# Claude FAF (npm · claude-faf-mcp)

Persistent project context for Claude. IANA-registered .faf format.

- Trust score: 65/100 (medium)
- Change this week: +12
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- mcpb · `claude-faf-mcp-5.20.0.mcpb`: 11/100, [markdown](https://verifymcp.io/servers/one-faf-claude-faf-mcp/https-github-com-wolfe-jam-claude-faf-mcp-releases-download-v5-20-0-claude-faf-m.md), [page](https://verifymcp.io/servers/one-faf-claude-faf-mcp/https-github-com-wolfe-jam-claude-faf-mcp-releases-download-v5-20-0-claude-faf-m)
- npm · `claude-faf-mcp`: 65/100 (this document), [markdown](https://verifymcp.io/servers/one-faf-claude-faf-mcp/claude-faf-mcp.md), [page](https://verifymcp.io/servers/one-faf-claude-faf-mcp/claude-faf-mcp)

## Channel facts

- Registry: `npm`
- Package: `claude-faf-mcp`
- Version: `5.20.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 82/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (143 of 147), so this covers what we could see, not the whole tree.
  - Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does.
  - Only part of the dependency tree could be resolved (143 of 147), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 33 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 84/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1802 tokens (~112/item across 16 items; 13 tools + 3 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (54% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add one-faf-claude-faf-mcp -- npx -y claude-faf-mcp
```

### Codex

```bash
codex mcp add one-faf-claude-faf-mcp -- npx -y claude-faf-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "one-faf-claude-faf-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "claude-faf-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add one-faf-claude-faf-mcp --command npx --arg -y --arg claude-faf-mcp
```

### Hermes

```yaml
mcp_servers:
  one-faf-claude-faf-mcp:
    command: "npx"
    args: ["-y", "claude-faf-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "one-faf-claude-faf-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "claude-faf-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 65, +39)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → partial
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The scripts that run when this package is installed changed: postinstall
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-07-31 (score 26, +18)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 8, −16)

- [security regression] Malware scan: pass → unverified
- [functional improvement] Dependency health: unverified → partial

### 2026-07-28 (score 24, −29)

- [functional regression] Schema quality: 100 → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-27 (score 53)

First indexed and scored.

## MCP tools (13)

### `faf_about` (~58 tokens)

Explain what the FAF format is — project DNA for AI — with its IANA registration, version, and connected platforms. Returns format metadata and the available MCP bridges. Use this when someone asks what FAF is or how it connects to other AI tools.

### `faf_score` (~90 tokens)

Score a project.faf and return its 0–100% AI-readability, tier, and per-slot breakdown, via the deterministic Mk4 engine. Use this for a quick status check; use faf_doctor when you need to diagnose and fix what's missing.

Input parameters:

- `details` (boolean): Include detailed breakdown and improvement suggestions
- `path` (string): Project path. Sets session context for subsequent calls.

Output parameters:

- `active` (number): Slots active for this app_type
- `empty` (number): Active slots still empty
- `hasFaf` (boolean): Whether a readable, valid project.faf was scored
- `ignored` (number): Slots marked slotignored (inactive for this app_type)
- `inherited` (boolean): True if the score is attested from a source repo (app_type: about)
- `nextTier` (object|null): Next tier above the current score, or null at top tier
- `parity` (object): Determinism parity receipt — an engine-agnostic hash any conformant scorer reproduces for this exact file. Third-party verifiable: sha256(projection) === parityHash.
- `path` (string): Path that was scored
- `populated` (number): Active slots that are filled
- `score` (number): AI-readiness score, 0-100
- `tier` (string): Tier name for this score (e.g. Bronze, Trophy)
- `total` (number): Total slots

### `faf_init` (~126 tokens)

Create a new project.faf with a name, goal, and language. Returns the file path and starting score. Won't overwrite an existing file — use faf_auto to fill the stack from your manifests, or faf_go for the human 6Ws.

Input parameters:

- `force` (boolean): Overwrite existing project.faf if it exists
- `path` (string): Project path or name. Smart resolution: "my-app" finds ~/Projects/my-app OR ~/Code/my-app. Full paths like ~/Projects/app or /Users/me/code/app work too. Omit to use current directory.

