Dear User

Analyze your human-agent collaboration. Scans your agent contract (CLAUDE.md or AGENTS.md), memory files, hooks, skills, and more to produce a collaboration report with persona detection, scoring, friction analysis, and recommendations. Returns a pre-formatted markdown report. Use the format parameter to control detail level: - "text" (default): concise, plain-language report designed for non-technical users - "detailed": full technical report with stats, session patterns, injection findings, feedback loop - "json": raw structured data for programmatic use Everything runs locally — no data leaves the machine, no API keys needed, files are only read (never modified). IMPORTANT — Presenting results: The user cannot see raw tool results. You MUST output the full report as your response text — do NOT summarize, shorten, or add commentary around it. The report is pre-formatted for direct display. After showing the report, offer to implement any recommendation marked "Actionable". Tool recommendations with a "whoActs" line indicate whether you (the agent) can install it or the user needs to act — present accordingly. Example prompts that should trigger this tool: - "Analyze my collaboration with Claude" - "How good is my Claude setup?" - "What should I improve in my CLAUDE.md or AGENTS.md?" - "Score my agent configuration"

Mark a Dear User recommendation as dismissed so it won't be suggested again. Call this when the user picks "drop"/"ikke for mig"/"skip" for a specific recommendation from the action menu. Use recommendation_id from the latest report's menu. For security/health findings, the dismissal propagates to the underlying finding in the ledger so future scans won't re-surface it (unless dismiss_expires_at elapses).

Send a short note to the Dear User team — a bug, a request, a "this score feels wrong", or anything you want the founder to read. Zero friction: one tool call and you're done. Behavior: - POSTs your message to the Dear User feedback inbox (Supabase) over HTTPS. - Respects Dear User's local-first guarantee — this is the one place data leaves the machine. - Email is only attached when opt_in_followup=true AND an email is provided. - No retries — if the network fails, you get a clear message and the payload is logged locally. - For public questions/ideas, point to GitHub Discussions: https://github.com/bleedmode/dearuser/discussions What this tool does NOT do: - Does NOT send anything automatically — the agent must have called this tool with an explicit message from the user. - Does NOT read past feedback — it is write-only from this side. The founder reads the inbox directly in Supabase. - Does NOT upload anything about your setup, files, or reports. Only what you put in the message. Context options: "collab" | "security" | "health" | "wrapped" | "general" — pick the tool the user just ran so the founder can slice the inbox. Length guidance: keep the confirmation you show the user short. If the user typed a one-liner, the reply can be one line. Example prompts that should trigger this tool: - "This score feels wrong — send feedback: the collab score is too low for a brand new project" - "Send feedback to Dear User: loving it, but the health findings could be shorter" - "Tell them I want Windows support" - "Send a bug report: health tool crashed on me"

Check the health of your AI stack. Returns a 0-100 system-sundhed score with category breakdown, plus findings ranked by severity. Complement to collab: where collab scores how well you and the agent communicate, health scores whether your skills, hooks, scheduled tasks, and MCP servers are still hanging together or have started drifting apart. Detects: - **Orphan scheduled jobs** — task produces output nothing reads - **Stale schedules** — jobs that stopped firing silently despite being enabled - **Expected jobs missing** — jobs declared in ~/.dearuser/expected-jobs.json that aren't registered - **Overlap** — skills/tasks/commands with similar purpose or same output path - **Missing closure** — non-scheduled producers with no downstream reader - **Substrate mismatch** — memory files that look like databases in disguise - **Unregistered MCP tools** — skills calling tools whose server isn't registered - **Unbacked-up substrate** — active ~/.claude/ files outside version control - **Reconciliation gap** — findings open in the ledger for 14+ days (closed-loop failure) What this tool does NOT do: - Does NOT fix problems — it identifies them for you to decide - Does NOT delete or modify any files, skills, or hooks - Does NOT contact external services — pure local filesystem analysis IMPORTANT — Presenting results: The user cannot see raw tool results. You MUST output the full report as your response text — do NOT summarize, shorten, or add commentary around it. The report is pre-formatted for direct display. Show the score and ceiling prominently. Lead with critical findings, then recommended, then nice-to-have. Each finding has a stable id users can reference to dismiss. Heuristic-based detection has some false positives — frame findings as "likely" not "definitely". Example prompts that should trigger this tool: - "Check my system's health" - "Are any of my scheduled tasks orphaned?" - "Run dearuser health" - "Is my agent substrate well-structured?"

