# .FAF Context (npm · faf-mcp)

Dedicated IDE Edition. Persistent project context for Cursor, Windsurf, Cline, VS Code.

- Trust score: 65/100 (medium)
- Change this week: +12
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `faf-mcp`: 65/100 (this document), [markdown](https://verifymcp.io/servers/one-faf-faf-mcp/faf-mcp.md), [page](https://verifymcp.io/servers/one-faf-faf-mcp/faf-mcp)

## Channel facts

- Registry: `npm`
- Package: `faf-mcp`
- Version: `2.3.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 80/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (114 of 118), so this covers what we could see, not the whole tree.
  - Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does.
  - Only part of the dependency tree could be resolved (114 of 118), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 33 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1665 tokens (~92/item across 18 items; 15 tools + 3 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add one-faf-faf-mcp -- npx -y faf-mcp
```

### Codex

```bash
codex mcp add one-faf-faf-mcp -- npx -y faf-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "one-faf-faf-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "faf-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add one-faf-faf-mcp --command npx --arg -y --arg faf-mcp
```

### Hermes

```yaml
mcp_servers:
  one-faf-faf-mcp:
    command: "npx"
    args: ["-y", "faf-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "one-faf-faf-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "faf-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 65, +39)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The scripts that run when this package is installed changed: postinstall
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 26, −5)

- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified

### 2026-07-31 (score 31, −4)

- [security] First check of Stability: unverified
- [functional] First check of MCP protocol: pass
- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 35, +11)

- [security regression] Malware scan: pass → unverified
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100

### 2026-07-28 (score 24, −29)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified

### 2026-07-27 (score 53)

First indexed and scored.

## MCP tools (15)

### `faf_about` (~73 tokens)

Explain what the .faf format is — the IANA-registered, portable context file (application/vnd.faf+yaml) that gives any AI instant project understanding. Returns a plain-language overview of the format and its purpose. Use this when you or the user are new to FAF and want the concept before running other tools.

### `faf_score` (~91 tokens)

Calculate a project.faf AI-readiness score (0-100%) from the populated context slots. Returns the percentage and tier, and with details a slot-by-slot breakdown with improvement suggestions. Use this to measure how complete the AI context is and what to fill next.

Input parameters:

- `details` (boolean): Include detailed breakdown and improvement suggestions
- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_init` (~128 tokens)

Create a project.faf for a project, making it instantly AI-readable. Returns the new file location and starting score. Accepts a path or bare project name (e.g. ~/Projects/my-app, my-app) and omitting it uses the current directory.

Input parameters:

- `force` (boolean): Overwrite existing project.faf if it exists
- `path` (string): Project path or name. Smart resolution: "my-app" finds ~/Projects/my-app OR ~/Code/my-app. Full paths like ~/Projects/app or /Users/me/code/app work too. Omit to use current directory.

### `faf_trust` (~53 tokens)

Validate a project.faf for structural integrity and field consistency. Returns trust metrics flagging malformed, missing, or contradictory data. Use this to confirm the context is sound before relying on it or syncing it to other formats.

### `faf_sync` (~82 tokens)

Sync a project.faf with CLAUDE.md so the two stay aligned. Returns what was written. Use this for the single CLAUDE.md target; use faf_bi_sync to fan out to AGENTS.md, .cursorrules, and GEMINI.md as well.

Input parameters:

- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_bi_sync` (~211 tokens)

Bi-directionally sync a project.faf with CLAUDE.md and, with the format flags or all, also AGENTS.md, .cursorrules, and GEMINI.md. Returns the formats written and any conflicts. Use this to keep every AI tool context file aligned from the single .faf source.

Input parameters:

- `agents` (boolean): Also sync to AGENTS.md (OpenAI/Codex format)
- `all` (boolean): Sync to ALL formats: CLAUDE.md + AGENTS.md + .cursorrules + GEMINI.md
- `auto` (boolean): Enable automatic synchronization
- `cursor` (boolean): Also sync to .cursorrules (Cursor IDE format)
- `force` (boolean): Force overwrite conflicting changes
- `gemini` (boolean): Also sync to GEMINI.md (Google Gemini format)
- `path` (string): Project path. Sets session context for subsequent calls.
- `watch` (boolean): Start real-time file watching for changes

### `faf_check` (~100 tokens)

Inspect the human_context fields and rate each empty/generic/good/excellent. Returns the ratings; with protect it locks good/excellent fields from being overwritten, with unlock it releases them. Use this to gauge context quality and guard your best answers.

