Every lamp

A database the agent can read and cannot damage: one statement, SELECT/WITH/EXPLAIN only, no write verbs, LIMIT enforced, SQLite opened read-only at the driver. SQLite files and Postgres/MySQL URLs. Connect with one line in the project's ./.env — LAMP_DB=… — written by the human; the value never comes back through lamp.

Read the history, never rewrite it: status, log, diff, show, blame, branches. A caller value can never become a flag; there is no push or reset because there is no way to express them.

Fetch from an allowlist of hosts and get text back, not markup: HTML reduced to readable text, JSON narrowed to a dotted path, everything clipped. Twelve hosts by default; one line to add another.

A shell with a ceiling. Runs one command, without a shell, only if a human-written policy allows it; destructive operations are refused before anything runs, and the refusal comes back as data.

Outdated, deprecated and vulnerable dependencies in package.json, in as few tokens as possible. Reads the project, asks the registry only its small endpoints, never runs npm.

Find, validate and read agent skills (SKILL.md folders) before an agent loads them: frontmatter contract, name/folder match, size, broken references. Read one section at a time.