io.github.TheRealFloatDev/agentsbestfriend
NPM · AGENTSBESTFRIEND · SCANNED SEP 20
MCP that provides fast, token-efficient tools for navigating, searching, and understanding codebases
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 25 of 55 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 150 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability72
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1812 tokens (~139/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.TheRealFloatDev/agentsbestfriend MCP server?
io.github.TheRealFloatDev/agentsbestfriend runs locally as an npm package, launched with npx -y agentsbestfriend. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · agentsbestfriend
claude mcp add therealfloatdev-agentsbestfriend -- npx -y agentsbestfriend
{
"mcpServers": {
"therealfloatdev-agentsbestfriend": {
"command": "npx",
"args": [
"-y",
"agentsbestfriend"
]
}
}
} {
"servers": {
"therealfloatdev-agentsbestfriend": {
"command": "npx",
"args": [
"-y",
"agentsbestfriend"
]
}
}
} codex mcp add therealfloatdev-agentsbestfriend -- npx -y agentsbestfriend
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"therealfloatdev-agentsbestfriend": {
"type": "local",
"command": [
"npx",
"-y",
"agentsbestfriend"
],
"enabled": true
}
}
} openclaw mcp add therealfloatdev-agentsbestfriend --command npx --arg -y --arg agentsbestfriend
mcp_servers:
therealfloatdev-agentsbestfriend:
command: "npx"
args: ["-y", "agentsbestfriend"] {
"McpServers": {
"therealfloatdev-agentsbestfriend": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"agentsbestfriend"
]
}
}
} assistant mcp add therealfloatdev-agentsbestfriend -t stdio -c npx -a -y agentsbestfriend
{
"mcpServers": {
"therealfloatdev-agentsbestfriend": {
"command": "npx",
"args": [
"-y",
"agentsbestfriend"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 −2
- Stability: pass → 0.80 functional
- 18 Sept 26 0
- Stability: 0.97 → pass security
- 17 Sept 26 +1
- Security disclosure: unverified → fail ▼ functional
- 16 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 −2
- Stability: pass → 0.80 functional
- 11 Sept 26 0
- Stability: 0.97 → pass security
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/agentsbestfriend@0.12.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 55 packages
| Packages resolved | 55 |
|---|---|
| Deprecated | 1 |
| Stale | 24 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
abf_chunk ~161
Smart file chunking by symbol boundaries. Returns actual source code. Use EXACTLY ONE of these modes: - symbol: pass a symbol name to get its full source code directly - chunk_index: pass a 0-based chunk index to get that chunk's code - (neither): returns a chunk overview listing — use this first to discover available chunks, then call again with chunk_index to retrieve code
| Name | Type | Req | Description |
|---|---|---|---|
| chunk_index | integer | – | 0-based chunk index to retrieve that chunk's source code. Get the index from the overview first. |
| file_path | string | yes | Path to the file (relative or absolute) |
| symbol | string | – | Name of a symbol (function, class, etc.) to retrieve its full source code directly. |
No output schema declared.
No examples provided.
abf_context_bundle ~267
Bundle multi-file context around an entry point in a single call. Traverses the import graph from the entry file, collecting symbols and optionally source code from all connected files. Replaces multiple read_file + abf_symbols + abf_dependencies calls with one compact result. Modes: - "signatures": compact — shows exported symbols with type signatures for all files (lowest tokens) - "full": returns full source code for all files up to the specified depth - "smart" (default): full source code for the entry file, signatures for dependencies Use focus_symbol to narrow the bundle to only imports relevant to a specific function/class. Use reverse=true to also find files that import the entry file.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | How deep to follow the import graph (0 = entry only, default: 1) |
| entry | string | yes | Entry file path (relative to project root or absolute) |
| focus_symbol | string | – | Focus on a specific symbol — only follows imports relevant to this function/class |
| include | string | – | What to include: "signatures" (compact types), "full" (source code), "smart" (full entry + signature deps) |
| reverse | boolean | – | Also include files that import the entry file (reverse dependencies) |
No output schema declared.
No examples provided.
abf_conventions ~107
Detect codebase conventions by analyzing file names, folder structure, design patterns, and config files. Returns detected conventions with confidence scores and examples. Purely heuristic — no LLM required. Useful to understand a project's style before making changes.
| Name | Type | Req | Description |
|---|---|---|---|
| aspect | string | – | Which conventions to detect: "naming" (file/variable casing), "structure" (folder organization), "patterns" (design patterns), "formatting" (indent, quotes, tooling), or "all" |
No output schema declared.
No examples provided.
abf_dependencies ~58
Show imports and reverse dependencies (imported_by) for a file.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Depth of transitive dependencies |
| direction | string | – | Which direction to analyze |
| file_path | string | yes | Path to the file |
No output schema declared.
No examples provided.
abf_file_summary ~191
Search across LLM-generated file summaries using full-text search. Returns files whose summaries match the query, ranked by relevance (BM25). Useful when exploring a codebase by concept rather than exact code text. Default mode is "or" — matches files containing ANY of the query terms, ranked by how many match. Use "and" mode to require ALL terms to be present. Requires summaries to be generated first (run abf_index with action=summarize).
| Name | Type | Req | Description |
|---|---|---|---|
| match_mode | string | – | "or": match files with ANY keyword (default, broader results). "and": require ALL keywords. |
| max_results | integer | – | Maximum number of results (default: 10) |
| path_filter | string | – | Optional prefix filter for file paths, e.g. "src/" or "packages/core" |
| query | string | yes | Search query — space-separated keywords to match against file summaries |
No output schema declared.
