{ "ok": true, "data": { "source": { "rootUrl": "https://platphormnews.com", "networkGraph": "https://platphormnews.com/api/network/graph", "mcpManifest": "https://platphormnews.com/.well-known/mcp.json", "agentPolicy": "https://platphormnews.com/.well-known/agent-policy.json", "robots": "https://platphormnews.com/robots.txt", "llmsIndex": "https://platphormnews.com/llms-index.json", "apiDocs": "https://platphormnews.com/api/docs", "sourceNotes": [ "Root MCP manifest identifies platphorm-root as the public DMZ network root.", "Root network graph publishes site, node, edge, source, category, compliance, and trusted-domain metadata.", "Root robots policy allows public LLM discovery paths and blocks admin/private/protected paths plus token/key/secret query patterns.", "Root JSON-LD exposes organization, website search, navigation, and FAQ identity data." ] }, "tips": [ { "id": "public-dmz", "title": "Public DMZ means safe read-only front door", "surface": "Root MCP manifest and trust policy", "sourceUrl": "https://platphormnews.com/.well-known/mcp.json", "plainLanguage": "Think of the public DMZ like a public lobby. Anyone can ask where things are, but they cannot unlock private rooms, edit records, or trigger protected work.", "operator": "The root site publishes public discovery, network graph, stories, route compliance, and MCP introspection while reserving sync, validation, reports, and policy updates for protected actions.", "realWorldView": "Your job is to check that the front desk gives useful directions without accidentally becoming an admin panel.", "aha": "Public does not mean powerful. Public means safely inspectable.", "fieldMove": "Sort five actions into public read or protected mutation before looking at any API response.", "safeBoundary": "Do not test destructive, private, protected, credential, admin, or mutation paths without explicit authorization.", "entryIds": [ "integration-contract-cards", "abstention-design" ] }, { "id": "network-graph", "title": "The network graph is the map of the city", "surface": "GET /api/network/graph", "sourceUrl": "https://platphormnews.com/api/network/graph", "plainLanguage": "A website network is like a city. The graph tells you what buildings exist and how roads connect them.", "operator": "The root graph reports sites, nodes, edges, sources, categories, route compliance, discovery compliance, and trusted domain status.", "realWorldView": "A graph helps you check coverage: which sites are trusted, which surfaces are discoverable, and which claims need source-backed evidence.", "aha": "Discovery is not guessing URLs. Discovery is reading the map the platform publishes.", "fieldMove": "Show one graph count, then ask what evidence would prove whether a site is in or out of scope.", "safeBoundary": "Stay inside trusted domains and published discovery routes. Do not crawl arbitrary user-provided URLs.", "entryIds": [ "dictionary-provenance-check", "memory-hygiene" ] }, { "id": "robots-llms", "title": "robots.txt and llms files teach crawler manners", "surface": "robots.txt, llms.txt, llms-full.txt, llms-index.json", "sourceUrl": "https://platphormnews.com/robots.txt", "plainLanguage": "robots.txt is a hallway sign for crawlers. llms files are a study guide for AI systems.", "operator": "The root robots policy allows public discovery files and graph routes for LLM crawlers while blocking admin, private, protected, auth, cron, webhook, and secret-query paths.", "realWorldView": "Good automation respects the published crawl lanes. Ignoring them is not clever; it is unsafe and low-signal.", "aha": "The safest crawler is the one that reads instructions before touching the site.", "fieldMove": "Mark which listed routes are safe to inspect and which are clear stop signs.", "safeBoundary": "Never put tokens, keys, or secrets into URLs, traces, screenshots, feeds, or public artifacts.", "entryIds": [ "glossary-before-demo", "integration-contract-cards" ] }, { "id": "mcp-toolbox", "title": "MCP is a toolbox, not a permission slip", "surface": ".well-known/mcp.json and /api/mcp", "sourceUrl": "https://platphormnews.com/.well-known/mcp.json", "plainLanguage": "MCP lists tools an AI client can ask for, like a toolbox label. The label does not mean every tool is safe for every person to use.", "operator": "The root manifest exposes JSON-RPC methods, public tools, protected tools, resources, prompts, trace headers, and the PLATPHORM_API_KEY boundary.", "realWorldView": "Read tools/list and resources/list first. Confirm whether a tool is public read-only or protected before designing any workflow.", "aha": "Tool discovery comes before tool execution.", "fieldMove": "Inspect a tool list and flag which names sound mutating before reading the protected list.", "safeBoundary": "Do not call sync, refresh, ingestion, reporting, or policy-update tools unless authorized and key-gated.", "entryIds": [ "tool-dry-run", "human-approval-queue" ] }, { "id": "openapi-contract", "title": "OpenAPI is the menu with ingredients listed", "surface": "/api/docs and /openapi.yaml", "sourceUrl": "https://platphormnews.com/api/docs", "plainLanguage": "An API doc is a menu. It tells you what you can ask for, what parameters it accepts, and what shape the answer should have.", "operator": "The root API documentation covers stories, search, sources, network APIs, network MCP, evidence, trustops, searchops, agentops, public contract, feeds, and discovery routes.", "realWorldView": "A contract lets you test behavior without guessing. You can verify route shape, auth requirements, and public-safe responses.", "aha": "Guessing endpoint behavior is amateur hour; reading the contract is how experts move fast safely.", "fieldMove": "Pick one endpoint and predict query params, success shape, and protected boundary before calling it.", "safeBoundary": "Use read-only endpoints for practice. Treat POST, sync, ingestion, and reporting routes as protected unless explicitly documented otherwise.", "entryIds": [ "schema-first-output", "socratic-eval-prompts" ] }, { "id": "jsonld-identity", "title": "JSON-LD