Install
- In the yof dashboard, open AI builders (app.yof.io/yof/builders) and press Connect on the tool. yof makes a key for this connection and puts it inside the config, so you never type it. It is shown once.
- In Cascade, open the MCP config file and paste the block it shows.
- Save and refresh the servers.
By hand, without a key (the account tools then explain how to connect):
{ "mcpServers": { "yof": { "command": "npx", "args": ["-y", "@yof/cli", "mcp"] } } }What it can do
- yof_check scans the project folder for leaked keys and made-up or risky packages.
- yof_check_diff scans only what changed since the last commit, plus new files. Use it before you say a change is done.
- yof_explain, yof_fix_prompt and yof_verify explain a finding, give the exact fix steps and re-scan the file.
- With your yof key: yof_findings (your yof.io findings), yof_patch_status (Patch's pull requests and CI) and yof_lessons (notes from merged Patch fixes).
Privacy
- The scans run on your computer. Your code and file contents are never sent anywhere.
- The package check sends package names and pinned versions to npm, PyPI and OSV. Turn it off with offline: true.
- With a yof key, the server sends one ping when it starts and, for the three account tools, only the tool name and its arguments (ids and rule ids) to mcp.yof.io.
- Every answer is labelled as untrusted data from the scanned project, and secret values come back only as a short prefix plus REDACTED.