### `faf_trust` (~70 tokens)

Attest a project.faf's integrity: its validity, score, and a deterministic parity hash any conformant engine reproduces. Returns the ✪ receipt. Use this to prove a score is genuine and untampered.

Input parameters:

- `path` (string): Project path. Sets session context for subsequent calls.

Output parameters:

- `hasFaf` (boolean): Whether a project.faf was found
- `parity` (object): Determinism parity receipt (same shape as faf_score.parity).
- `path` (string): Path that was attested
- `reason` (string): Why validation failed, when valid is false
- `receipt` (object): The ✪ trust receipt — render-identical, self-verifying score+parity artifact.
- `score` (number): AI-readiness score, 0-100
- `sourceSha256` (string): SHA-256 of the raw .faf bytes
- `tier` (string): Tier name for this score
- `valid` (boolean): Whether the project.faf is readable and valid

### `faf_sync` (~230 tokens)

Sync project.faf into CLAUDE.md as a faf-managed block, and optionally into AGENTS.md (agents), .cursorrules (cursor), GEMINI.md (gemini), and .github/copilot-instructions.md (copilot) — or all of them (all). Updates each block in place — it never overwrites your file. Use this after editing project.faf so every AI tool sees the latest context.

Input parameters:

- `agents` (boolean): Also sync to AGENTS.md (OpenAI/Codex format)
- `all` (boolean): Sync to ALL formats: CLAUDE.md + AGENTS.md + .cursorrules + GEMINI.md + .github/copilot-instructions.md
- `copilot` (boolean): Also sync to .github/copilot-instructions.md (GitHub Copilot)
- `cursor` (boolean): Also sync to .cursorrules (Cursor IDE format)
- `gemini` (boolean): Also sync to GEMINI.md (Google Gemini format)
- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_enhance` (~159 tokens)

Refine a project.faf with an AI model (claude/gemini/grok, optionally by consensus). Returns the enhanced content, or a dry-run preview when dryRun is set. Use this to polish after faf_auto and faf_go have filled the slots.

Input parameters:

- `consensus` (boolean): Build consensus from multiple AI models
- `dryRun` (boolean): Preview enhancement without applying changes
- `focus` (string): Enhancement focus: claude-optimal|human-context|ai-instructions|completeness
- `model` (string): Target AI model: claude|chatgpt|gemini|universal (default: claude)
- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_context` (~65 tokens)

Set or show the active project path that subsequent faf_ calls resolve against. Returns the current context path. Call this once at the start of a session so the other tools target the right project.

Input parameters:

- `path` (string): Set active project path. If omitted, shows current context.

Output parameters:

- `active` (string): Absolute path of the active project
- `changed` (boolean): True if this call set a new context, false if it only reported
- `filename` (string|null): The .faf filename, if found
- `hasFaf` (boolean): Whether a project.faf (or .faf) was found there

### `faf_go` (~186 tokens)

The friendly front door — "let's go, tell me about your idea." Asks the human the 6Ws (goal, why, who, what, where, when) that can't be auto-detected, then applies them to project.faf. If no project.faf exists yet, faf_go bootstraps it first (creates it, sources the stack) so you go from nothing to the 6Ws in one step. Returns the Table-of-8 to confirm/answer, or applies the answers you pass back. Use faf_auto for the technical stack on its own.

Input parameters:

- `answers` (object): Answers to apply. Keys are field paths (e.g., "project.goal", "human_context.why"), values are the answers. If provided, applies answers and returns new score.
- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_auto` (~113 tokens)

Scan your manifests (package.json, Cargo.toml, pyproject.toml, go.mod…) and fill the project.faf stack slots from real dependencies — no hardcoded defaults. Returns what was detected and the updated score. Use this for the technical context; use faf_go for the human 6Ws it can't detect, and faf_enhance to have an AI refine the result.

Input parameters:

- `force` (boolean): Force overwrite existing files
- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_bench` (~301 tokens)

Prove the .faf earns its place — measure how much the context is worth, on THIS repo, falsifiably. Questions derive from the project.faf's own populated slots (the .faf is the answer key), so grading is mechanical — no judge, no rubric. action=questions returns the answer-key-safe question set; action=grade takes your answers WITHOUT the .faf (cold) and WITH it (faf), grades both, and returns the cold→with-faf lift with a ✪ receipt. The delta is the product; the cold number belongs to the absence of context, never to FAF.