Input parameters:

- `path` (string): Project path. Sets session context for subsequent calls.
- `protect` (boolean): Lock good/excellent fields from being overwritten
- `unlock` (boolean): Remove all field protections

### `faf_context` (~65 tokens)

Set or show the active project path that later faf_ calls resolve against. Returns the current context path. Call this once at the start of a session so the other tools target the right project.

Input parameters:

- `path` (string): Set active project path. If omitted, shows current context.

### `faf_go` (~129 tokens)

Drive a project.faf to 100% through a guided interview — returns the next questions for the missing human-context and goal fields, then applies the answers passed back. Returns the updated score after each round. Use this to close the gap to a complete context when auto-detection cannot fill the human slots.

Input parameters:

- `answers` (object): Answers to apply. Keys are field paths (e.g., "project.goal", "human_context.why"), values are the answers. If provided, applies answers and returns new score.
- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_auto` (~103 tokens)

Run the full setup pipeline in one call — init, stack detection, sync, bi-sync, and score — taking a project from no context to a complete project.faf. Returns the final AI-readiness score and what was created. Use this as the fast path on a fresh project; use the individual tools when you need finer control.

Input parameters:

- `force` (boolean): Force overwrite existing files
- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_doctor` (~72 tokens)

Diagnose a project.faf setup — report missing files, empty or weak slots, and common configuration issues, each with how to fix it. Returns a prioritized checklist. Use this when your score is low and you need to know why.

Input parameters:

- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_agents` (~141 tokens)

Import, export, or sync context between AGENTS.md (the OpenAI/Codex convention) and project.faf. Returns the merged or written result for the chosen action. Use this to keep a Codex/OpenAI-style AGENTS.md and your .faf in agreement from one source.

Input parameters:

- `action` (string, required): Action: import (AGENTS.md -> .faf), export (.faf -> AGENTS.md), sync (bidirectional)
- `force` (boolean): Force overwrite existing files
- `merge` (boolean): Merge imported data with existing .faf instead of replacing
- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_cursor` (~136 tokens)

Import, export, or sync context between .cursorrules (the Cursor IDE convention) and project.faf. Returns the merged or written result for the chosen action. Use this to keep Cursor rules and your .faf in agreement from one source.

Input parameters:

- `action` (string, required): Action: import (.cursorrules -> .faf), export (.faf -> .cursorrules), sync (bidirectional)
- `force` (boolean): Force overwrite existing files
- `merge` (boolean): Merge imported data with existing .faf instead of replacing
- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_gemini` (~137 tokens)

Import, export, or sync context between GEMINI.md (the Google Gemini CLI convention) and project.faf. Returns the merged or written result for the chosen action. Use this to keep a Gemini context file and your .faf in agreement from one source.

Input parameters:

- `action` (string, required): Action: import (GEMINI.md -> .faf), export (.faf -> GEMINI.md), sync (bidirectional)
- `force` (boolean): Force overwrite existing files
- `merge` (boolean): Merge imported data with existing .faf instead of replacing
- `path` (string): Project path. Sets session context for subsequent calls.

### `faf_git` (~105 tokens)

Generate a project.faf from any public GitHub repository URL — fetches the repo and extracts its stack and context. Returns the generated .faf. Use this to bootstrap context for a project you have the URL for but not cloned locally.

Input parameters:

- `path` (string): Output directory for generated project.faf. If omitted, returns content without writing.
- `url` (string, required): GitHub repository URL (e.g., https://github.com/owner/repo or owner/repo)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/one-faf-faf-mcp/faf-mcp#diagnostics

## Score history

- 2026-08-03: 65
- 2026-08-02: 65
- 2026-08-01: 26
- 2026-07-31: 31
- 2026-07-30: 35
- 2026-07-28: 24
- 2026-07-27: 53

## Links

- npm package: https://www.npmjs.com/package/faf-mcp
- Socket report: https://socket.dev/npm/package/faf-mcp
- Repository: https://github.com/Wolfe-Jam/faf-mcp
- Website: https://faf.one/
- Changelog RSS feed: https://verifymcp.io/servers/one-faf-faf-mcp/faf-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/one-faf-faf-mcp/faf-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/one-faf-faf-mcp/faf-mcp