Install
- In the yof dashboard, open AI builders (app.yof.io/yof/builders) and press Connect on the tool. yof makes a key for this connection and puts it inside the config, so you never type it. It is shown once.
- Copy the command and run it, or paste the config.toml lines.
By hand, without a key (the account tools then explain how to connect):
[mcp_servers.yof]
command = "npx"
args = ["-y", "@yof/cli", "mcp"]What it can do
- yof_check scans the project folder for leaked keys and made-up or risky packages.
- yof_check_diff scans only what changed since the last commit, plus new files. Use it before you say a change is done.
- yof_explain, yof_fix_prompt and yof_verify explain a finding, give the exact fix steps and re-scan the file.
- With your yof key: yof_findings (your yof.io findings), yof_patch_status (Patch's pull requests and CI) and yof_lessons (notes from merged Patch fixes).
Privacy
- The scans run on your computer. Your code and file contents are never sent anywhere.
- The package check sends package names and pinned versions to npm, PyPI and OSV. Turn it off with offline: true.
- With a yof key, the server sends one ping when it starts and, for the three account tools, only the tool name and its arguments (ids and rule ids) to mcp.yof.io.
- Every answer is labelled as untrusted data from the scanned project, and secret values come back only as a short prefix plus REDACTED.