Show Dear User's capabilities to the user. Call this whenever the user asks "what can Dear User do?", "hvad kan DearUser?", "show me the options", "help", or seems uncertain about which tool fits their need. Also call proactively the first time a user mentions Dear User if they haven't used it before. What this tool does NOT do: - Does NOT run any analysis — it only describes what Dear User can do - Does NOT access or read any user files When presenting: return the text verbatim. Do NOT summarize or re-wrap — the formatting is designed for direct chat display.

Retrieve past Dear User reports without re-running the scan. Reads from local SQLite (~/.dearuser/dearuser.db) — no network, no fresh scan. Use when the user wants to see their latest score, how scores have changed over time, or what got better/worse since the last run. A fresh scan takes ~30s; this returns instantly. Call `collab`/`health`/`security` instead if the user explicitly asks for a new scan. Three formats: - **"summary"** (default): latest stored report per scope. Fast, no re-scan. Use when the user asks what the previous/overnight report said. - **"trend"**: score sparkline over time per scope, with delta from oldest to newest. Use for "is it getting better?" questions. - **"regression"**: delta vs prior run — score change + new/resolved findings by stable ID. Use for "what changed?" / "what's new?" questions. Scope narrows to one area: "collab", "health", "security", or "all" (default). Pass `run_id` to fetch a specific historical report by its ID (printed at the bottom of every Dear User report). What this tool does NOT do: - Does NOT run any new scans — pure read of stored reports - Does NOT delete or modify stored history - Does NOT contact any external service — everything stays on your machine IMPORTANT — Presenting results: The user cannot see raw tool results. You MUST output the full report as your response text — do NOT summarize or add commentary. Output is pre-formatted markdown with a "What to do next" section. Example prompts that should trigger this tool: - "Vis seneste rapport" - "Show me the latest collab score" - "Er sikkerheden blevet bedre?" - "Hvad fandt nattens scan?" - "What changed since last run?" - "Vis trend"

Apply a Dear User recommendation to the user's setup — automatically if safe, or by returning the exact command/instruction for the agent to run. After a collab/health/security report runs, the result text contains a "Three things to fix" menu with up to 3 recommendation_ids plus "Take all of them" and "Skip for now" options. Present those options to the user via AskUserQuestion (or as a numbered list if AskUserQuestion isn't available). When the user picks an item: call this tool with that recommendation_id. When the user picks "Take all": call this tool once per id, in order. When the user picks "Skip" or dismisses an item: call mcp__dearuser__dismiss_recommendation instead. Behavior by action_type: - **claude_md_append** — appends the markdown rule to ~/.claude/CLAUDE.md (with timestamped backup). Idempotent. - **settings_merge** — merges a JSON snippet into ~/.claude/settings.json (with backup, arrays deduped). Idempotent. - **shell_exec** — returns the shell command for YOU (the agent) to run via the Bash tool. Do NOT paraphrase; run it verbatim. - **manual** — returns instructions that need human judgment; present them to the user. After a successful implementation, the recommendation's status is marked "implemented" so Dear User won't suggest it again. IMPORTANT: Present the ImplementResult back to the user in plain Danish — confirm what changed, show any backup paths, and if there's a `command` field, run it via Bash and report the result. If `ok:false`, tell the user why and suggest they try again or do it manually.

