Add commands

Document kcmshell6 (tldr) plus soup, cmcp, listnr, swiftlet, and semsearch from Hacker News.

Author: SimonSchubert

assets/commands/cmcp.md

@@ -0,0 +1,85 @@
+# TAGLINE
+
+Confidential MCP gateway with TEE-backed policy enforcement
+
+# TLDR
+
+**Install** the runtime
+
+```pip install cmcp-runtime```
+
+**Validate** config and policy bundle before starting
+
+```cmcp validate-config --config cmcp-config.yaml```
+
+```cmcp validate-bundle --bundle-path ./policies --expected-hash sha256:[hex]```
+
+**Start** the gateway in software / dev mode (no hardware TEE)
+
+```CMCP_DEV_MODE=1 cmcp start --config cmcp-config.yaml```
+
+**Verify** a signed TRACE claim file
+
+```cmcp verify claim.json```
+
+**Verify** with pinned policy and catalog hashes
+
+```cmcp verify claim.json --policy-hash sha256:[hex] --catalog-hash sha256:[hex]```
+
+# SYNOPSIS
+
+**cmcp** _command_ [_options_]
+
+# PARAMETERS
+
+**start** **--config** _path_
+> Start the cMCP gateway using the given YAML config. Listens for MCP-style tool calls, evaluates each against a Cedar policy bundle, and records a hardware-sealed (or software-signed in dev mode) audit chain.
+
+**validate-config** **--config** _path_
+> Parse and validate **cmcp-config.yaml** without starting the server.
+
+**validate-bundle** **--bundle-path** _path_ **--expected-hash** **sha256:**_hex_
+> Verify that a Cedar policy bundle directory matches an expected SHA-256 before deploy.
+
+**verify** _claim_file_ [**--policy-hash** _h_] [**--catalog-hash** _h_] [**--max-age** _s_] [**--trusted-key** _path_] [**--audit-bundle** _path_] ...
+> Offline verification of a TRACE / GatewayClaim: signature, schema, freshness, audit chain, and optional pinned hashes. Does not require trusting the operator who produced the claim.
+
+# DESCRIPTION
+
+**cmcp** is the CLI for **cMCP (Confidential MCP Runtime)**, an open-source gateway that sits between AI agents and MCP tools. Every **tools/call** is intercepted, evaluated against a **Cedar** policy bundle inside a policy engine intended to run in a **Trusted Execution Environment (TEE)**, then allowed, denied, or redacted. Sessions emit a signed **TRACE Claim** (GatewayClaim) that records which tools ran, which policy decided each call, the policy bundle hash measured at startup, and a hash-chained audit log.
+
+Supported attestation providers include **TPM 2.0 / vTPM**, **AMD SEV-SNP**, and **Intel TDX** (with NVIDIA GPU confidential computing on the roadmap). When no hardware TEE is present, **CMCP_DEV_MODE=1** enables a software-only provider for local development; production starts should omit that flag so the gateway refuses to run without attestation hardware.
+
+Typical config (**cmcp-config.yaml**) sets **attestation.provider** (**auto** or a specific provider), **enforcement_mode** (**enforcing**, **advisory**, or **silent**), **policy_bundle_path**, **catalog_path**, and **listen_addr**. Agents send JSON-RPC tool calls to the gateway HTTP endpoint instead of directly to upstream MCP servers.
+
+# CONFIGURATION
+
+**cmcp-config.yaml** (path required by **start** and **validate-config**). Important keys: **attestation.provider**, **attestation.enforcement_mode**, **policy_bundle_path** (directory of **.cedar** files plus **manifest.json**), **catalog_path** (approved tool catalog JSON), **listen_addr**.
+
+Environment:
+
+- **CMCP_DEV_MODE=1** — software-only TEE; no hardware required
+- **CMCP_BEARER_TOKEN** — require this bearer token on inbound requests (needed beyond loopback in tokenless setups)
+- **OPAQUE_ATTESTATION_URL** — opt-in OPAQUE managed runtime (placeholder / not fully implemented)
+
+# CAVEATS
+
+Developer preview: APIs and claim shapes may change before 1.0. **CMCP_DEV_MODE** claims verify only as partially_verified (no hardware attestation). Enforcement defaults to **enforcing** (HTTP 403 on deny). Running without a bearer token is intended for loopback only. Requires **Python 3.11+**. Residual risks and scope limits are documented in the project's **LIMITATIONS.md**.
+
+# HISTORY
+
+**cMCP** is maintained by **AgenTrust** under the MIT license. It was launched as a developer preview around the Confidential Computing Summit (2026) with PyPI package **cmcp-runtime**.
+
+# SEE ALSO
+
+[curl](/man/curl)(1), [pip](/man/pip)(1)
+
+# RESOURCES
+
+```[Source code](https://github.com/agentrust-io/cmcp)```
+
+```[Homepage](https://github.com/agentrust-io/cmcp)```
+
+```[Documentation](https://github.com/agentrust-io/cmcp/tree/main/docs)```
+
+<!-- verified: 2026-08-04 -->

