Lightpaper — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Lightpaper (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Permanent knowledge. Beautifully shared. Discoverable by everyone.
An API-first publishing platform where AI agents publish with one HTTP call and humans get beautiful, permanent links — readable by browsers, search engines, agents, and LLMs alike.
There is no frontend. No editor. No WYSIWYG. Just an API.
curl -X POST https://lightpaper.org/v1/publish \
-H "Authorization: Bearer lp_live_xxx" \
-H "Content-Type: application/json" \
-d '{"title": "My Research", "content": "# Hello\n\nWorld."}'Response:
{
"url": "https://lightpaper.org/my-research",
"permanent_url": "https://lightpaper.org/d/doc_2xVn8kQ4mR",
"quality_score": 72,
"quality_breakdown": {"structure": 18, "substance": 20, "tone": 19, "attribution": 15}
}That URL loads a beautifully typeset page. Perfect OG preview on LinkedIn, X, Slack, email. The URL works forever. Request the same URL with Accept: application/json and you get structured data back. An LLM can read llms.txt at the root to understand the entire platform.
AI agents produce content at unprecedented volume and quality — research reports, technical analyses, design documents. Today, that content dies in chat windows or markdown files. lightpaper.org gives it a permanent, beautiful, discoverable home.
| Document | Description |
|---|---|
| API_DESIGN.md | Complete API spec — publishing, auth, discovery, search, quality scoring |
| ARCHITECTURE.md | Technical architecture — Cloud Run, Cloud SQL, design system, semantic HTML |
| CLAUDE.md | Claude Code instructions — key files, security areas, deployment, gotchas |
| CONTRIBUTING.md | Development setup and contribution guidelines |
| SECURITY.md | Vulnerability reporting |
No platform today addresses all five:
How will agents find the API? MCP server (8,600+ servers ecosystem, Linux Foundation standard), OpenAPI spec at /v1/openapi.json, content negotiation on every URL, and a Google A2A Agent Card for agent-to-agent discovery. llms.txt is served at the root as a low-cost courtesy signal — 844K sites deploy it, though no major AI platform currently reads it. /.well-known/ai-plugin.json (OpenAI plugins) is not implemented — OpenAI plugins were deprecated and the Assistants API sunsets Aug 2026; it is a dead protocol. Agents that have never heard of lightpaper.org can discover and use it through MCP, OpenAPI, and A2A.
API keys are fragile. lightpaper.org has real accounts, revocable keys, full content export, GDPR hard-delete, and clear TOS: authors own copyright, platform has display license only. Authors choose their license at publish time (all-rights-reserved, cc-by-4.0, cc-by-sa-4.0, cc-by-nc-4.0, cc-by-nc-sa-4.0, cc0). Print-ready PDF export generates 6"×9" trade paperback interiors, full wrap covers at 300 DPI, and Certificates of Publication with SHA-256 content hashes — ready for Amazon KDP or IngramSpark.
Not just publishing — finding. Search API from day one (GET /v1/search?q=&tags=), auto-generated sitemap.xml, JSON-LD on every page, tag browsing, author pages, RSS feeds. robots.txt welcomes all crawlers.
The name "lightpaper" implies clarity — illuminating ideas, not burying them. Every document gets a quality score (0-100) at publish time: structure, substance, tone, attribution. Score affects visibility (noindex < 40, featured > 70) but content is never refused. Transparent feedback helps authors improve.
Every document requires a human account. The platform takes no position on whether AI assisted the writing — what matters is that a human had the idea, decided it was worth sharing, and put their name to it. That accountability is the strongest spam filter that exists.
Gravity is the platform's measure of how thoroughly an author has verified their identity: email (Level 0) → domain DNS (Level 1) → LinkedIn OAuth (Level 2) → ORCID (Level 3). Gravity affects search ranking (1.0×–1.4× multiplier) and featured eligibility threshold. Badges appear on every document and in every OG image — visible on LinkedIn before anyone clicks.
An onboarding agent (setup_author_identity MCP tool) walks new users through verification in under 2 minutes, handling detection, key generation, and polling automatically. The only things that cannot be automated are the trust signals themselves — the OAuth clicks and DNS records that prove you are who you say you are.
# Clone and start
git clone https://github.com/lightpaperorg/lightpaper.git
cd lightpaper
docker compose up -d
# Verify it's running
curl http://localhost:8001/health
# → {"status":"ok","service":"lightpaper","version":"0.1.0"}
# Create an account (sends OTP to your email)
curl -X POST http://localhost:8001/v1/auth/email \
-H "Content-Type: application/json" \
-d '{"email":"[email protected]","display_name":"Your Name","handle":"yourhandle"}'
# Verify OTP code (returns API key)
curl -X POST http://localhost:8001/v1/auth/verify \
-H "Content-Type: application/json" \
-d '{"session_id":"SESSION_ID_FROM_ABOVE","code":"123456"}'
# Publish a document (requires API key)
curl -X POST http://localhost:8001/v1/publish \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"title":"Hello World","content":"# Hello\n\nThis is a test document."}'# Virtual environment setup
python -m venv .venv
source .venv/bin/activate
pip install -r requirements-dev.txt
# Copy env and start database
cp .env.example .env
docker compose up -d db
# Run with hot reload
uvicorn app.main:app --host 0.0.0.0 --port 8001 --reloadpython -m pytest tests/ -v # All tests
python -m pytest tests/test_quality.py -v # Quality scoring
python -m pytest tests/test_renderer.py -v # XSS sanitization
python -m pytest tests/test_security.py -v # Security regressionlightpaper/
├── app/ # FastAPI application
│ ├── main.py # App init, middleware, route mounting
│ ├── config.py # Environment-based settings
│ ├── auth.py # Firebase + API key authentication
│ ├── models.py # SQLAlchemy ORM models
│ ├── schemas.py # Pydantic request/response schemas
│ ├── rate_limit.py # slowapi limiter singleton
│ ├── utils.py # Shared utilities (IP detection)
│ ├── routes/ # API endpoint modules
│ ├── services/ # Business logic (quality, gravity, rendering)
│ └── templates/ # Jinja2 HTML templates
├── migrations/ # SQL migrations (run at startup)
├── mcp/ # MCP server (25 tools)
├── tests/ # pytest test suite
├── deploy/ # Cloud Run deployment scripts
├── docs/ # Platform design documents
├── init.sql # Database schema
├── docker-compose.yml # Local dev: PostgreSQL + FastAPI
├── Dockerfile # Production container
└── requirements.txt # Python dependencies| Variable | Description | Default |
|---|---|---|
DATABASE_URL | PostgreSQL async connection string | postgresql+asyncpg://lightpaper:lightpaper_dev@localhost:5433/lightpaper |
FIREBASE_PROJECT_ID | Firebase project for legacy auth | (none) |
RESEND_API_KEY | Resend API key for OTP emails | (none) |
LINKEDIN_CLIENT_ID | LinkedIn OAuth app client ID | (none) |
LINKEDIN_CLIENT_SECRET | LinkedIn OAuth app client secret | (none) |
BASE_URL | Public-facing base URL | http://localhost:8001 |
CORS_ORIGINS | Comma-separated allowed origins | http://localhost:3000,https://lightpaper.org |
Deployed on Google Cloud Run with Cloud SQL PostgreSQL:
bash deploy/deploy-cloud-run.shSee CONTRIBUTING.md for development setup and SECURITY.md for vulnerability reporting.
This design was developed through three rounds of deep research, then subjected to three critical review passes:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.