Conversational setup. Walks the user through 5 steps (intro → goals → stack+pains → substrate → plan) and produces a tailored setup plan — tailored agent-contract template (CLAUDE.md or AGENTS.md), skill recommendations, hook recommendations, and next 3 steps. How to use (for the agent): 1. First call: no arguments. The tool returns an intro question + nextStep. 2. Present the question to the user and collect their answer. 3. Call again with step=<nextStep from previous>, answer=<user answer>, state=<state from previous>. 4. Continue until done=true, then show the plan. IMPORTANT — Presenting results: The user cannot see raw tool results. You MUST output each step's response text as your response — do NOT summarize, rephrase, or wrap it in your own words. The questions and final plan are pre-formatted for direct display. Just show what the tool returns, then collect the user's answer for the next step. IMPORTANT: The `state` parameter is opaque. Pass it back verbatim. Do not parse or modify it. What this tool does NOT do: - Does NOT write files automatically — it produces a plan for the user/agent to apply - Does NOT require prior Claude Code experience — designed for first-time users - Does NOT collect or transmit any answers — state is a local opaque blob passed between calls Good for: new users, non-technical professionals, anyone setting up Claude Code for the first time, or someone revisiting goals after a while. Example prompts that should trigger this tool: - "Set up Dear User for me" - "I'm new to Claude Code, help me configure it" - "Onboard me" - "Help me create a CLAUDE.md" - "Help me create an AGENTS.md"

Security audit of your AI setup. Scans for: - **Leaked secrets** — API keys, tokens, credentials in CLAUDE.md / AGENTS.md, memory, skills, or settings - **Prompt-injection surfaces** — hooks/skills that pass user input to shell unsafely - **Rule conflicts** — your agent contract says one thing but a hook/skill does another (e.g., "never force-push" but a hook runs `git push --force`) Presents findings sorted by severity (critical → recommended → nice-to-have). Secrets and rule conflicts are the highest-trust signals because false positives are rare; injection findings are pattern-based and may warrant manual review. What this tool does NOT do: - Does NOT access your passwords, keychains, or browser saved credentials - Does NOT send findings to any external service — everything stays local - Does NOT auto-rotate or revoke credentials — it reports, you act - Does NOT scan source code repositories — only your agent config files (~/.claude/, memory, skills, hooks) IMPORTANT — Presenting results: The user cannot see raw tool results. You MUST output the full report as your response text — do NOT summarize, shorten, or add commentary around it. The report is pre-formatted for direct display. Lead with secrets (rotate any found credentials immediately). Be precise about rule conflicts — show the rule AND the conflicting action. Don't minimize: "no findings" is a REAL signal of clean setup, not evidence of a broken scanner. Example prompts that should trigger this tool: - "Scan my Claude setup for security issues" - "Are there any leaked API keys in my config?" - "Check my hooks for prompt injection risks" - "Security audit of my agent setup"

Generate a public shareable link for your Dear User Wrapped card. Uploads an anonymized copy to dearuser.ai and returns a URL you can paste anywhere (X, LinkedIn, Slack). Only Wrapped reports are shareable. Collab/health/security reports stay local. Privacy contract: - Absolute filesystem paths are collapsed to basenames. - Email addresses are stripped. - Anything matching our secret-scanner patterns (API keys, tokens, JWTs, private keys) is redacted before upload. - The user's local ~/.dearuser/ database is NOT modified. Works out of the box — uploads through the public dearuser.ai Supabase endpoint with an RLS-protected anon key. Forks/staging deployments can override with DEARUSER_SUPABASE_URL + DEARUSER_SUPABASE_ANON_KEY. IMPORTANT — Presenting results: Show the returned URL prominently and tell the user it's public. Do NOT auto-paste it anywhere on their behalf. Example prompts that should trigger this tool: - "Share my Wrapped" - "Lav et delbart link til min Wrapped"

Generate your Dear User — shareable stats about your human-agent collaboration in a fun, Spotify Wrapped-style format. What this tool does NOT do: - Does NOT share anything automatically — it generates text you can copy/paste if you choose - Does NOT access external accounts or profiles - Does NOT store or upload the generated stats anywhere IMPORTANT — Presenting results: The user cannot see raw tool results. You MUST output the full report as your response text — do NOT summarize, shorten, or add commentary around it. The report is pre-formatted for direct display. Example prompts that should trigger this tool: - "Give me my Dear User Wrapped" - "Show my collaboration stats" - "Generate shareable stats about my Claude usage"