io.yof/yof

up checked 2026-11-11T13:38:05.683Z

Unclaimed · Unverified

Publisher-provided title

yof

Publisher-provided description

Checks AI-written code for leaked keys and made-up packages, on your machine. Never uploads code.

Summary by lookupd

Scans AI-generated code locally for leaked secrets and hallucinated package names without sending any code off the machine.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http yof https://mcp.yof.io/mcp

Claude Code, npm package (stdio)

claude mcp add yof -- npx -y @yof/cli

Codex, remote (streamable-http)

codex mcp add yof --url https://mcp.yof.io/mcp

Codex, npm package (stdio)

codex mcp add yof -- npx -y @yof/cli

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "yof": {
      "url": "https://mcp.yof.io/mcp"
    }
  }
}

Cursor, npm package (stdio) → .cursor/mcp.json

{
  "mcpServers": {
    "yof": {
      "command": "npx",
      "args": [
        "-y",
        "@yof/cli"
      ]
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Publisher-provided text

yof_apps List your apps on yof with their id, address, whether you proved the site is yours, the latest check score and the linked GitHub repository. Call it first to ge
yof_findings List open findings for your proven apps, from their live sites and linked GitHub repositories, with secret values redacted. Use it to see what to fix; pass a fi
yof_explain Explain one yof rule in plain words: what it means, why it matters, how urgent it is, the safe fix and its CWE and OWASP references. Use it to understand a find
yof_fix_prompt Write step-by-step instructions to fix one finding (pass finding_id) or one kind of problem (pass rule_id), with any secret shown only as a prefix plus REDACTED
yof_verify Report whether one finding is fixed, according to yof's latest finished check; it does not run a new check. After a fix, run yof_check first, wait for it to fin
yof_check Start a new check of one of your apps: target site checks the live site, target repo reads the linked GitHub repository (read only). Use it after a fix is deplo
yof_patch_status List Patch's open fix pull requests, with the state of each one's CI checks. Use it to see whether a fix Patch proposed is waiting, passing or failing; use yof_
yof_lessons List short lessons from Patch fixes that were merged: what was fixed, in which pull request, whether yof's next check confirmed it, and how to avoid it next tim

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.yof/yof.svg)](https://lookupd.com/servers/io.yof/yof)