF guard, no-auth rule, audit
npm run check:spec     # the spec against the code it describes
npm run migrate -w packages/corpus     # Postgres schema
npm run test:postgres  # the driver against a real server, needs QUORUM_PG_URL

CI runs the test suite inside a network namespace with no route off the host, so an adapter that quietly reaches for the wire fails immediately instead of flaking later. Three of the 1,330 tests need a real PostgreSQL server and skip without QUORUM_PG_URL.

License

Apache 2.0 on the whole engine: every adapter, every gate, both corpus drivers, the CLI and the SDK. Nothing is crippled.

The hosted service sells one thing the source cannot give you, which is a warm corpus. Self hosting gets you the entire engine and a cold start. That is a real product, and if it is the right one for you, take it.

Acknowledgements

This runs on archives other people maintain, most of them for free:

• Arctic Shift, the public Reddit archive, which is a volunteer project and is treated as one
• Hacker News search
• The GitHub issue search API, used keyless as documented, which is what puts filed defects with reaction counts in tier B
• The Apple App Store public review feeds
• CPSC, openFDA, NHTSA and the EU Safety Gate, four regulators whose recall data is what makes attested evidence possible
• SEC EDGAR, which asks callers to identify themselves and is the reason QUORUM_CONTACT_EMAIL exists
• The CFPB Consumer Complaint Database, 17 million complaints under CC0 with the consumer's own account of what happened, through its public search API: the voice tier for anything financial, where forums are thin
• The YouTube Data API, used with a free key as documented: comments under review videos are buyers talking, at one quota unit per hundred comments against a 10,000 unit free day
• Apify, the one paid vendor, carrying both metered legs: the Meta Ad Library scraper and Amazon product reviews. The reviews leg reads only what Amazon's public product page shows a logged out visitor, plans nothing unless the subject is an Amazon product, and every call charges the cost meter at rates verified against real billing
• Standard Webhooks, so webhook signing is somebody else's well reviewed design rather than ours