.FAF Context

NPM · FAF-MCP · SCANNED AUG 3

Dedicated IDE Edition. Persistent project context for Cursor, Windsurf, Cline, VS Code.

Available components

+12 this week 65 65 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security80

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (114 of 118), so this covers what we could see, not the whole tree.Partial
Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does. View diagnostics → Partial
Only part of the dependency tree could be resolved (114 of 118), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 33 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability85

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (excellent).Pass
Tool/resource definitions use about 1665 tokens (~92/item across 18 items; 15 tools + 3 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · faf-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add one-faf-faf-mcp -- npx -y faf-mcp

# add to Codex CLI

codex mcp add one-faf-faf-mcp -- npx -y faf-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "one-faf-faf-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "faf-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add one-faf-faf-mcp --command npx --arg -y --arg faf-mcp

# ~/.hermes/config.yaml

mcp_servers:
  one-faf-faf-mcp:
    command: "npx"
    args: ["-y", "faf-mcp"]

// mcp.json

{
  "mcpServers": {
    "one-faf-faf-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "faf-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +39
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- The scripts that run when this package is installed changed: postinstall security
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: MIT functional
1 Aug 26 −5
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
31 Jul 26 −4
- First check of Stability: unverified security
- First check of MCP protocol: pass functional
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 +11
- Malware scan: pass → unverified ▼ security
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
28 Jul 26 −29
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
27 Jul 26 53

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Install scripts 1 script

Hook	Tier	Command
postinstall	unreviewed	`node scripts/postinstall.js`

Dependencies 114 packages

114 packages in the resolved dependency tree · 114 deprecated · 33 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 15 exposed · ~1,626 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

faf_about ~73

Explain what the .faf format is — the IANA-registered, portable context file (application/vnd.faf+yaml) that gives any AI instant project understanding. Returns a plain-language overview of the format and its purpose. Use this when you or the user are new to FAF and want the concept before running other tools.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

faf_agents ~141

Import, export, or sync context between AGENTS.md (the OpenAI/Codex convention) and project.faf. Returns the merged or written result for the chosen action. Use this to keep a Codex/OpenAI-style AGENTS.md and your .faf in agreement from one source.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action: import (AGENTS.md -> .faf), export (.faf -> AGENTS.md), sync (bidirectional)
force	boolean	—	Force overwrite existing files
merge	boolean	—	Merge imported data with existing .faf instead of replacing
path	string	—	Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_auto ~103

Run the full setup pipeline in one call — init, stack detection, sync, bi-sync, and score — taking a project from no context to a complete project.faf. Returns the final AI-readiness score and what was created. Use this as the fast path on a fresh project; use the individual tools when you need finer control.

Input Output Examples

Name	Type	Req	Description
force	boolean	—	Force overwrite existing files
path	string	—	Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_bi_sync ~211

Bi-directionally sync a project.faf with CLAUDE.md and, with the format flags or all, also AGENTS.md, .cursorrules, and GEMINI.md. Returns the formats written and any conflicts. Use this to keep every AI tool context file aligned from the single .faf source.

Input Output Examples

Name	Type	Req	Description
agents	boolean	—	Also sync to AGENTS.md (OpenAI/Codex format)
all	boolean	—	Sync to ALL formats: CLAUDE.md + AGENTS.md + .cursorrules + GEMINI.md
auto	boolean	—	Enable automatic synchronization
cursor	boolean	—	Also sync to .cursorrules (Cursor IDE format)
force	boolean	—	Force overwrite conflicting changes
gemini	boolean	—	Also sync to GEMINI.md (Google Gemini format)
path	string	—	Project path. Sets session context for subsequent calls.
watch	boolean	—	Start real-time file watching for changes

No output schema declared.

No examples provided.

faf_check ~100

Inspect the human_context fields and rate each empty/generic/good/excellent. Returns the ratings; with protect it locks good/excellent fields from being overwritten, with unlock it releases them. Use this to gauge context quality and guard your best answers.

