Dex Distribution Checklist

Dex Distribution Checklist

Status: ✅ Ready for GitHub Distribution

This document verifies that Dex is properly configured for public distribution without exposing credentials or requiring manual path configuration.

✅ 1. Dynamic Paths (SOLVED)

Problem: Users will clone to different paths like /Users/alice/Documents/dex

Solution: Template + install script substitution (already implemented)

How It Works

1. Template file: System/.mcp.json.example uses {{VAULT_PATH}} placeholder
2. Install script: install.sh (lines 49-55) automatically:
   • Detects current directory: CURRENT_PATH="$(pwd)"
   • Replaces placeholder: sed "s|{{VAULT_PATH}}|$CURRENT_PATH|g"
   • Generates .mcp.json (gitignored)

User Experience

cd ~/Documents/dex
./install.sh
# ✅ Creates .mcp.json with /Users/alice/Documents/dex

Status: No action needed — industry-standard pattern.

✅ 2. MCP Server Architecture (CLARIFIED)

Dex Core MCP Servers (7 total)

All shipped with Dex in core/mcp/:

External MCPs (NOT part of Dex)

These are user-installed separately via Claude Desktop/Cursor settings:

• cursor-ide-browser — Browser automation
• user-granola — Official Granola MCP (different from dex granola-mcp)
• pendo — Pendo's hosted MCP server (OAuth, optional for Pendo customers)
• user-whatsapp, user-apify, etc. — Other user-installed integrations

Optional Dependencies

Granola (meeting transcription):

• Install script checks: ~/Library/Application Support/Granola/cache-v3.json
• If found: "✅ Granola detected - meeting intelligence available"
• If not found: "ℹ️ Granola not detected - meeting intelligence won't work"
• User can install from https://granola.ai
• System works without it — users can paste meeting transcripts manually

Apple Calendar:

• Uses macOS Calendar.app via AppleScript (no API keys needed)
• Works with any calendar synced to Calendar.app (Google, Outlook, iCloud)
• macOS only (calendar-mcp gracefully degrades on other platforms)

Status: Documentation clear — no changes needed.

✅ 3. Credentials & Security (VERIFIED)

Gitignored Files

# Credentials
.env
.env.local

# Generated config
.mcp.json

# User data
System/user-profile.yaml
System/pillars.yaml
00-Inbox/
01-Quarter_Goals/
02-Week_Priorities/
03-Tasks/
04-Projects/
05-Areas/
07-Archives/

Credential Scan Results

Python MCP servers:

✅ No API keys found in core/mcp/*.py
✅ No hardcoded passwords/tokens
✅ No personal data

Environment variables:

• Template: env.example (safe — no real keys)
• Actual .env is gitignored
• Created during setup only if user enables optional features

What Gets Committed to GitHub

Safe to commit:

• ✅ System/.mcp.json.example — Template with {{VAULT_PATH}}
• ✅ env.example — Template showing structure
• ✅ core/mcp/*.py — MCP server code (no credentials)
• ✅ Documentation and README
• ✅ Demo mode files (sanitized examples)

Never committed:

• ❌ .mcp.json — Generated, contains user paths
• ❌ .env — Contains API keys if configured
• ❌ User data folders (00-07)
• ❌ System/user-profile.yaml — Personal info

Status: Security verified — ready for public release.

📋 Pre-Release Checklist

Before pushing to GitHub:

Repository Setup

• Remove or sanitize System/Session_Learnings/ (contains personal work history)
• Verify .gitignore is committed
• Check no .env or .mcp.json in git history: git log --all --full-history --name-only -- .env .mcp.json
• Verify no API keys in commit history: git log --all -S "sk-ant-" -S "ANTHROPIC_API_KEY" -S "OPENAI_API_KEY"

Documentation

• README links to actual podcast episode (currently placeholder)
• README links to blog post (currently placeholder)
• Verify GitHub repo URL in clone command
• Add LICENSE file (MIT recommended)
• Add CONTRIBUTING.md if accepting PRs

Testing

• Fresh clone on different machine
• Run ./install.sh with no prior Dex installation
• Verify .mcp.json generates with correct paths
• Run setup wizard: /setup in Cursor
• Test without Granola installed (graceful degradation)
• Test on Windows if supporting (install.sh needs .bat version)

Demo Mode

• Verify System/Demo/ contains no personal info
• Test /dex-demo enable/disable
• Verify demo data is realistic but generic

🔐 Credential Management for Users

What Users Need to Know

99% of features work immediately — no API keys needed:

• Task management
• Person pages
• Project tracking
• Daily planning
• Meeting prep
• All /commands

Optional API keys (only if enabling background automation):

• Anthropic API key — For /prompt-improver and background meeting processing
• OpenAI or Gemini — Alternative to Anthropic

Setup Flow

1. First install: No .env file — everything works through Cursor
2. Optional: Run /setup → answers "Enable automatic meeting processing?"
3. If yes: System creates .env from template, prompts for API key
4. If no: Skip entirely — manual meeting processing works fine

Security Best Practices

For users:

• Never commit .env to their own repos
• Use separate API keys for different projects
• Set usage limits in Anthropic console

For Dex maintainers:

• Keep env.example up to date
• Never commit real .env
• Document which features require keys

🚀 Distribution Recommendations

GitHub Release Strategy

v1.0.0 - Initial Public Release

1. Tag the release:

   git tag -a v1.0.0 -m "Initial public release"
   git push origin v1.0.0
   

2. Create GitHub Release:

   • Title: "Dex v1.0.0 — Your AI Chief of Staff"
   • Description: Paste first 3 sections of README
   • Attach: Installation guide, demo video (if available)

3. Post-release:

   • Monitor issues for Windows compatibility
   • Create FAQ from common questions
   • Build community in Discussions tab

Alternative Distribution

For teams/organizations:

• Fork repo → customize roles/templates → distribute internal URL
• Include company-specific integrations in core/mcp-custom/
• Company pillars in System/pillars-company.yaml template

For consultants:

• Charge for customization/setup services
• Pre-configured bundles for specific roles (PM, Sales, etc.)
• Training packages

✅ Final Verification

Run this before pushing to GitHub:

# Check for credentials in tracked files
git ls-files | xargs grep -E '(sk-ant-|sk-[a-zA-Z0-9]{48}|AIza[a-zA-Z0-9-_]{35}|ANTHROPIC_API_KEY|OPENAI_API_KEY)' 2>/dev/null

# Expected output: (no matches except in env.example and documentation)

# Check for personal data
git ls-files | xargs grep -iE '(dave|killeen|[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,})' | grep -v 'README\|example\|template\|CHANGELOG'

# Expected output: Only documentation/examples, no real emails/names

# Verify .gitignore is working
git status --ignored | grep -E '(\.env$|\.mcp\.json$|00-Inbox|04-Projects|System/user-profile\.yaml)'

# Expected output: Shows these as ignored, not tracked

Status: ✅ Ready for distribution

• Paths dynamically configured via install script
• MCP servers documented (7 core, others external)
• No credentials exposed
• .gitignore properly configured
• User data protected
• Documentation complete

Next steps:

1. Complete pre-release checklist
2. Push to GitHub
3. Announce to audience
4. Monitor for issues

Questions? See 06-Resources/Dex_System/Dex_Technical_Guide.md for implementation details.