No examples provided.
abf_git ~104
Query git history, blame, and diff for the project.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Git action: log (recent commits), file_history, blame, diff |
| count | integer | – | Number of commits (log, file_history) |
| file_path | string | – | File path (required for file_history, blame; optional for diff) |
| line_end | integer | – | End line for blame range |
| line_start | integer | – | Start line for blame range |
No output schema declared.
No examples provided.
abf_impact ~69
Find all files and lines that reference a given symbol name. Useful for change impact analysis.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | – | Optional: scope search to usages of this symbol from this file |
| symbol | string | yes | The symbol (function, class, variable) name to find references for |
No output schema declared.
No examples provided.
abf_index ~81
Manage the file index: check status, trigger rebuild, incremental update, or generate LLM summaries. Rebuild/update will auto-generate summaries when Ollama is available.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | status: show index info, rebuild: full re-index, update: incremental update, summarize: (re)generate LLM file summaries (requires Ollama) |
No output schema declared.
No examples provided.
abf_notes ~246
Agent notepad — persist notes across sessions in a local SQLite database (.abf/notes.db). Supports save, get, list, search (full-text via FTS5), update, and delete actions. Use this to store task context, decisions, TODOs, or anything that should survive between conversations. Notes are project-scoped and independent from the code index (survive re-indexing).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The operation to perform |
| content | string | – | Note body (required for save, optional for update) |
| id | integer | – | Note ID (for get, update, delete) |
| limit | integer | – | Max results for list/search (default: 20) |
| match_mode | string | – | "or": match notes with ANY keyword (default). "and": require ALL keywords. |
| query | string | – | Search query for full-text search (FTS5) |
| tag | string | – | Filter notes by a specific tag (for list) |
| tags | string | – | Comma-separated tags, e.g. "todo,architecture,auth" |
| title | string | – | Note title (required for save, optional for update) |
No output schema declared.
No examples provided.
abf_ping ~49
Health check tool. Returns server status and project root. Use this to verify the ABF MCP server is running correctly.
| Name | Type | Req | Description |
|---|---|---|---|
| include_config | boolean | – | Include current ABF configuration in the response |
No output schema declared.
No examples provided.
abf_project_overview ~88
Get a comprehensive overview of the current project. Returns detected tech stack, frameworks, entry points, directory structure with purposes, language distribution, config files, and architectural patterns. Very token-efficient way to orient yourself in a new codebase. No index required.
| Name | Type | Req | Description |
|---|---|---|---|
| detail_level | string | – | "compact" for top-level summary (default), "detailed" for full directory breakdown |
No output schema declared.
No examples provided.
abf_search ~270
Search code in the project using multiple modes: - "exact": Fast ripgrep-based search for exact strings or regex patterns. Returns matching lines with file path, line number, and surrounding context. - "keyword": Exploratory search — splits the query into keywords, scores every file by keyword density, returns the top matching files ranked by relevance. Best when you're not sure of exact names. - "semantic": (Requires Ollama + embeddings index) Embedding-based similarity search. Falls back to keyword mode if unavailable. Use "exact" when you EXACTLY know what to search for. Use "keyword" when exploring or looking for files related to a concept.
| Name | Type | Req | Description |
|---|---|---|---|
| case_sensitive | boolean | – | Case-sensitive search (exact mode only) |
| max_results | integer | – | Maximum number of results to return (default: 20) |
| mode | string | – | Search mode: "exact" (ripgrep), "keyword" (file scoring), or "semantic" (embedding similarity) |
| path_filter | string | – | Glob pattern to filter files, e.g. "src/**/*.ts" or "*.py" |
| query | string | yes | Search query — exact text, regex, or space-separated keywords depending on mode |
| regex | boolean | – | Treat query as regex pattern (exact mode only) |
No output schema declared.
No examples provided.
abf_symbols ~55
Get the symbol outline (functions, classes, methods, types) of a file.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | How deep to show nested symbols |
| file_path | string | yes | Path to the file (relative or absolute) |
No output schema declared.
No examples provided.
What is the io.github.TheRealFloatDev/agentsbestfriend MCP server?
io.github.TheRealFloatDev/agentsbestfriend is an MCP server listed in the public MCP registry as io.github.TheRealFloatDev/agentsbestfriend. MCP that provides fast, token-efficient tools for navigating, searching, and understanding codebases. This page covers its npm package (agentsbestfriend).
Is the io.github.TheRealFloatDev/agentsbestfriend MCP server safe to use?
io.github.TheRealFloatDev/agentsbestfriend scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.TheRealFloatDev/agentsbestfriend MCP server expose?
io.github.TheRealFloatDev/agentsbestfriend exposes 13 tools: abf_ping, abf_search, abf_project_overview, abf_git, abf_index, and 8 more. Their descriptions and schemas cost roughly 1,746 tokens of context every time the server is loaded.
Is the io.github.TheRealFloatDev/agentsbestfriend MCP server still maintained?
io.github.TheRealFloatDev/agentsbestfriend is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.TheRealFloatDev/agentsbestfriend MCP server under?
io.github.TheRealFloatDev/agentsbestfriend declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.