
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
Persistent AI context + memory — .faf and .fafm, IANA-registered. Anthropic-merged.
One .faf file → AGENTS.md · CLAUDE.md · GEMINI.md · .cursorrules,
detected from your real stack, scored, and versioned with your code. No drift. No re-explaining.
Over 100k downloads · see faf.one/downloads for latest stats · IANA-registered · Anthropic-merged (#2759)
⭐ A star helps other devs find faf-cli — despite the downloads, ~3 of 4 devs check stars.
FAF defines. MD instructs. AI codes.
project/
├── package.json ← npm reads this
├── project.faf ← AI reads this
├── README.md ← humans read this
└── src/
Every building requires a foundation. FAF is AI's foundational layer.
You have a
package.json. AI needs you to add aproject.faf. Done.
Git-Native. project.faf versions with your code — every clone, every fork, every checkout gets full AI context.
No setup, no drift, no re-explaining.
bunx faf # Bun — zero install, fastest path
npx faf # npm — works everywhere
brew install wolfe-jam/faf/faf-cli && faf # Homebrew (auto-taps)
fafis shorthand forfaf-cli auto— same behavior, fewer keystrokes.
# ANY GitHub repo — no clone, no install, 2 seconds
bunx faf-cli git https://github.com/facebook/react
# Your own project
bunx faf-cli init # Create .faf
bunx faf-cli auto # Zero to 100% in one command
bunx faf-cli go # Interactive interview to gold code
Run faf with no arguments:

faf-cli dogfoods itself — project.faf is source DNA; CLAUDE.md and GEMINI.md are authored from it via
faf. AGENTS.md is the BETTER ops briefing (hand-kept for agents;faf export --agentsstill authors AGENTS.md for other repos).
| Command | What it does |
|---|---|
faf init | Create project.faf from your local project |
faf git <url> | Instant .faf from any GitHub repo — no clone |
faf auto | Detect stack, fill every slot it can, score |
faf go | Guided interview to fill the human-only slots |
faf score | Check AI-readiness (0–100%) |
faf export | Author AGENTS.md, CLAUDE.md, GEMINI.md, .cursorrules |
faf sync | Bi-directional .faf ↔ CLAUDE.md |
faf memory | .fafm soul ops — convert Claude memory, etch, recall, ls, show |
faf diff / log | Semantic context diff + score timeline across git history |
faf hooks --install | Pre-commit guard against context regression |
faf compile / decompile | .faf ↔ .fafb sealed binary |
faf check | Validate a .faf file |
faf recover | Rebuild .faf from an existing CLAUDE.md / AGENTS.md |
faf show | Render project.faf to a browsable HTML page |
faf formats | List supported stacks and formats |
Run faf --help for the full command set and options.
.fafm) — new in 7.2.0Portable agent memory in the IANA-registered .fafm format. Same INTEROP as claude-fafm-sdk 1.0.
# Claude Code memory dir → soul.fafm
faf memory convert ~/.claude/projects/.../memory -o soul.fafm
faf memory ls # ranked facts
faf memory recall "your query" # deterministic filter + rank
faf memory etch "a durable fact" --id my-fact
faf memory show
Content-aware Swift — Package.swift alone ≠ app. Libraries stay libraries.
swift build).Gemfile alone ≠ Rails · JVM (7.5.x) pom/gradle alone ≠ type · C# (7.4.0) .csproj alone ≠ type · Go (7.3.0) go.mod alone ≠ backend.pubspec ≠ Flutter — pure Dart stays Dart. Same content-aware detection as the Dart Edition. 7.2.1 refreshes the single-source knowledge table: Riverpod annotation, Flutter Hooks, Beamer, Routemaster, Jaspr, Relic, and more MCP package names — still one classifier, composed by the MCPs.
Your own rules for the AI — "use full words in identifiers," "use bun, not npm" — go in project.faf under ai_instructions.warnings. They land at the top of every AGENTS.md faf writes, verbatim and non-destructive.
