New:Introducing Socket Scanning for VS Code Marketplace Extensions.Learn more →
Get Started

@nuffo/cli

Package Overview
Dependencies
Maintainers
1
Versions
4
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@nuffo/cli

Connect Claude Code and Cursor to nuffo in one command: your agent saves ideas instead of chasing them, knows your three projects and today's three, and asks before starting a fourth.

latest
Source
npmnpm
Version
0.1.5
Version published
Maintainers
1
Created
Source

@nuffo/cli

Your AI starts everything. nuffo makes you finish.

nuffo keeps you to three things a day and three projects at a time. This CLI connects Claude Code and Cursor to it in one command: your agent can save ideas instead of chasing them, knows your projects and today's three, and asks you before it starts anything that isn't one of your projects.

npx @nuffo/cli connect

You approve a code in the browser (new to nuffo? it sends you to sign up first). That's the whole setup: it also turns on builder mode in your nuffo settings. Then restart your agent. No projects picked yet? It says so and points you to scan.

Using Claude.ai, the Claude desktop app or ChatGPT instead? No CLI needed: paste https://nuffo.app/mcp as a custom connector and sign in. Steps: nuffo.app/guide/connect.

What your agent gets

toolwhat it does
dumpSaves anything you mention (tasks, dates, wishes, links, new ideas). nuffo sorts it. Never touches today.
get_todayToday's three and the main win. Nothing picked yet? nuffo's suggestion, which only you can accept.
get_betsYour projects (three at most), shelved ones, and ideas still cooling for 7 days.
get_laterOpen tasks and deadlines, soonest first.
check_betAsks whether new work belongs to one of your projects (see below).
completeTicks off finished work. Every tick leaves a receipt you can undo.

Plus three ready-made prompts: plan my day, empty my head and wrap up.

What it never gets: a way onto today. Only you pick your three, in nuffo. Everything an agent adds or ticks off shows up in nuffo with its name on it, and can be undone.

The project check

When your agent is about to start something new (npm create, git init, git clone, cargo new/cargo init, go mod init, uv init, npx degit, npm init -y and friends, mkdir of a new top-level folder, or writing files into a brand-new folder), the hook checks it against your projects. Scratch space (temp folders, hidden folders in your home, also as the target of a clone or create) never counts:

  • inside one of your projects: it just carries on.
  • clearly part of one: nuffo links the folder to it and carries on (with an undoable receipt).
  • a folder you said isn't a side project: it stays quiet there for good.
  • anything else: Claude Code (or Cursor) shows you its own permission prompt with nuffo's question. Yes lets it through just this once. Once the command has actually run, it's logged for Sunday's review and nuffo won't ask again there for 30 minutes. A "no" leaves nothing behind: a retry asks again. No, and your agent asks what you'd rather:
[add to a project]  [cool it 7d]  [swap a project]  [not a side project]

add to a project remembers the folder, so next time it just carries on. cool it 7d saves the idea to wait a week. swap a project cools the idea too and gives you the link to shelve one of your projects; the new one can take its place once it has cooled (7 days). not a side project is for the day job: nuffo leaves that folder or repo alone from then on (see them in nuffo → settings → work folders).

No projects picked yet? Then there's nothing to protect and the hook stays quiet. Run npx @nuffo/cli scan or pick them at nuffo.app/app/three.

The check is part of Pro (builder mode). On Free your agent still gets everything else: saving, your projects, today's three, ticking things off.

What connect changes on your machine

wherewhat
~/.nuffo/config.jsonYour token. Only you can read it (mode 600).
~/.nuffo/hook.mjsThe hook script (no dependencies).
Claude CodeMCP server added with claude mcp add --transport http --scope user; hooks in ~/.claude/settings.json (PreToolUse and PostToolUse for Bash and Write/Edit, SessionStart); a short rules block in ~/.claude/CLAUDE.md between <!-- nuffo:start --> and <!-- nuffo:end -->.
CursorMCP server in ~/.cursor/mcp.json (mode 600); hooks in ~/.cursor/hooks.json (beforeShellExecution, afterShellExecution, sessionStart, which also carries the rules).

Only the agents you have are set up. Every file is backed up before it's changed (*.nuffo-backup-<time>, and the very first original as *.nuffo-backup). A settings file that isn't valid JSON is never overwritten: that step is skipped and the summary says so.

Commands

npx @nuffo/cli connect      # pair this machine and set everything up
npx @nuffo/cli status       # what's installed, and whether nuffo answers
npx @nuffo/cli disconnect   # remove everything it added and revoke the token
npx @nuffo/cli scan         # find your git repos and send the ones you pick to nuffo to choose projects from (--all, --json)
npx @nuffo/cli --version

disconnect removes the MCP entries, hooks and rules block and revokes the token at once. Your lists stay in nuffo.app. On a machine where nothing was set up it says "nothing to remove" instead of claiming success.

Safe by design

  • The token is made on your machine. nuffo only ever receives its hash. It never appears in output.
  • Hooks fail open. If nuffo is down, slow (over ~3.5 s) or the token was revoked, your command runs as normal and you see one nuffo: … line about it, once per session. Your agent is never blocked by nuffo being away.
  • Your permission prompts stay yours. The hook never auto-approves anything for your agent.
  • Git remotes are sent without credentials, and only to tell which project a folder belongs to.
  • Text from your lists reaches your agent fenced as data, never as instructions.

Requirements

  • Node 18 or newer.
  • Claude Code: the claude command on your PATH for the MCP part (hooks and rules are set up either way).
  • Cursor: a recent version with hooks.
  • A nuffo account (sign up free). Free connects one AI; Pro connects every AI you use.

Troubleshooting

  • "a newer nuffo cli is out": npx sometimes runs a cached copy. Use npx @nuffo/cli@latest connect.
  • "That code expired": approval waits 10 minutes. Run npx @nuffo/cli connect again.
  • "Free connects 1 AI" at approval: remove another connection in nuffo → settings → your AI and shortcuts, or go Pro.
  • Agent doesn't see nuffo: restart it after connecting. Then npx @nuffo/cli status.
  • A step shows ✗: the summary says why; fix it and run connect again. It's safe to run twice.

MIT licensed. go live a little.

Keywords

claude-code

FAQs

Package last updated on 16 Oct 2026

Related posts