Mycroft

Goose extension pack for investigative journalists

Newsroom memory, recurring editorial workflows, and source-grounded fact-checking — 18 skills, open-weight and local-capable, ZDR cloud optional.

Install | First Run | Core Workflows | Skills | Recipes | Website

Built by Buried Signals • tom@buriedsignals.com

---

Mycroft is a Goose extension pack for newsroom memory, recurring editorial workflows, source-grounded fact-checking, and connections to the rest of the Buried Signals suite.

It gives an investigative journalist a durable local OpenKnowledge wiki, a set of Goose recipes for common reporting work, and a privacy-conscious provider setup that can run with ZDR cloud models or local inference.

What Mycroft Does

• Maintains an OpenKnowledge journalism wiki for sources, notes, methods, story material, and promoted Spotlight findings.
• Ingests links, PDFs, newsletters, pasted notes, documents, and folders into structured local knowledge.
• Answers questions over that wiki with citations.
• Runs SIFT-style source checks and draft fact-checks.
• Produces morning briefs and recurring wiki audits.
• Helps set up beats, watchlists, source-monitoring profiles, and story triggers.
• Connects to Scoutpost monitoring and Spotlight investigations when those sibling products are installed.
• Keeps provider and workspace configuration local to the user's machine.

Core Workflows

Workflow	What it does	Main recipe
Start	First-run menu for beats, knowledge ingest, morning brief, scouts, lead investigation, or demo flow.	start
Wiki Q&A	Answers questions over local newsroom memory and live sources with citations.	wiki-qa
Knowledge ingest	Turns links, notes, files, PDFs, folders, and newsletters into structured knowledge.	wiki-sync, newsletter-summarize
Fact-check	Checks article drafts or claims with SIFT-style verdicts and optional provenance packaging.	fact-check
Perspective audit	Traces observed viewpoints from source passages through summaries and an optional draft.	perspective-audit
Source verification	Evaluates a single source's credibility and evidence value.	source-verify
Morning brief	Builds a recurring digest from configured beats, watchlists, bookmarks, and recent wiki changes.	morning-brief
Wiki audit	Finds weak claims, missing frontmatter, orphaned sources, and stale promoted Spotlight findings.	wiki-audit
Browser acquisition	Opens a journalist-controlled browser session for portals, forms, downloads, and authenticated source capture.	dev-browser
Scoutpost	Sets up or queries hosted monitoring scouts and information units.	scoutpost skill
Spotlight case	Reads an existing Spotlight case read-only, or launches Spotlight for a new lead (Spotlight owns the brief gate).	spotlight-case

Mycroft, Spotlight, Scoutpost

These are sibling products. Indicator Lab can install several of them on one machine; Mycroft does not install Spotlight (or Scoutpost) for you.

• Mycroft — durable knowledge and publishing support: source records, wiki notes, claim checks, methods, story pitches, drafts, briefings.
• Spotlight — active OSINT casework: briefs, methodology, research cycles, evidence, review, exports. Own installer, own workspace, own update path — including its own brief approval gate.
• Scoutpost — hosted monitoring: page/beat/social scouts and alerts.

When both Mycroft and Spotlight are present, Mycroft records Spotlight’s paths so it can (1) launch Spotlight with a lead and let Spotlight brief the case, or (2) read an existing case read-only without copying live files into the wiki (spotlight-case). Material you choose to keep long-term can be promoted into Mycroft under handoff/from-spotlight/.

Typical loop: Scoutpost surfaces leads → Spotlight investigates → Mycroft keeps the durable notes and supports publication.

First Run

When the installer finishes it opens a personalized getting-started guide in the browser — example prompts and first workflows, written to ~/.config/goose/mycroft/getting-started.html. Mycroft also opens Goose and writes START_HERE.md into the wiki. The first-run menu offers:

• Set up my beat.
• Add material to my knowledge base.
• Create my morning brief.
• Investigate a lead.
• Set up scouts.
• Show me a demo workflow.

If the wiki is empty and the journalist already has material, start with knowledge ingest. If the journalist already knows the beat, start with the morning brief preflight. If the lead needs active OSINT work and Spotlight is installed, launch Spotlight (spotlight-case with action launch) and let it run its brief gate.

See docs/first-run.md.