Input Output Examples

Name	Type	Req	Description
path	string	—	Project path. Sets session context for subsequent calls.
protect	boolean	—	Lock good/excellent fields from being overwritten
unlock	boolean	—	Remove all field protections

No output schema declared.

No examples provided.

faf_context ~65

Set or show the active project path that later faf_ calls resolve against. Returns the current context path. Call this once at the start of a session so the other tools target the right project.

Input Output Examples

Name	Type	Req	Description
path	string	—	Set active project path. If omitted, shows current context.

No output schema declared.

No examples provided.

faf_cursor ~136

Import, export, or sync context between .cursorrules (the Cursor IDE convention) and project.faf. Returns the merged or written result for the chosen action. Use this to keep Cursor rules and your .faf in agreement from one source.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action: import (.cursorrules -> .faf), export (.faf -> .cursorrules), sync (bidirectional)
force	boolean	—	Force overwrite existing files
merge	boolean	—	Merge imported data with existing .faf instead of replacing
path	string	—	Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_doctor ~72

Diagnose a project.faf setup — report missing files, empty or weak slots, and common configuration issues, each with how to fix it. Returns a prioritized checklist. Use this when your score is low and you need to know why.

Input Output Examples

Name	Type	Req	Description
path	string	—	Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_gemini ~137

Import, export, or sync context between GEMINI.md (the Google Gemini CLI convention) and project.faf. Returns the merged or written result for the chosen action. Use this to keep a Gemini context file and your .faf in agreement from one source.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action: import (GEMINI.md -> .faf), export (.faf -> GEMINI.md), sync (bidirectional)
force	boolean	—	Force overwrite existing files
merge	boolean	—	Merge imported data with existing .faf instead of replacing
path	string	—	Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_git ~105

Generate a project.faf from any public GitHub repository URL — fetches the repo and extracts its stack and context. Returns the generated .faf. Use this to bootstrap context for a project you have the URL for but not cloned locally.

Input Output Examples

Name	Type	Req	Description
path	string	—	Output directory for generated project.faf. If omitted, returns content without writing.
url	string	yes	GitHub repository URL (e.g., https://github.com/owner/repo or owner/repo)

No output schema declared.

No examples provided.

faf_go ~129

Drive a project.faf to 100% through a guided interview — returns the next questions for the missing human-context and goal fields, then applies the answers passed back. Returns the updated score after each round. Use this to close the gap to a complete context when auto-detection cannot fill the human slots.

Input Output Examples

Name	Type	Req	Description
answers	object	—	Answers to apply. Keys are field paths (e.g., "project.goal", "human_context.why"), values are the answers. If provided, applies answers and returns new score.
path	string	—	Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_init ~128

Create a project.faf for a project, making it instantly AI-readable. Returns the new file location and starting score. Accepts a path or bare project name (e.g. ~/Projects/my-app, my-app) and omitting it uses the current directory.

Input Output Examples

Name	Type	Req	Description
force	boolean	—	Overwrite existing project.faf if it exists
path	string	—	Project path or name. Smart resolution: "my-app" finds ~/Projects/my-app OR ~/Code/my-app. Full paths like ~/Projects/app or /Users/me/code/app work too. Omit to use current directory.

No output schema declared.

No examples provided.

faf_score ~91

Calculate a project.faf AI-readiness score (0-100%) from the populated context slots. Returns the percentage and tier, and with details a slot-by-slot breakdown with improvement suggestions. Use this to measure how complete the AI context is and what to fill next.

Input Output Examples

Name	Type	Req	Description
details	boolean	—	Include detailed breakdown and improvement suggestions
path	string	—	Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_sync ~82

Sync a project.faf with CLAUDE.md so the two stay aligned. Returns what was written. Use this for the single CLAUDE.md target; use faf_bi_sync to fan out to AGENTS.md, .cursorrules, and GEMINI.md as well.

Input Output Examples

Name	Type	Req	Description
path	string	—	Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_trust ~53

Validate a project.faf for structural integrity and field consistency. Returns trust metrics flagging malformed, missing, or contradictory data. Use this to confirm the context is sound before relying on it or syncing it to other formats.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug