Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

.FAF Context

NPM · FAF-MCP · SCANNED SEP 20

.FAF Context — persistent project context for Cursor, VS Code and every MCP-compatible IDE.

Available components

npm · faf-mcp 83
−1 this week 83 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • Known CVEs were checked across the 116 of 117 dependencies we could resolve, so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Dependency health was assessed across the 116 of 117 dependencies we could resolve, so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 9 days ago).Pass
  • Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability87
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 2012 tokens (~95/item across 21 items; 15 tools + 6 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management80
  • Stability check failed: the tool surface changed between 2.3.1 and 3.0.2: 1 tool removals, 0 breaking changes, 1 additions. See how to fix → Fail
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 15 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the .FAF Context MCP server?

.FAF Context runs locally as an npm package, launched with npx -y faf-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · faf-mcp

# add to Claude Code
claude mcp add one-faf-faf-mcp -- npx -y faf-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "one-faf-faf-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "faf-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "one-faf-faf-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "faf-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add one-faf-faf-mcp -- npx -y faf-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "one-faf-faf-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "faf-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add one-faf-faf-mcp --command npx --arg -y --arg faf-mcp
# ~/.hermes/config.yaml
mcp_servers:
  one-faf-faf-mcp:
    command: "npx"
    args: ["-y", "faf-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "one-faf-faf-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "faf-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add one-faf-faf-mcp -t stdio -c npx -a -y faf-mcp
// mcp.json
{
  "mcpServers": {
    "one-faf-faf-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "faf-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 0
    • Security disclosure: pass → unverified ▼ functional
  • 19 Sept 26 0
    • Known CVEs: pass → partial ▼ security
    • Dependency health: 0.86 → partial functional
  • 18 Sept 26 −3

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 73.

  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93.

  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 77 to 80.

  • 12 Sept 26 +15
    • Malware scan: unverified → pass ▲ security
  • 11 Sept 26 +8
    • Known CVEs: unverified → pass ▲ security
    • Dependency health: unverified → 0.86 ▲ functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/faf-mcp@3.0.2

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 116 packages
Packages resolved 116
Stale 36
Tree resolution Partial

The dependency tree was only partially resolved, so these counts may be incomplete.

Background: SBOMs and build attestations, explained →

MCP tools · 15 exposed · ~1,839 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
faf_about ~73

Explain what the .faf format is — the IANA-registered, portable context file (application/vnd.faf+yaml) that gives any AI instant project understanding. Returns a plain-language overview of the format and its purpose. Use this when you or the user are new to FAF and want the concept before running other tools.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

faf_agents ~184

Import AGENTS.md (the OpenAI/Codex convention) into project.faf, or write it from project.faf. Returns the merged or written result for the chosen action. Use this to keep a Codex/OpenAI-style AGENTS.md and your .faf in agreement from one source.

NameTypeReqDescription
actionstringyesAction: import (AGENTS.md -> .faf; merge:true writes it into project.faf), export (.faf -> AGENTS.md), sync (re-writes AGENTS.md from .faf; export with force)
forceboolean–Update the faf-managed block in an existing file (content outside it is preserved)
mergeboolean–Write the imported data into project.faf (without it, import only reports the section count and writes nothing)
pathstring–Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_auto ~105

Run the setup pipeline in one call — init or merge, stack detection, CLAUDE.md, and score — taking a project from no context to a scored project.faf plus CLAUDE.md; faf_go closes the human slots. Returns the final AI-readiness score and what was created. Use this as the fast path on a fresh project; use the individual tools when you need finer control.

NameTypeReqDescription
pathstring–Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_check ~117

Inspect the human_context fields and rate each empty/generic/good. Returns the ratings; with protect it records the good fields in _protected_fields as an advisory list (other tools do not enforce it), with unlock it clears that list. Use this to gauge context quality.

NameTypeReqDescription
pathstring–Project path. Sets session context for subsequent calls.
protectboolean–Record good fields in _protected_fields (advisory; other tools do not enforce it)
unlockboolean–Clear the _protected_fields list

No output schema declared.

No examples provided.

faf_claude ~202

Write CLAUDE.md from project.faf (one direction: .faf → CLAUDE.md) and, with the format flags or all, also AGENTS.md, .cursorrules and GEMINI.md. Content outside the faf-managed block is preserved. Returns the files written. Use this to keep every AI tool's context file current from one source. (Named faf_bi_sync before 3.0.1; that name still works.)

NameTypeReqDescription
agentsboolean–Also write AGENTS.md (OpenAI/Codex format)
allboolean–Write ALL formats: CLAUDE.md + AGENTS.md + .cursorrules + GEMINI.md
cursorboolean–Also write .cursorrules (Cursor IDE format)
geminiboolean–Also write GEMINI.md (Google Gemini format)
pathstring–Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_context ~82

Set or show the active project path that later faf_ project tools resolve against (faf_read and faf_write resolve relative paths against the server's working directory instead). Returns the current context path. Call this once at the start of a session so the project tools target the right project.

NameTypeReqDescription
pathstring–Set active project path. If omitted, shows current context.

No output schema declared.

No examples provided.

faf_cursor ~181

Import .cursorrules (the Cursor IDE convention) into project.faf, or write it from project.faf. Returns the merged or written result for the chosen action. Use this to keep Cursor rules and your .faf in agreement from one source.

NameTypeReqDescription
actionstringyesAction: import (.cursorrules -> .faf; merge:true writes it into project.faf), export (.faf -> .cursorrules), sync (re-writes .cursorrules from .faf; export with force)
forceboolean–Update the faf-managed block in an existing file (content outside it is preserved)
mergeboolean–Write the imported data into project.faf (without it, import only reports the section count and writes nothing)
pathstring–Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_doctor ~74

Diagnose a project.faf setup — report missing files, the real score with populated/active slot counts, and common configuration issues, each with a fix. Returns a checklist. Use this when your score is low and you need to know why.

NameTypeReqDescription
pathstring–Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_gemini ~180

Import GEMINI.md (the Google Gemini CLI convention) into project.faf, or write it from project.faf. Returns the merged or written result for the chosen action. Use this to keep a Gemini context file and your .faf in agreement from one source.

NameTypeReqDescription
actionstringyesAction: import (GEMINI.md -> .faf; merge:true writes it into project.faf), export (.faf -> GEMINI.md), sync (re-writes GEMINI.md from .faf; export with force)
forceboolean–Update the faf-managed block in an existing file (content outside it is preserved)
mergeboolean–Write the imported data into project.faf (without it, import only reports the section count and writes nothing)
pathstring–Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_git ~129

Author a project.faf from any public GitHub repository URL — fetches the repo and extracts its stack and context. Returns the authored .faf. Use this to bootstrap context for a project you have the URL for but not cloned locally.

NameTypeReqDescription
forceboolean–Overwrite an existing project.faf at path (without it, faf_git refuses)
pathstring–Output directory for the authored project.faf. If omitted, returns content without writing.
urlstringyesGitHub repository URL (e.g., https://github.com/owner/repo or owner/repo)

No output schema declared.

No examples provided.

faf_go ~129

Drive a project.faf to 100% through a guided interview — returns the next questions for the missing human-context and goal fields, then applies the answers passed back. Returns the updated score after each round. Use this to close the gap to a complete context when auto-detection cannot fill the human slots.

NameTypeReqDescription
answersobject–Answers to apply. Keys are field paths (e.g., "project.goal", "human_context.why"), values are the answers. If provided, applies answers and returns new score.
pathstring–Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_init ~128

Create a project.faf for a project, making it instantly AI-readable. Returns the new file location and starting score. Accepts a path or bare project name (e.g. ~/Projects/my-app, my-app) and omitting it uses the current directory.

NameTypeReqDescription
forceboolean–Overwrite existing project.faf if it exists
pathstring–Project path or name. Smart resolution: "my-app" finds ~/Projects/my-app OR ~/Code/my-app. Full paths like ~/Projects/app or /Users/me/code/app work too. Omit to use current directory.

No output schema declared.

No examples provided.

faf_score ~91

Calculate a project.faf AI-readiness score (0-100%) from the populated context slots. Returns the percentage and tier, and with details a slot-by-slot breakdown with improvement suggestions. Use this to measure how complete the AI context is and what to fill next.

NameTypeReqDescription
detailsboolean–Include detailed breakdown and improvement suggestions
pathstring–Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_sync ~124

Reconcile project.faf with what the repo manifests say now (package.json name, description, framework dependencies). Dry-run by default: reports the fields that would change. Pass apply:true to write them into project.faf. Does not touch CLAUDE.md — use faf_claude for CLAUDE.md, AGENTS.md, .cursorrules and GEMINI.md.

NameTypeReqDescription
applyboolean–Write the detected changes into project.faf (default: dry-run report only)
pathstring–Project path. Sets session context for subsequent calls.

No output schema declared.

No examples provided.

faf_trust ~40

Validate a project.faf's required fields (faf_version, project.name) and about.* block with faf-cli's validator, and report its real score.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

Common questions

What is the .FAF Context MCP server?

.FAF Context is an MCP server listed in the public MCP registry as one.faf/faf-mcp. .FAF Context, persistent project context for Cursor, VS Code and every MCP-compatible IDE. This page covers its npm package (faf-mcp).

Is the .FAF Context MCP server safe to use?

.FAF Context scores 83 out of 100 on VerifyMCP. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the .FAF Context MCP server expose?

.FAF Context exposes 15 tools: faf_about, faf_score, faf_init, faf_trust, faf_sync, and 10 more. Their descriptions and schemas cost roughly 1,839 tokens of context every time the server is loaded.

Is the .FAF Context MCP server still maintained?

.FAF Context is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the .FAF Context MCP server under?

.FAF Context declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.