OpenKnowledge wiki

Mycroft’s durable memory is an OpenKnowledge workspace. Default location: ~/Documents/OpenKnowledge/Mycroft.

_schema/
sources/raw/
sources/processed/
wiki/
stories/
context/
handoff/from-spotlight/
_audits/

Spotlight uses a separate workspace / case root for active investigations. Mycroft never mixes live case state into its wiki; it only reads cases read-only (spotlight-case), and only keeps what you promote under handoff/from-spotlight/.

Skills

Shipped skill set is the engine-resolved list in skills.manifest (18 skills):

Skill	Role
ai-writing-detox	Strip AI-sounding patterns from drafts
bsig-engine	Talk to the Buried Signals Engine / Indicator Labs stack
copywriting	Editorial copy help
epistemic-grounding	Confidence, sourcing, and claim discipline
fact-check	SIFT-style claim checking
foia-requests	Public-records request drafting and tracking
interview-prep	Dossiers, question frames, attribution rules
knowledge-ingest	Bring material into the wiki
knowledge-primitives	Note types, frontmatter, link structure
knowledge-workspace	OpenKnowledge as the primary wiki interface
mycroft-maintenance	Doctor, update, and repair helpers
navigator	OSINT Navigator connection (membership unlocks)
perspective-audit	Trace viewpoints through sources and drafts
photo-metadata	Caption / IPTC / EXIF workflows
scoutpost	Hosted monitoring scouts
shell-safety	Safe shell use with untrusted inbound text
story-pitch	Pitch framing
web-acquisition	Local search/scrape (SearXNG + Crawl4AI)

Install

Buried Signals Engine (bsig) is Mycroft's only installation authority. Indicator Labs submits the same Engine plans while adding guided setup, credential prompts, repair, and automatic updates for members.

For agent-led manual setup, fetch the signed Engine descriptor at:

https://navigator.indicator.media/api/artifacts/bootstrap/bsig/<platform>

Use darwin-arm64, darwin-amd64, linux-arm64, linux-amd64, or windows-amd64. Download the archive, checksum, signature, and public key before the 60-second grants expire; verify SHA-256 and Minisign before running bsig. Then:

bsig catalog sync
bsig --json configure describe mycroft

The agent selects values from that signed descriptor and submits the JSON request on stdin to bsig configure plan mycroft. Review and apply the emitted plan.json. Preflight and bsig keys list name optional provider credential IDs. A trusted local agent may prepare Engine's protected stdin/keychain flow, but the user enters each value only through a private operating-system or terminal prompt—never argv, chat, shell history, or a repository file. Manual updates use bsig plan update mycroft; Indicator Labs automates the same lifecycle.

install.sh remains a fail-closed pointer for old curl | bash commands; it is not another installer. Contributors may clone buriedsignals/mycroft, but Engine installs the catalog-pinned public commit for journalists.

Install from source (agents)

Engine is the supported path above. An agent pointed at this repository can install the runtime set without cloning the whole repository: install-set.txt names the directories a runtime needs; everything else is the site, catalog, and documentation. Scripts use the Python 3 standard library only.

git clone --filter=blob:none --sparse https://github.com/buriedsignals/mycroft.git mycroft
cd mycroft
git sparse-checkout set $(grep -v '^#' install-set.txt)

Then link the skills into your agent's skills directory (Windows: use New-Item -ItemType Junction in place of ln -s):

Agent	Link
Goose, Cursor, Codex, Gemini (shared agents store)	mkdir -p ~/.agents/skills/mycroft && for s in skills/*/; do ln -s "$PWD/$s" ~/.agents/skills/mycroft/$(basename "$s"); done
Claude Code	ln -s "$PWD" ~/.claude/skills/mycroft

These are the same links Engine creates; a later Engine install adopts or replaces them. Provider keys are never read from this checkout.

