AgentsBestFriend (TheRealFloatDev/AgentsBestFriend) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 24 tools. No publisher has claimed this listing.
Give your AI coding agents superpowers — a local MCP server for fast, token-efficient code navigation, search & analysis.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
TheRealFloatDev
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
abf_apply_editAtomically write new file contents to disk. WRITE TOOL — disabled unless ABF_ENABLE_WRITES=1 is set. Requires expected_old_hash (sha256 of the file currently on disk) to prevent overwriting concurrent changes. For new files pass expected_old_hash="" (empty string) and the file must not yet exist. AL…
abf_blast_radiusCompute the transitive blast radius of a file (or symbol's defining file): which files would be affected if it changes. BFS over the reverse-import graph with depth control and a heuristic break-risk score.
abf_call_graphBuild a call graph around a function or method (TypeScript/JavaScript only, ts-morph). Modes: - "callers": who calls the symbol (transitive, by depth) - "callees": what the symbol calls (transitive, by depth) - "both": combined view Use this to answer "what happens when this function runs?" or "who …
abf_chunkSmart file chunking by symbol boundaries. Returns actual source code. Use EXACTLY ONE of these modes: - symbol: pass a symbol name to get its full source code directly - chunk_index: pass a 0-based chunk index to get that chunk's code - (neither): returns a chunk overview listing — use this first to…
abf_context_bundleBundle multi-file context around an entry point in a single call. Traverses the import graph from the entry file, collecting symbols and optionally source code from all connected files. Replaces multiple read_file + abf_symbols + abf_dependencies calls with one compact result. Modes: - "signatures"…
abf_conventionsDetect codebase conventions by analyzing file names, folder structure, design patterns, and config files. Returns detected conventions with confidence scores and examples. Purely heuristic — no LLM required. Useful to understand a project's style before making changes.
abf_definitionJump to a symbol's definition in TypeScript/JavaScript code. Provide either (line + column) for a position-based lookup or (symbol) to find a named identifier in the file first. Returns absolute file path, line range, and a short source preview — replaces "search for the definition" round-trips.
abf_dependenciesShow imports and reverse dependencies (imported_by) for a file.
abf_diagnosticsRun TypeScript diagnostics on a single file or every git-tracked TS/JS file. Surfaces type errors, missing imports, and other compile-time issues without running a full build. Use this AFTER editing TS/JS code to verify correctness before declaring a task done.
abf_file_summarySearch across LLM-generated file summaries using full-text search. Returns files whose summaries match the query, ranked by relevance (BM25). Useful when exploring a codebase by concept rather than exact code text. Default mode is "or" — matches files containing ANY of the query terms, ranked by how…
abf_gitQuery git history, blame, and diff for the project.
abf_hoverGet the inferred type and JSDoc for an identifier in TypeScript/JavaScript code. Equivalent to a "hover tooltip" in an IDE: returns the symbol's resolved type signature and any documentation comments. Use this to verify an API's exact shape before calling it.
abf_impact_typedAST-aware impact analysis for TS/JS — eliminates string/comment false positives. For non-TS/JS files, falls back to enriched ripgrep with comment filtering. Use this BEFORE renaming or removing a symbol when accuracy matters.
abf_impactFind all files and lines that reference a given symbol name. Useful for change impact analysis.
abf_indexManage the file index: check status, trigger rebuild, incremental update, or generate LLM summaries. Rebuild/update will auto-generate summaries when Ollama is available.
abf_notesAgent notepad — persist notes across sessions in a local SQLite database (.abf/notes.db). Supports save, get, list, search (full-text via FTS5), update, and delete actions. Use this to store task context, decisions, TODOs, or anything that should survive between conversations. Notes are project-scop…
abf_pingHealth check tool. Returns server status and project root. Use this to verify the ABF MCP server is running correctly.
abf_preview_changesPreview a planned file change WITHOUT writing to disk. Returns a structured diff plus symbol-level deltas, exported-API impact warnings, and a quick external-usage probe for removed/renamed exports. Use BEFORE editing to validate scope and risk.
abf_project_overviewGet a comprehensive overview of the current project. Returns detected tech stack, frameworks, entry points, directory structure with purposes, language distribution, config files, and architectural patterns. Very token-efficient way to orient yourself in a new codebase. No index required.
abf_refactor_planGenerate a SAFE, ORDERED edit plan for a refactoring intent — read-only. Does NOT modify files. Currently supports: - rename: rename a symbol across the repo (best-effort, name-based) Other intents (move, extract, split) return a structured guidance plan.
abf_related_testsFind tests that likely cover a given file or symbol. Heuristic ranking based on: file name match, test-file imports of the source, and direct mention of the symbol name in test code.
abf_search_multiRun multiple search queries (mix of exact, keyword, semantic) in ONE call and merge results by file with weighted ranking. Reduces round-trips and combines complementary signals. Each sub-query contributes a normalized score; results are sorted by aggregated score.
abf_searchSearch code in the project using multiple modes: - "exact": Fast ripgrep-based search for exact strings or regex patterns. Returns matching lines with file path, line number, and surrounding context. - "keyword": Exploratory search — splits the query into keywords, scores every file by keyword densi…
abf_symbolsGet the symbol outline (functions, classes, methods, types) of a file.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
ABF_PROJECT_ROOTTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
24/24 tools missing one or more hints — abf_apply_edit (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); abf_blast_radius (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); abf_call_graph (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +21 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Destructive tools are labelled
1 tool perform destructive updates without destructiveHint — abf_apply_edit deletes at line 119 (unlinkSync(tmp))
Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.
Descriptions match behaviour
3 tools describe read intent but their handlers mutate — abf_call_graph (line 158: execFileSync(); abf_dependencies (line 114: execFileSync(); abf_related_tests (line 189: execFileSync()
Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.
Tool inputs are validated
Only 8/24 tool handlers declare input schemas (33%)
Declare an inputSchema with zod/joi/yup on every tool definition.
README present
No README found
Add a README.md describing the server and its tools.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Dev dependencies
2 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Domain consistency
npm scope @abf doesn't match GitHub owner therealfloatdev
Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.
Tool description accuracy
abf_dependencies: description implies read-only but handler writes/deletes/executes; abf_related_tests: description implies read-only but handler writes/deletes/executes
Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/therealfloatdev/agentsbestfriend)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check