Set up the Forgetful CLI and connect from a terminal — install, local or remote mode, auth, and verification. Use when connecting a human or headless agent via shell, wiring CI with token auth, or operating a local server (serve, database selection, feature flags, re-embedding). Also covers the machine contract…
Set up an MCP client for Forgetful — wire Claude Code, Cursor, Copilot, Codex, Gemini, or OpenCode to the server and verify the connection behaves. Covers stdio vs HTTP transport, auth and scopes, the three meta-tools every client sees, and delegation to subagents.
Use when configuring a FrontMCP server through frontmcp.config or the @FrontMcp options. Covers auth modes (public, transparent, local, remote), OAuth plus credential vault and secureStore, CORS, HTTP port / entry-path prefix / unix socket, security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options), rate…
Create temporary email inboxes and receive emails for testing auth flows, email verification, account confirmation, and any scenario where an AI agent needs to receive an email. Uses the agent-inbox MCP server with mail.tm + 1secmail fallback.
Use when building, changing, or deploying an instancez backend - editing instancez.yaml (tables, RLS, auth, storage, rpc, functions), running the inz CLI, or debugging why a query is denied. instancez is a single-binary Supabase-compatible backend defined by one YAML file.
Implements and reviews OAuth 2.0/2.1 flows following RFC 6749, RFC 9700 (BCP), and PKCE (RFC 7636). Use when implementing authorization code flow, token handling, client registration, or securing OAuth endpoints.
Fastify usage for QAuth — plugin authoring (encapsulation, decorators, lifecycle), route schemas with the Zod type provider, production/reverse-proxy setup, and the Fastify version/CVE requirement. Use when adding or modifying @qauth-labs/fastify-plugin- libraries, auth-server routes, or deployment config.
Database schema rules for QAuth. Use when working with the identity model, Drizzle ORM, migrations, repositories, or claim resolution. Reflects the CURRENT shipped schema — the identifier-abstraction model (ADR-002, IMPLEMENTED via Epic.
Use when building or modifying authentication in a FastAPI app with crudauth (the crudauth PyPI package) — covers CRUDAuth, the AuthUserMixin / makeauthidentity user model, IdentityConfig, currentuser(...) gates, session + bearer transports, OAuth (Google/GitHub), email verification / password reset / change, custom…
Add Firebase Authentication (Phone SMS OTP, Google Sign-In, Email/Password) to a Better Auth app using the better-auth-firebase-auth plugin. Use when adding phone authentication to Better Auth without Twilio, integrating Firebase Auth with Better Auth sessions, working with the better-auth-firebase-auth package, or…
Map and attack the authentication, authorization, session, tenant, federation, and machine-identity boundaries of a system, proving whether access controls actually hold rather than whether they appear to. Use whenever work touches login, sessions, tokens, roles, permissions, multi-tenancy, password reset…
Reproduce, isolate, and diagnose a specific software failure before changing production behaviour, then propose the smallest safe fix with regression protection. Use whenever the user reports a bug, crash, error, stack trace, flaky test, incorrect output, "works on my machine," intermittent failure, regression after a…
🧩 Codex Skill — Refresh Codex CLI auth.json from ChatGPT. Skipphone verification, no overseas number needed. For users behind firewalls, in WSL, or remote desktop.
Authenticate single-page apps in Fermi browser sessions by injecting tokens into localStorage AND document.cookie, with secret resolution in evaluate/setCookies.