Input parameters:

- `action` (string): questions = get the answer-key-safe question set to answer; grade = submit cold + with-faf answers to score the delta. Default: questions.
- `cold` (object): action=grade: answers produced WITHOUT the .faf (general repo knowledge only). Map of question number → answer string.
- `coldTokens` (number): action=grade (optional): tokens spent answering cold.
- `faf` (object): action=grade: answers produced WITH the project.faf in context. Map of question number → answer string.
- `fafTokens` (number): action=grade (optional): tokens spent answering with the .faf.
- `model` (string): action=grade (optional): the model that produced the answers.
- `path` (string): Project path (optional — current directory if omitted).

Output parameters:

- `action` (string)
- `cold` (object): action=grade — score WITHOUT context (absence baseline).
- `delta` (number): with-faf minus cold — the product.
- `faf` (object): action=grade — score WITH the .faf.
- `protocol` (string): in-session — answers are self-reported by the agent under test.
- `qsetHash` (string): Hash of the question set — rides the receipt; same .faf reproduces it.
- `questions` (array): action=questions only — NEVER includes the answer key.
- `receipt` (object): ✪ receipt — sha256 over the canonical projection; third-party verifiable.
- `total` (number): Number of questions in the set.
- `version` (string)

### `faf_doctor` (~66 tokens)

Diagnose a project.faf: report empty or weak slots, common issues, and how to fix each. Returns a prioritized checklist. Use this when faf_score is below target and you need to know why.

Input parameters:

- `path` (string): Project path. Sets session context for subsequent calls.

Output parameters:

- `checks` (number): Number of checks run
- `diagnostics` (array): Per-check results
- `errors` (number): Count of error-level findings
- `health` (string): Overall verdict: ok | warning | error
- `warnings` (number): Count of warning-level findings

### `faf_etch` (~166 tokens)

Remember a decision, gotcha, or win across sessions by writing it to the project soul (.fafm). Returns the stored memory's id. Use this to persist something an AI should recall later; use faf_recall to read them back.

Input parameters:

- `id` (string): Stable id — re-etching the same id updates in place (dedup)
- `path` (string): Project path. Sets session context for subsequent calls.
- `priority` (string): Recall ranks by priority then recency
- `tags` (array): Tags (e.g. decision, gotcha, win) for filtering + recall coupling
- `text` (string, required): The memory to remember — capture the why (decision/gotcha/win)
- `type` (string): Memory category

Output parameters:

- `etched` (object)
- `namepoint` (string)
- `soul` (string): Path to soul.fafm
- `total` (number): Total memories in the soul

### `faf_recall` (~133 tokens)

Recall memories from the project soul (.fafm), ranked by priority then recency, filtered by query/tags/type. Returns the matching entries. Use this to surface past decisions; use faf_etch to add new ones.

Input parameters:

- `limit` (number): Max memories to return
- `minPriority` (string): Priority floor (default ephemeral)
- `path` (string): Project path. Sets session context for subsequent calls.
- `query` (string): Case-insensitive substring match on memory text (optional)
- `tags` (array): Filter by tag intersection
- `type` (string): Filter by memory type

Output parameters:

- `memories` (array)
- `soul` (string)
- `soulTotal` (number): Total memories in the soul
- `total` (number): Number returned

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/one-faf-claude-faf-mcp/claude-faf-mcp#diagnostics

## Score history

- 2026-08-03: 65
- 2026-08-02: 65
- 2026-08-01: 26
- 2026-07-31: 26
- 2026-07-30: 8
- 2026-07-28: 24
- 2026-07-27: 53

## Links

- npm package: https://www.npmjs.com/package/claude-faf-mcp
- Socket report: https://socket.dev/npm/package/claude-faf-mcp
- Repository: https://github.com/Wolfe-Jam/claude-faf-mcp
- Website: https://faf.one/
- Changelog RSS feed: https://verifymcp.io/servers/one-faf-claude-faf-mcp/claude-faf-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/one-faf-claude-faf-mcp/claude-faf-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/one-faf-claude-faf-mcp/claude-faf-mcp