
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
Connect Claude Code and Cursor to nuffo in one command: your agent saves ideas instead of chasing them, knows your three projects and today's three, and asks before starting a fourth.
Your AI starts everything. nuffo makes you finish.
nuffo keeps you to three things a day and three projects at a time. This CLI connects Claude Code and Cursor to it in one command: your agent can save ideas instead of chasing them, knows your projects and today's three, and asks you before it starts anything that isn't one of your projects.
npx @nuffo/cli connect
You approve a code in the browser (new to nuffo? it sends you to sign up first). That's the whole setup: it also
turns on builder mode in your nuffo settings. Then restart your agent. No projects picked yet? It says so and points
you to scan.
Using Claude.ai, the Claude desktop app or ChatGPT instead? No CLI needed: paste
https://nuffo.app/mcpas a custom connector and sign in. Steps: nuffo.app/guide/connect.
| tool | what it does |
|---|---|
dump | Saves anything you mention (tasks, dates, wishes, links, new ideas). nuffo sorts it. Never touches today. |
get_today | Today's three and the main win. Nothing picked yet? nuffo's suggestion, which only you can accept. |
get_bets | Your projects (three at most), shelved ones, and ideas still cooling for 7 days. |
get_later | Open tasks and deadlines, soonest first. |
check_bet | Asks whether new work belongs to one of your projects (see below). |
complete | Ticks off finished work. Every tick leaves a receipt you can undo. |
Plus three ready-made prompts: plan my day, empty my head and wrap up.
What it never gets: a way onto today. Only you pick your three, in nuffo. Everything an agent adds or ticks off shows up in nuffo with its name on it, and can be undone.
When your agent is about to start something new (npm create, git init, git clone, cargo new/cargo init,
go mod init, uv init, npx degit, npm init -y and friends, mkdir of a new top-level folder, or writing files
into a brand-new folder), the hook checks it against your projects. Scratch space (temp folders, hidden folders in
your home, also as the target of a clone or create) never counts:
[add to a project] [cool it 7d] [swap a project] [not a side project]
add to a project remembers the folder, so next time it just carries on. cool it 7d saves the idea to wait a
week. swap a project cools the idea too and gives you the link to shelve one of your projects; the new one can
take its place once it has cooled (7 days). not a side project is for the day job: nuffo leaves that folder or
repo alone from then on (see them in nuffo → settings → work folders).
No projects picked yet? Then there's nothing to protect and the hook stays quiet. Run npx @nuffo/cli scan or pick
them at nuffo.app/app/three.
The check is part of Pro (builder mode). On Free your agent still gets everything else: saving, your projects, today's three, ticking things off.
connect changes on your machine| where | what |
|---|---|
~/.nuffo/config.json | Your token. Only you can read it (mode 600). |
~/.nuffo/hook.mjs | The hook script (no dependencies). |
| Claude Code | MCP server added with claude mcp add --transport http --scope user; hooks in ~/.claude/settings.json (PreToolUse and PostToolUse for Bash and Write/Edit, SessionStart); a short rules block in ~/.claude/CLAUDE.md between <!-- nuffo:start --> and <!-- nuffo:end -->. |
| Cursor | MCP server in ~/.cursor/mcp.json (mode 600); hooks in ~/.cursor/hooks.json (beforeShellExecution, afterShellExecution, sessionStart, which also carries the rules). |
Only the agents you have are set up. Every file is backed up before it's changed (*.nuffo-backup-<time>, and the
very first original as *.nuffo-backup). A settings file that isn't valid JSON is never overwritten: that step is
skipped and the summary says so.
npx @nuffo/cli connect # pair this machine and set everything up
npx @nuffo/cli status # what's installed, and whether nuffo answers
npx @nuffo/cli disconnect # remove everything it added and revoke the token
npx @nuffo/cli scan # find your git repos and send the ones you pick to nuffo to choose projects from (--all, --json)
npx @nuffo/cli --version
disconnect removes the MCP entries, hooks and rules block and revokes the token at once. Your lists stay in
nuffo.app. On a machine where nothing was set up it says "nothing to remove" instead of claiming success.
nuffo: … line about it, once per session. Your agent is never blocked by nuffo being away.claude command on your PATH for the MCP part (hooks and rules are set up either way).npx @nuffo/cli@latest connect.npx @nuffo/cli connect again.npx @nuffo/cli status.connect again. It's safe to run twice.MIT licensed. go live a little.
FAQs
Connect Claude Code and Cursor to nuffo in one command: your agent saves ideas instead of chasing them, knows your three projects and today's three, and asks before starting a fourth.
We found that @nuffo/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.