assets/commands/index.txt

@@ -1263,6 +1263,7 @@ clx.md
 cmake.md
 cmark.md
 cmatrix.md
+cmcp.md
 cmctl.md
 cmd-wrapped.md
 cmdperf.md
@@ -3863,6 +3864,7 @@ kb.md
 kbt.md
 kcadm.sh.md
 kcat.md
+kcmshell6.md
 kdash.md
 kde-builder.md
 kde-inhibit.md
@@ -4183,6 +4185,7 @@ linux32.md
 linux64.md
 liquidctl.md
 lispmtopgm.md
+listnr.md
 lit.md
 litecli.md
 littler.md
@@ -7073,6 +7076,7 @@ semanage.md
 semantic-release.md
 semgrep.md
 semodule.md
+semsearch.md
 semtools.md
 semver.md
 sen.md
@@ -7304,6 +7308,7 @@ sort.md
 sot.md
 sou.md
 soundscope.md
+soup.md
 soupault.md
 source-highlight.md
 sox.md
@@ -7521,6 +7526,7 @@ swaynag.md
 swc.md
 swift.md
 swiftc.md
+swiftlet.md
 swig.md
 swipl.md
 switch_root.md

assets/commands/kcmshell6.md

@@ -0,0 +1,101 @@
+# TAGLINE
+
+Open a single KDE Plasma 6 system settings module
+
+# TLDR
+
+**List** all available KCM modules
+
+```kcmshell6 --list```
+
+Open the **display / screen** settings module
+
+```kcmshell6 kcm_kscreen```
+
+Open **network** settings
+
+```kcmshell6 kcm_networkmanagement```
+
+Open several modules in one dialog
+
+```kcmshell6 kcm_fonts kcm_style```
+
+Open a module with a custom **window title** and **icon**
+
+```kcmshell6 kcm_keyboard --caption "[Keyboard]" --icon preferences-desktop-keyboard```
+
+Show **indicators** for settings that differ from defaults
+
+```kcmshell6 kcm_fonts --highlight```
+
+Pass **arguments** through to a module
+
+```kcmshell6 kcm_kwinrules --args "[window-class]"```
+
+# SYNOPSIS
+
+**kcmshell6** [**--list**] [**--args** _arguments_] [**--icon** _icon_] [**--caption** _caption_] [**--highlight**] _module_...
+
+# PARAMETERS
+
+**--list**
+> List all discoverable KCM (KDE Control Module) plugin IDs with short descriptions, then exit.
+
+_module_
+> One or more configuration modules to open. IDs may be given as the full plugin id (for example **kcm_fonts**), or as a short name that **kcmshell6** expands by trying **kcm_**_name_ and **kcm**_name_. Multiple modules open in a list-style dialog.
+
+**--args** _arguments_
+> Space-separated arguments forwarded to the module (parsed like a shell command line).
+
+**--icon** _icon_
+> Theme icon name for the dialog window. Defaults to the module's own icon.
+
+**--caption** _caption_
+> Custom window title. For a single module without this option, the module name is used.
+
+**--highlight**
+> Show visual indicators when a setting has been changed from its default value.
+
+**--help**
+> Show command-line help (via KAboutData / QCommandLineParser).
+
+**--version**
+> Show version information.
+
+# DESCRIPTION
+
+**kcmshell6** launches one or more **KDE Control Modules (KCMs)** in a standalone dialog, without opening the full **systemsettings** application. It is the Plasma 6 successor to **kcmshell5**, and ships as part of the **KCMUtils** framework.
+
+Modules are discovered as plugins under the usual Plasma KCM namespaces (**plasma/kcms**, **plasma/kcms/systemsettings**, **plasma/kcms/systemsettings_qwidgets**, and **plasma/kcms/kinfocenter**). Each module presents a focused settings panel (fonts, display, network, power, and so on). When several module IDs are given, they appear together in a multi-page list dialog.
+
+Scripts, desktop files, and documentation often invoke **kcmshell6** to deep-link into a single settings page. Interactive users typically use **systemsettings** for browsing and **kcmshell6** when they already know the module id.
+
+# CAVEATS
+
+Requires a running graphical session with Qt/KDE libraries available (normally a Plasma desktop). Module IDs differ between Plasma releases; use **kcmshell6 --list** on the target machine rather than hard-coding outdated names. Some modules need elevated privileges or PolicyKit for system-wide changes. Unknown module IDs may still open a dialog that only shows an error.
+
+# HISTORY
+
+**kcmshell** originated in KDE as a way to start individual control modules outside the full control center. Plasma 5 used **kcmshell5**; Plasma 6 renames the binary to **kcmshell6** and loads Qt 6 / KF6 KCM plugins (including QML-based modules) through KCMUtils.
+
+# INSTALL
+
+```apt: sudo apt install libkf6kcmutils-bin```
+
+```pacman: sudo pacman -S kcmutils```
+
+```apk: sudo apk add kcmutils```
+
+<!-- packages: 2026-08-04 -->
+
+# SEE ALSO
+
+[systemsettings](/man/systemsettings)(1), [plasmashell](/man/plasmashell)(1), [kwriteconfig5](/man/kwriteconfig5)(1)
+
+# RESOURCES
+
+```[Source code](https://invent.kde.org/frameworks/kcmutils)```
+
+```[Homepage](https://develop.kde.org/docs/features/configuration/kcm/)```
+
+<!-- verified: 2026-08-04 -->