→ How to add custom rules · docs.faf.one
✪ Trophy 100% — all or nothing. From v6.6.0 onward, faf-cli recommends only Trophy. 100% on the FCL is what makes the layers above (MD instructions, Agents, AI tooling) work — sub-Trophy leaves gaps that AI guesses on. Sub-Trophy tiers (including Bronze 85) remain on the ladder as honest interim states — they are not deleted; we just no longer aim for 85 as the goal.
| Tier | Score | Status |
|---|---|---|
| ✪ Trophy | 100% | AI never has to guess — target |
| ★ Gold | 99%+ | 1 slot from Trophy |
| ◆ Silver | 95%+ | Close — keep going |
| ◇ Bronze | 85%+ | On the ladder (was the old recommend-min; not the target) |
| ● Green | 70%+ | Interim — keep going |
| ● Yellow | 55%+ | AI flipping coins |
| ○ Red | <55% | AI working blind |
| ♡ White | 0% | No context at all |
One score, three glyphs: ✪ work (CLI · docs · receipts) · 🏆 social (X · blogs) · Trophy Mark PNG (brand). Source of truth: src/core/tiers.ts.
bi-sync: .faf ←── 8ms ──→ CLAUDE.md
tri-sync: .faf ←── 8ms ──→ CLAUDE.md ↔ MEMORY.md
The full manual lives at docs.faf.one — facts for devs, faf-cli first.
For a specific agent: Grok, xAI & Cursor 👀 · Claude Code 👀 · Bun 👀
Pivotal releases — full history in CHANGELOG.md:
faf export --agents authors a complete, non-destructive AGENTS.md.faf diff / log / hooks.faf export --copilot writes the file GitHub Copilot reads.faf loop drives any repo to ✪ 100% or the honest human wall.faf show renders a .faf to a browsable page. (FAF defines. MD instructs. AI codes. HTML shows.)Bun's single-file compiler produces standalone binaries — no runtime needed.
bun run compile # Current platform
bun run compile:all # darwin-arm64, darwin-x64, linux-x64, windows-x64
Ship faf as a single binary for CI/CD, Docker, or air-gapped environments.
src/
├── cli.ts ← Entry point (Commander registrations)
├── commands/ ← one file per faf subcommand
├── core/ ← Types, slots (Mk4), tiers, scorer, schema
├── detect/ ← Framework detection, stack scanner
├── interop/ ← YAML I/O, CLAUDE.md, AGENTS.md, GEMINI.md
├── ui/ ← Colors (#00D4D4), display
└── wasm/ ← faf-scoring-kernel wrapper (Rust → WASM)
Toolchain: Bun (test, build, compile) · TypeScript (strict) · WASM (scoring kernel)
Robust. Reliable. Next-level WJTTC tested. — The Foundation Edition.
bun test # extensive WJTTC + e2e suite
Test reports in reports/.
If faf-cli has been useful, consider starring the repo — it helps others find it.
If you use faf-cli or the .faf / .fafm formats in research or production, please cite the format papers:
Wolfe, J. (2025). Format-Driven AI Context Architecture: The .faf Standard for Persistent Project Understanding. Zenodo. https://doi.org/10.5281/zenodo.18251362
Wolfe, J. (2026). Permanent Memory and Instant Recall: The .fafm Standard for Multi-Profile AI Agent Memory. Zenodo. https://doi.org/10.5281/zenodo.20348942
@article{wolfe2025faf,
title = {Format-Driven AI Context Architecture: The .faf Standard for Persistent Project Understanding},
author = {Wolfe, James},
year = {2025},
month = {nov},
publisher = {Zenodo},
doi = {10.5281/zenodo.18251362},
url = {https://doi.org/10.5281/zenodo.18251362}
}
@article{wolfe2026fafm,
title = {Permanent Memory and Instant Recall: The .fafm Standard for Multi-Profile AI Agent Memory},
author = {Wolfe, James},
year = {2026},
month = {may},
publisher = {Zenodo},
doi = {10.5281/zenodo.20348942},
url = {https://doi.org/10.5281/zenodo.20348942}
}
MIT — Free and open source
IANA-registered: application/vnd.faf+yaml (Context Layer) · application/vnd.fafm+yaml (Memory Layer)
format | driven 🏎️⚡️ wolfejam.dev · faf.one/cli
FAQs
Persistent AI context + memory — .faf and .fafm, IANA-registered. Anthropic-merged.
The npm package faf-cli receives a total of 1,294 weekly downloads. As such, faf-cli popularity was classified as popular.
We found that faf-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.