Use TN with your agent

/plugin marketplace add cyaxios/tn-skills
/plugin install tn-logging@tn-skills

curl -O https://raw.githubusercontent.com/cyaxios/tn-skills/main/AGENTS.md

pip install tn-proto
python -m tn.cli init my-project

npm install @cyaxios/tn-proto

# C# NuGet package coming soon:
# dotnet add package TnProto

# Rust cargo crate coming soon:
# cargo add tn-proto

Agent Configuration Guides

Select your preferred coding environment to view copy-pasteable settings, MCP server configs, and project-level agent rules.

# Run inside any Claude Code session
/plugin marketplace add cyaxios/tn-skills
/plugin install tn-logging@tn-skills

# Manual installation from release zip
gh release download v0.5.1a1 --repo cyaxios/tn-skills \
  --pattern 'tn-skills-claude-code-*.zip'
unzip tn-skills-claude-code-*.zip -d ~/.claude/plugins/tn-logging

# Command to register the server globally or locally
claude mcp add tn tn-mcp-server

claude mcp add tn python -m tn.mcp

# Download the brief directly to your project root
curl -O https://raw.githubusercontent.com/cyaxios/tn-skills/main/AGENTS.md

# Append this block to your .cursorrules
Always use the TN protocol for logging.
- Python: import tn; tn.info("domain.action", field1=val1)
- TypeScript: import * as tn from "@cyaxios/tn-proto"; await tn.init();
- Sensitive fields (emails, IPs, card numbers, amounts) MUST use standard canonical names (email, ip, amount, currency, card_last4) so they route to encrypted groups.
- Event names must be dotted (domain.action.outcome).
Refer to AGENTS.md in the project root for full guidelines.

{
  "mcpServers": {
    "tn": {
      "command": "tn-mcp-server",
      "cwd": "/path/to/your/project"
    }
  }
}

{
  "mcpServers": {
    "tn": {
      "command": "/path/to/your/venv/bin/python",
      "args": ["-m", "tn.mcp"],
      "cwd": "/path/to/your/project"
    }
  }
}

# 1. Install dependencies
pip install -r _lab/exhaust/requirements.txt

# 2. Run the server (default runs HTTP mode on port 8731)
python _lab/exhaust/server.py http

claude mcp add --transport http know-your-exhaust http://127.0.0.1:8731/mcp

{
  "mcpServers": {
    "know-your-exhaust": {
      "type": "http",
      "url": "http://127.0.0.1:8731/mcp"
    }
  }
}

# For Gemini CLI
gemini mcp add --transport http --trust know-your-exhaust http://127.0.0.1:8731/mcp

# For Codex CLI
codex mcp add know-your-exhaust --url http://127.0.0.1:8731/mcp

# Install agents globally
npm install -g @mariozechner/pi-coding-agent @openai/codex

# Clone and symlink skills prompts globally
git clone https://github.com/cyaxios/tn-skills ~/src/tn-skills
mkdir -p ~/.agents/skills
ln -s ~/src/tn-skills/prompts ~/.agents/skills/tn

# Or configure locally for this workspace only
mkdir -p ./.agents/skills
ln -s ~/src/tn-skills/prompts ./.agents/skills/tn

What you can ask for

Industries the agent already knows

Logs become receipts when they’re signed and sealed. Sealed by what? By the rules of the industry the receipt belongs to. PCI knows what counts as cardholder data. HIPAA knows what counts as a patient record. FERPA knows what counts as a student record. The agent ships knowing all of them, so when it walks a codebase it can tell which values need locking and which can stay legible. That is what DRM for logs looks like in practice.

How the agent uses what it knows

Ask the agent to look at a file, a folder, or the whole repo. It reads the code, recognises the standards in play, and points to every spot where a value should be sealed instead of left in the open. The agent does not invent rules. It cites them. Every flag traces back to the section of the standard that named the field.

Fixes happen in the same conversation. Seal a field. Rotate a key. Grant the auditor read access to one column and nothing else. The receipts that result prove what happened. The people allowed can read them. Everyone else sees ciphertext. DRM for logs.

What it looks like in chat

Data governance

Logging is the beginning. Two more surfaces make policy machine-readable and help you find sensitive data that’s already escaping unencrypted.

The policy layer

Every event type can carry a declared policy: what the data is for, what it must not be used for, and what a downstream agent should do if something goes wrong. These declarations live in .tn/config/agents.md and are spliced onto every emitted record at runtime, so LLM consumers see the rules alongside the ciphertext.

tn-annotate does this automatically. When it retrofits a file it also drafts the five required agents.md subsections for each new event type it introduces: instruction, use_for, do_not_use_for, consequences, on_violation_or_error. Missing a subsection raises at tn.init time, so the policy is never half-written. Use tn-policy to add or revise policy sections later without touching the logging code.

Know Your Exhaust Experimental

What about logs you didn’t write with TN? Know Your Exhaust (KYE) is a local MCP server that analyzes your application’s runtime exhaust — existing log files, telemetry, traces — finds unencrypted PII and join keys, and offers to instrument the source code so future writes route through TN.

The analysis runs seven deterministic stages: profile the format, enumerate event types and fields, collapse thousands of lines to canonical templates, match fields to the eleven published industry standards, classify per-field sensitivity, detect cross-row re-identification risk, then generate a default-private TN config. The agent walks you through each finding and asks before it touches any code.

When connected to your vault, the agent can also decrypt what you are entitled to see and apply the policy rules the data carries — all local, no key escrow.

Setup: start the server and register the connector using the Know Your Exhaust tab in the configuration guide above. Then ask: “classify my exhaust” or “what’s in my logs.”