assets/commands/listnr.md

@@ -0,0 +1,95 @@
+# TAGLINE
+
+Local dual-lane meeting transcription for macOS
+
+# TLDR
+
+**Install** via Homebrew and grant permissions
+
+```brew tap rokib16x/listnr https://github.com/rokib16x/listnr```
+
+```brew trust --tap rokib16x/listnr```
+
+```brew install listnr```
+
+```listnr setup```
+
+Start the **interactive** shell, then live-transcribe
+
+```listnr```
+
+```/live```
+
+One-shot session for **N seconds** with two remote speakers expected
+
+```listnr start --seconds 60 --speakers 2```
+
+Transcribe **Bangla** (or other supported languages)
+
+```listnr start --language bn --seconds 120```
+
+Speak any language; transcript in **English**
+
+```listnr start --language bn --translate --seconds 120```
+
+**List / download** Whisper models
+
+```listnr models list```
+
+```listnr models download whisper-large-v2```
+
+Check **permissions** and environment
+
+```listnr doctor```
+
+# SYNOPSIS
+
+**listnr** [_command_] [_options_]
+
+# PARAMETERS
+
+**(no command)**
+> Start the interactive REPL (**listnr>** prompt). Common in-session commands: **/live** [_seconds_], **/stop** or **q**, **/lang** _code_, **/translate**, **/speakers** _n_, **/model** _id_, **/diarize**, **/sensitivity** high|low, **/dump**, **/status**, **/help**.
+
+**start** [**--seconds** _n_] [**--speakers** _n_] [**--language** _code_] [**--translate**] ...
+> One-shot capture without the interactive shell. Transcript goes to **stdout**; progress and meters to **stderr**. Omitting **--seconds** runs until Ctrl+C.
+
+**setup**
+> Guide you through granting **Microphone** and **Screen & System Audio Recording** permissions to the host terminal app.
+
+**doctor**
+> Report which permissions and dependencies are missing.
+
+**models list**
+> List available WhisperKit model ids and sizes.
+
+**models download** _id_
+> Prefetch model weights from Hugging Face into the local cache.
+
+# DESCRIPTION
+
+**listnr** is a macOS command-line meeting listener. It captures **two separate audio lanes**: your **microphone** (always labeled **You**) and **system / speaker audio** (remote participants). Both lanes are transcribed **on-device** with **WhisperKit** (Core ML). Remote speakers are split into **Speaker 1…N** with **SpeakerKit** diarization after the session ends. Audio and transcripts never leave the machine except for the one-time model download from Hugging Face.
+
+Using a **headset** is strongly recommended so remote audio does not bleed into the microphone lane. Sessions write Markdown transcripts under **~/Documents/Listnr/**. Optional **/dump** writes raw WAV debug audio with owner-only permissions.
+
+Supported languages include English, Bangla, Hindi, Spanish, French, German, Japanese, and Chinese. **/translate** uses Whisper's translate-to-English task (one-way). Default models balance live latency; larger models improve accuracy at the cost of real-time headroom.
+
+# CAVEATS
+
+**macOS 14+ on Apple Silicon only** (Intel Macs are not supported). Permissions attach to the **terminal app**, not the binary—switching Terminal ↔ iTerm requires re-granting. Beta software (**0.x**): CLI flags and behavior may change. Diarization of remote speakers runs **after** you stop (live labels are all **Others**). Memory grows with session length (~460 MB per hour of dual-lane audio in RAM). Recording other people may require **all-party consent** under local law—obtain agreement before use. Session options like language and model do not currently persist across restarts.
+
+# HISTORY
+
+**Listnr** is an MIT-licensed open-source project by Rokibul Hasan. It builds on **WhisperKit** / **SpeakerKit** for on-device speech and diarization, and is distributed as a prebuilt Homebrew formula, notarized **.pkg**, and source build via Swift Package Manager.
+
+# SEE ALSO
+
+[whisper](/man/whisper)(1), [ffmpeg](/man/ffmpeg)(1)
+
+# RESOURCES
+
+```[Source code](https://github.com/rokib16x/listnr)```
+
+```[Homepage](https://github.com/rokib16x/listnr)```
+
+<!-- verified: 2026-08-04 -->