Privacy And Providers

Mycroft is designed for privacy-sensitive reporting:

• ZDR providers are the default cloud posture.
• The guided install defaults to OpenRouter with GLM-5.2. It configures Goose's OPENROUTER_PARAMETERS so every request includes provider.zdr=true, and checks OpenRouter's live endpoint list for a healthy GLM-5.2 ZDR route during setup. It also requires confirmation that account-level ZDR is enabled for OpenRouter's Non-frontier model group, protecting other Goose clients as defense in depth. This route requires Goose 1.41 or newer; the installer checks it. Fireworks remains the direct-host cloud alternative.
• Local inference is available when you want on-device models.
• Web search and scrape are local by default — SearXNG (search) and Crawl4AI (scrape) run with no API key or vendor account; Firecrawl is only an optional fallback when FIRECRAWL_API_KEY is set. An opt-in --tor fetch can route scraping through Tor so a target of investigation never sees the operator's IP. The installer provisions this stack, and mycroft update keeps it current.
• Wiki, schedules, generated instructions, and fallback script secrets live on the user's machine.
• API keys are stored locally through Goose or Mycroft config files, not in the wiki.
• Source acquisition and fact-check recipes preserve local evidence trails where tooling is available.

Model choice belongs in provider/runtime docs, not the product overview. The important contract is that Mycroft can operate with the newsroom's chosen provider posture.

Shipping Recipes

Core journalism

• start
• wiki-qa
• fact-check
• fact-check-c2pa
• perspective-audit
• source-verify
• morning-brief
• morning-brief-preflight
• wiki-audit
• newsletter-summarize
• wiki-sync
• spotlight-case

Source acquisition and parsing — local by default (Crawl4AI scrape, SearXNG search, pdftotext, sitemap.py); Firecrawl is only an optional fallback when FIRECRAWL_API_KEY is set. The recipe filenames keep the firecrawl- prefix for now.

• firecrawl-scrape — scrape a URL to markdown (Crawl4AI)
• firecrawl-change-track — snapshot + diff a page across runs
• firecrawl-pdf — extract a civic PDF (pdftotext)
• firecrawl-batch — scrape many URLs
• firecrawl-map — enumerate a domain's URL space (sitemap.py)
• dev-browser
• liteparse

Social and optional workflows

• apify-social/select-actor
• apify-social/instagram
• apify-social/x
• apify-social/facebook
• apify-social/tiktok
• apify-social/instagram-comments
• apify-social/linkedin
• voice-setup
• update-mycroft
• ft-preflight

Documentation

• Architecture — how Mycroft layers onto Goose.
• First run — what happens after setup.
• Grounding and provenance — evidence bundles, claim grounding, and optional C2PA signing.
• Schedules — morning brief, wiki audit, and updater schedules.
• Plugin authoring — adding workflows and plugins.
• Troubleshooting — common install and runtime failures.
• Security policy — disclosure process.
• Contributing — contribution guidance.
• Changelog — release history.

What To Do Next

Start Goose with the Mycroft profile and choose one action from the first-run menu. Use Mycroft for durable knowledge and publishing support. Use Spotlight when a lead needs active investigation. Use Scoutpost when something should be monitored over time.

Acknowledgements

Mycroft stands on open work — community-maintained open-source projects and open methods. A sincere thank-you to every project below — the pack would not exist without them. (Listing does not imply affiliation or endorsement.)

Category	Projects we're grateful to
Agent runtime	Goose (Block, Apache-2.0 — the open-source runtime Mycroft is built on)
Journalism skills & methods	claude-skills-journalism (Joe Amditis, MIT) · SIFT (Mike Caulfield)
Local search & scraping	SearXNG (AGPL-3.0) · Crawl4AI (unclecode, Apache-2.0) · Playwright (browser automation) · Poppler (pdftotext — PDF extraction) · Tor (opt-in anonymous scraping)
Local inference	llama.cpp (ggml, MIT)
Media & metadata	ExifTool (Phil Harvey — powers photo-metadata)
Voice	Whisper (MIT — open-weight local dictation) · Edge TTS (rany2, LGPL-3.0 — spoken briefings)
Knowledge workspace	OpenKnowledge (local knowledge app, CLI, search, and agent workspace)
Provenance	C2PA (content-provenance standard behind SIFT manifests)

Built something here we should credit, or want a listing changed or removed? Open an issue or PR — we'll fix it fast.

Vendored skills

Five of Mycroft's journalism skills — foia-requests, interview-prep, story-pitch, photo-metadata, and ai-writing-detox — are adapted from claude-skills-journalism by Joe Amditis (Center for Cooperative Media, Montclair State University), MIT licensed. Each skill carries its attribution and our localization edits; the full record lives in NOTICE.md and docs/amditis-catalogue.md.

License

MIT - © 2026 Buried Signals.