is the site's ID card", "surface": "Homepage JSON-LD", "sourceUrl": "https://platphormnews.com", "plainLanguage": "JSON-LD is structured data that tells search engines and agents who the site is, what it publishes, and what actions it supports.", "operator": "The root homepage publishes organization, website search action, navigation, and FAQ structured data for public identity and discoverability.", "realWorldView": "Structured data is a claim surface. Compare it with live routes and policies to catch stale identity, stale navigation, or unsafe promises.", "aha": "A page can speak to humans in HTML and to machines in JSON-LD at the same time.", "fieldMove": "Find one human sentence and one JSON-LD claim that should agree.", "safeBoundary": "Do not treat structured data as secret or authority by itself; verify with the corresponding public route.", "entryIds": [ "receipts", "citation-triangulation" ] }, { "id": "rss-sitemap", "title": "RSS tells what changed; sitemaps tell what exists", "surface": "RSS, Atom, sitemap, sitemap index", "sourceUrl": "https://platphormnews.com/rss.xml", "plainLanguage": "RSS is the update stream. A sitemap is the table of contents. Together they help people and machines find new and existing pages.", "operator": "The root publishes RSS/feed/Atom and several sitemap variants, including network and full sitemap surfaces, with robots pointers.", "realWorldView": "Feeds and sitemaps are low-risk coverage tools. They reveal intended public pages without probing private paths.", "aha": "The public site tells you where to look if you start with the sitemap instead of guessing.", "fieldMove": "Compare one RSS item with one sitemap URL and name which question each file answers.", "safeBoundary": "Use published sitemaps instead of brute-force path discovery.", "entryIds": [ "retrieval-relevance", "misconception-map" ] }, { "id": "agent-policy", "title": "Agent policy tells bots how to behave", "surface": ".well-known/agent-policy.json", "sourceUrl": "https://platphormnews.com/.well-known/agent-policy.json", "plainLanguage": "Agent policy is the operating boundary for AI clients: what they can read, what needs a key, and what data must stay private.", "operator": "The root policy names public access surfaces, supported client classes, PLATPHORM_API_KEY requirements, trace propagation, JA4 redaction, and no-private-data rules.", "realWorldView": "Before running any automated inspection, prove your agent obeys the policy and can stop at protected boundaries.", "aha": "A well-behaved agent is safer because it knows where not to go.", "fieldMove": "Design a crawler that can explain why it skipped a protected path.", "safeBoundary": "No secrets, cookies, raw IP addresses, raw JA4 digests, private traces, or private audit details in public reports.", "entryIds": [ "abstention-design", "notes-as-observation-log" ] }, { "id": "trace-context", "title": "Trace headers are the breadcrumb trail", "surface": "MCP manifest and agent policy trace fields", "sourceUrl": "https://platphormnews.com/.well-known/agent-policy.json", "plainLanguage": "Trace headers are like numbered sticky notes that help you follow one request as it moves between services.", "operator": "Root policy accepts traceparent, tracestate, X-PlatPhorm-Trace-Id, and propagates safe PlatPhorm trace/request/source/target headers.", "realWorldView": "Traceability helps debug cross-site behavior, but secret baggage must never ride along.", "aha": "Observability is useful only when it does not leak the thing it observes.", "fieldMove": "Draw a three-service request path and label which trace fields travel forward.", "safeBoundary": "Never put authorization, API keys, cookies, session tokens, or raw private payloads into trace state or baggage.", "entryIds": [ "memory-hygiene", "integration-contract-cards" ] }, { "id": "source-backed-status", "title": "Status should say how it knows", "surface": "Network graph and compliance payloads", "sourceUrl": "https://platphormnews.com/api/network/graph", "plainLanguage": "A status card is better when it tells you where the number came from, not just whether it is green.", "operator": "Root discovery surfaces label sources such as static manifest, MCP registry, sitemap index, declared route spec, stale markers, confidence, and checkedAt timestamps.", "realWorldView": "Source labels let you separate current evidence from stale, degraded, inferred, or declared-only status.", "aha": "Green without evidence is decoration. Green with source and time is operational signal.", "fieldMove": "Compare two green statuses and decide which one has enough evidence to trust.", "safeBoundary": "Do not convert degraded or declared-only status into a claim of live success.", "entryIds": [ "confidence-buckets", "dictionary-provenance-check" ] } ], "skillRampLevels": [ { "id": "level-1", "label": "First-pass reader", "readerCan": "Explain the difference between public read, protected action, and private data.", "practice": "Sort routes from robots.txt into safe-to-read and stop-sign groups." }, { "id": "level-2", "label": "Careful operator", "readerCan": "Use sitemaps, RSS, llms files, OpenAPI, and JSON-LD to inspect a site without guessing.", "practice": "Build a source-backed checklist for one public surface." }, { "id": "level-3", "label": "Agent workflow designer", "readerCan": "Read MCP tools/resources/prompts and design a public-safe workflow with explicit stop states.", "practice": "Write a dry-run plan for a read-only MCP inspection." }, { "id": "level-4", "label": "Real-world operator", "readerCan": "Audit public automation behavior while respecting trust policy, robots policy, auth boundaries, trace redaction, and no-secret rules.", "practice": "Produce a report that says what was inspected, what was skipped, why it was skipped, and what evidence supports each conclusion." } ], "policy": "These tips teach public-safe inspection and careful automation. They do not authorize private probing, credential testing, destructive actions, or protected workflow execution." } }