TAC CLI local checks

Verify TAC voice-memory access before an AI client reads anything.

The local `tac-mcp` binary checks env readiness, generates redacted client config, and runs governance preflight for approved Claude Desktop, OpenClaw, Codex, or RasBaraka profiles.

Copy CLI checks Review governance preflight

This is not a globally published @tac/cli product yet. It is the local CLI that ships with the TAC MCP package and stays credential-redacted by default.

Talk and Comment voice feedback interface preview

$ tac-mcp --doctor --json
{
  "ok": true,
  "env": { "ok": true },
  "protocol": {
    "ok": true,
    "apiRequests": 0
  }
}

Local setup

Run the checks before connecting a client.

Use a private env file for TAC session values, then run doctor and client-config checks. The commands report variable names and readiness state, not raw token values.

1. Private file

Keep credentials out of client JSON

Create the file locally after an operator approves the TAC profile. Shell variables still override file values when you need a temporary local override.

mkdir -p ~/.config/tac
chmod 700 ~/.config/tac
cat > ~/.config/tac/mcp.env <<'EOF'
TAC_MCP_BASE_URL=https://talkandcomment.com
TAC_MCP_USER_HASH=your-user-hash
TAC_MCP_ACCESS_TOKEN=your-devise-token
TAC_MCP_CLIENT=your-devise-client
[email protected]
EOF
chmod 600 ~/.config/tac/mcp.env

2. Readiness

Check setup without API calls

Doctor exercises local MCP protocol shape and records `apiRequests=0`, so CoS or RasBaraka can prove the client package is ready before using live TAC data.

pnpm --filter @tac/mcp-server build
tac-mcp --tac-env-file ~/.config/tac/mcp.env --check-env --json
tac-mcp --tac-env-file ~/.config/tac/mcp.env --doctor --json
tac-mcp --print-client-config --tac-env-file ~/.config/tac/mcp.env

What the CLI does now

Four checks that make MCP setup repeatable.

--check-env

Readiness output

Shows required TAC_MCP_* variable names and missing/ready status without printing credential values.

--doctor

Protocol smoke

Runs local initialize, tools, resources, and templates checks without TAC API requests.

--print-client-config

Client bootstrap

Generates a redacted stdio config for approved local MCP clients.

--tac-env-file

Private profile path

Keeps credentials in a local file and out of copied client snippets.

Governance preflight

Evaluate access intent before memory reads.

District and agent workflows can evaluate a local governance context before enabling memory tools. This is a no-network policy check; production decision receipts live in the Rails governance API.

Set TAC_MCP_REQUIRE_GOVERNANCE_CONTEXT=true when memory tools must fail closed unless an approved governance context is present.

Copyable preflight

Transcript read, then export review packet

cat > governance-context.json <<'JSON'
{
  "governance_context": {
    "agent_id": "ag.openai.codex.local",
    "sponsoring_human_id": "usr.teacher.demo",
    "purpose_statement": "Review one approved TAC transcript before drafting teacher feedback.",
    "record_scope": "single",
    "field_scope": "profile-based",
    "cadence": "one-time",
    "effect": "view-only",
    "autonomy_mode": "human-approved",
    "retention": "ephemeral",
    "downstream_sharing": "none",
    "human_review_point": "teacher_before_send"
  }
}
JSON

tac-mcp --evaluate-intent mcp.tac.transcript.v1 --governance-context-file ./governance-context.json --tenant-id district.demo
tac-mcp --prepare-request mcp.tac.export.v1 --governance-context-file ./governance-context.json

Now

Local CLI shipped with MCP

Redacted setup diagnostics for local operators and automation.
Private env-file support for approved client profiles.
No-network governance decisions and review-packet preparation.

Not yet

Future public CLI product

No global `npm install -g @tac/cli` claim until the productized CLI exists.
No remote OAuth MCP claim until the approved auth path is live.
No school or student data should enter an unapproved AI client.

Need the actual MCP client surface?

Use `/mcp` for local server setup, example prompts, current tool coverage, and the repo guide.

Open MCP setup Inspect REST API Open CLI guide