faf-cli

MCP server · npm · ★ 43 · graded 2026-10-24Source linked

The context every AI coding agent reads — authors AGENTS.md, CLAUDE.md, GEMINI.md & .cursorrules from your repo's real stack. IANA-registered .faf format.

No outside reports on file

This tool reads your code to help AI assistants, so review what context it generates and be careful not to commit sensitive information or share it with untrusted AI services.

Based on public adoption and transparency signals as of Oct 24, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for Faf CLI helpful?

What it can access

Local filesNo local folder access notedLOW
Command executionNo shell command runner notedLOW
Network reachLocal or standard API callsLOW
CredentialsNo API token requiredLOW
Package sourcenpm (faf-cli)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

npx -y faf-cli

All setup options ↓

Check this skill Watch it in my stack Compare Add to allowlist README badge View project

About Faf CLI

faf-cli creates context files (AGENTS.md, CLAUDE.md, GEMINI.md, .cursorrules) that tell AI coding agents about your project's tech stack and setup. It reads your repository to generate these guide files automatically, using an IANA-registered .faf file format.

Who it’s for

Developers who work with AI coding assistants (like Claude or Gemini) and want those tools to understand their project structure and coding standards without manually writing context files.

Alternatives

Manual .cursorrules / context files: Write your own project context guides without automation.
Cursor IDE built-in context: Use Cursor's native features to define project rules and stack information.
Prompt engineering: Manually craft detailed prompts to your AI assistant explaining your project structure.

Setup

Check these steps against the project’s own instructions before running anything.

Install via npm: npm install -g faf-cli or npx faf-cli. Follow the project's README for configuration details and how to run it on your repository.

Why this grade

CC — Moderate risk signals

Signal-based grade (3/7 points): listed in several sources, public source code. This reflects adoption and transparency, not a code review.

Popularity and upkeep

45/100

GitHub stars: 43
Weekly npm downloads: 2.3k
Listing last refreshed: 2026-10-28

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Security reports

No reports found for this package in our research (last checked 2026-10-29).

Check a specific version →

Risks to watch for

File system access: Reads your entire repo to build context, including secrets or private code you may not intend to share with AI models.
Generated file leaks: The created AGENTS.md and similar files could be committed to version control or sent to AI services, exposing project details.
Malicious repo content: If .faf files or configuration exist in dependencies you install, they could contain instructions that trick the AI or inject false context.
AI model exposure: Context files are typically sent to cloud-based AI services; your codebase details become part of those interactions.
Automatic overwriting: The tool regenerates context files, which could overwrite custom instructions you've written if you're not careful with version control.

How to lower the risk

Least-privilege permissions

Run faf-cli only on repositories you own or trust.
Review generated files before committing them to git.

Network isolation

faf-cli itself generates files locally; check if it phones home or uploads data.
Keep the generated context files out of public repositories if they reveal sensitive tech details.

Monitoring

Audit the AGENTS.md and similar files it creates to ensure no secrets leaked.
Check git diffs after running the tool to catch unexpected changes.

Red flags to watch for

Generated files that include API keys, passwords, or internal URLs.
Tool updates that change what data is collected or how files are formatted.

Questions

How do I install Faf CLI?

Run npx -y faf-cli in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page. Full setup docs and environment variables are in github.com/Wolfe-Jam/faf-cli.

Are there security reports about Faf CLI?

No reports found for this package in our research (last checked 2026-10-29). Faf CLI currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include file system access, generated file leaks, malicious repo content.

Is Faf CLI actively maintained?

Faf CLI has 43 GitHub stars and 2.3k weekly npm downloads. Our directory data was last refreshed on 2026-10-28. Check recent commit activity, release tags, and open issues at github.com/Wolfe-Jam/faf-cli before pinning it in production.

What are alternatives to Faf CLI?

Notable alternatives to Faf CLI include Manual .cursorrules / context files (Write your own project context guides without automation), Cursor IDE built-in context (Use Cursor's native features to define project rules and stack information), Prompt engineering (Manually craft detailed prompts to your AI assistant explaining your project structure). You can also compare Faf CLI side by side with other MCP servers in the Related tools section on this page.

Maintain or use Faf CLI? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

GitHub README Markdown:

markdown

[![AgentArmorHQ Risk Grade for Faf CLI](https://agentarmorhq.com/api/badge/wolfe-jam-faf-cli)](https://agentarmorhq.com/skills/wolfe-jam-faf-cli)

HTML embed:

html

<a href="https://agentarmorhq.com/skills/wolfe-jam-faf-cli"><img src="https://agentarmorhq.com/api/badge/wolfe-jam-faf-cli" alt="AgentArmorHQ Risk Grade for Faf CLI" height="20" /></a>

Terminal check:

terminal

curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "wolfe-jam-faf-cli"

Share with your security lead

Need sign-off to use faf-cli? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: faf-cli
- **Listing URL:** https://agentarmorhq.com/skills/wolfe-jam-faf-cli
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 43 GitHub stars, 2.3k weekly npm downloads

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Local or standard API calls
- **Credentials:** No API token required
- **Package source:** npm (faf-cli)

#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts faf-cli`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 24, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type: App connector
Publisher: Wolfe-Jam
Source code: github.com/Wolfe-Jam/faf-cli
Install command: npm install faf-cli
Est. context load: ~550 tokens / turn (~3 tool schemas, 0.27% of 200k context)
Popularity: 43 GitHub stars, 2.3k weekly npm downloads
Last updated: 2026-10-28
Last graded: 2026-10-24

Community

Discussions for Faf CLI

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for Faf CLI helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude