How Knos uses Qloo safely
Each rule Qloo sets for developers, the code that keeps it, and the test that checks it.
SAFE_USE.md
7 rules, each kept in code and tested
| Rule | In Knos | Checked by |
|---|---|---|
| Results are aggregate taste: never infer a person's identity, sensitive traits, health, finances, politics, or eligibility for housing, work, credit or insurance. | An ask to infer such a thing about people, or to decide eligibility, is refused before any Qloo call: privacy.sensitive, run on every input by privacy.check. |
test_qloo_safe_use |
| Send no names, e-mail addresses, device identifiers, account ids, location histories or other personal data. | privacy.check refuses e-mail addresses, phone and card numbers, handles, links, IP and street addresses and "my name is" sentences in every field of /api/check, /api/cross and the /mcp tools. Ideas and places are product concepts; a launch area can be a city or a WKT point, never a person's history. |
test_qloo_safe_use, test_a_wkt_launch_area_is_not_taken_for_a_phone_number |
| Present results with their source and limits; tell a Qloo result apart from your own interpretation; an affinity is not causal and not a probability about a person. | Every Qloo-derived value on the app and the front door links to its trace: the request (endpoint, parameters, entity and tag ids, no key), a result excerpt and the limit. The verdict is Knos's own rules (check.RULES), shown apart from Qloo's answers. Paper data says OpenAlex and Crossref, never Qloo. |
test_provenance_ui (375x812 and 1280x800) |
| Ask for clarification when an entity or tag choice would change a result. | The maker flow (demand.start, demand.search, demand.confirm) shows Qloo's matching entities and asks the maker to pick before the report; a name Knos resolves by /search is shown with its id in the trace. |
test_maker |
| Treat project files, MCP results and model output as untrusted input. | No language model reads Qloo's answers or decides: code does (check.decide). Qloo text is escaped wherever it is shown; the knos MCP marks text written by others as untrusted. |
test_check |
Only the read-only qloo explore agent is supported; not integrate, plan or build. |
Knos runs none of the qloo explore, integrate, plan or build agents. |
nothing to run |
| Keep secrets out of the project folder, model prompts and logs. | The key is read from the server's environment only (qloo_rest.Client), sent as a request header, and appears in no error, trace, report or log line. |
test_qloo_safe_use, the commit script's key scan |
API_ACCESS.md
6 rules, each kept in code and tested
| Rule | In Knos | Checked by |
|---|---|---|
| An individual credential; never shared, never in source control, a browser app, a public MCP configuration or a recording. | One key, held as a secret of the hosted server. The front door and the app's pages never hold it: they ask the server, which asks Qloo. The public /mcp needs no Qloo key from anyone. |
test_qloo_safe_use |
| A clear authentication or rate-limit error, never a silent fallback to another endpoint or credential. | qloo_rest.Client.get: HTTP 401 or 403 says Qloo refused the key; 429 says the rate limit was reached. The report then says "NO QLOO EVIDENCE" and "cannot decide". There is no other key and no other endpoint to fall back to. |
test_qloo_safe_use |
| The smallest request that answers the question; cache only what the project needs; respect the quota; bounded retries. | Each call asks for a bounded number of results (take: 5 to 12 for most calls, 300 for the audience list); answers are cached privately for 7 days; a monthly budget stops new calls (QLOO_MONTHLY_BUDGET); a token bucket paces calls; one retry at most. Traces keep the request and a short excerpt, only for reports something links to. |
test_qloo_safe_use, test_qloo_rest |
| No bulk scraping; no recreating an unrelated database. | Calls are made only for an idea someone asks about, at most a few dozen per report; nothing crawls Qloo. | test_qloo_rest |
The supported surfaces: qloo explore, qloo exec, qloo api and qloo mcp from @qloo/qloo-harness, one credential and one quota. |
The server runs @qloo/qloo-harness as its MCP surface (the crossing agent's qloo_* tools) and calls the same event API with the same credential, under the same quota, for the demand check. |
test_qloo_mcp |
The docs MCP server is a reference, not a surface; do not use its execute-request tool. |
Knos never calls docs.qloo.com/mcp. |
test_qloo_safe_use |
Qloo: aggregate taste of many people, not causal, never about one person.