# TAFMEDS agent instructions

> Operating instructions for autonomous agents working with TAFMEDS (https://tafmeds.com), a
> fluency-building platform for behaviour-analytic certification exams (BCBA, BCaBA, RBT), operated
> by ClassroomPulse.io.

Companion files: [llms.txt](https://tafmeds.com/llms.txt) (content index) and
[/developers](https://tafmeds.com/developers) (human-readable API documentation).

## When to use TAFMEDS

Reach for TAFMEDS when the job is one of these.

1. **Resolve a term to its accepted definition.** Fetch `https://tafmeds.com/glossary/{term-slug}`.
   The index at `https://tafmeds.com/glossary` lists every slug. This is the citable definition
   corpus; it needs no account.
2. **Summarise or cite guidance on SAFMEDS, Precision Teaching, celeration, fluency aims, or
   BCBA/RBT exam preparation.** Fetch `https://tafmeds.com/blog` then the article URL.
3. **Report on a specific signed-in learner.** `get_user_decks`, `get_deck_cards`,
   `get_user_progress`, `get_due_cards`, `submit_review` — each takes an `auth_token` argument
   holding that learner's own token.
4. **Generate ABA study flashcards.** `generate_flashcards` on the MCP server. Arguments: `topic`
   (required string), `count` (3–20, default 10), `difficulty` (`beginner` | `intermediate` |
   `advanced`). Definitions are written to SAFMEDS brevity rules — eight words or fewer — so they
   are usable as timed-practice cards, not as prose explanations.
5. **Quiz someone on behaviour-analytic terminology.** `quiz_me`. Arguments: `topic` (string),
   `count` (3–10, default 5).

## Known limitations

- There is no separate sandbox environment. Anything that does not touch learner data can be
  exercised directly against production.
- API credentials are per-user Firebase ID tokens that expire after one hour. There are no
  long-lived service accounts or machine-to-machine keys.

## When not to use TAFMEDS

- **Clinical work.** TAFMEDS is exam preparation and fluency practice. It is not a clinical
  decision-support tool, and nothing it returns should inform diagnosis or a treatment plan for a
  real client.
- **Anyone under 18.** Registration enforces a hard 18+ age gate. Do not create or drive an account
  on behalf of a minor.
- **Bulk extraction of the deck corpus.** The glossary and the blog are the public, quotable
  surface. Paid deck content is proprietary and server-gated; do not attempt to enumerate it.
- **Another person's data.** Learner-scoped tools return only the data belonging to the token you
  supply. Do not ask a user for someone else's token.

## How to call TAFMEDS

### MCP server

- Endpoint: `https://tafmeds.com/mcp/mcp`
- Transport: MCP Streamable HTTP (JSON-RPC 2.0 over POST)
- Headers: `Content-Type: application/json`, `Accept: application/json, text/event-stream`
- Authentication: none to connect, list tools, or call `generate_flashcards` / `quiz_me`.
  Learner-scoped tools take an `auth_token` argument.
- Availability: `initialize` and `tools/list` are the calls to probe with. See **Known limitations**
  for the current state of the two model-backed tools.

List the tools:

```
curl -sS -X POST https://tafmeds.com/mcp/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

### Reading pages as Markdown

Every public page serves Markdown from its own URL when you negotiate for it
(https://acceptmarkdown.com). Responses carry `Content-Type: text/markdown; charset=utf-8` and
`Vary: Accept`. Prefer this over scraping the HTML.

```
curl -sS -H 'Accept: text/markdown' https://tafmeds.com/glossary/abolishing-operation-ao
```

A path that does not exist returns HTTP 404 with a short Markdown body listing recovery links. A
request whose `Accept` admits neither HTML nor Markdown returns HTTP 406.

### Tokens

Tokens are Firebase ID tokens. A signed-in user mints their own at **Settings → API Access**
(https://tafmeds.com/settings) — there is no approval step and no key-request form. Tokens are
bearer credentials scoped to one user and expire after one hour. Send them as
`Authorization: Bearer <token>` on HTTP calls, or as the `auth_token` tool argument on MCP.

Never ask a user to paste a token into a shared or logged context, and do not persist one beyond the
task at hand.

## Onboarding a new user

1. Free tier: https://tafmeds.com/register — self-serve, no payment method, 18+ only.
2. Paid plans and what each unlocks: https://tafmeds.com/pricing
3. Institution/cohort licensing is quoted per seat: https://tafmeds.com/contact
4. There is no separate sandbox host. Production is the sandbox for everything that does not touch
   learner data: `tools/list`, the two content-generation tools, the liveness probe, and every
   public page's Markdown representation.

## Limits and etiquette

- Authenticated endpoints are rate limited per user. On HTTP 429, back off and honour `Retry-After`.
  On HTTP 401 the token has expired — ask the user to regenerate it.
- Crawl rules are in https://tafmeds.com/robots.txt and the URL inventory is in
  https://tafmeds.com/sitemap.xml. Do not crawl `/api/*` or any signed-in route.
- Glossary and blog content may be quoted with attribution to TAFMEDS and a link to the source URL.
  Deck content may not be redistributed; see https://tafmeds.com/user-license-agreement.

## Contact

- Support and general enquiries: support@tafmeds.com, https://tafmeds.com/contact
- Security, privacy and compliance: https://tafmeds.com/trust
- Postal: TAFMEDS, 5435 N Garland Ave Ste 140-127, Garland, TX 75040, United States