This MCP server provides a deterministic index of the First Principles Framework (FPF) spec, enabling agents to query patterns, routes, and relations without vector databases.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
process.env. You'll be asked to provide them before it can run.FPF_CONTENT_QUALITY_BASE_URLFPF_CONTENT_QUALITY_MONITOR_FORMATFPF_CONTENT_QUALITY_MONITOR_MODEFPF_CONTENT_QUALITY_STATUS_URLFPF_DEPLOYED_ATFPF_DOCS_OUT_DIRFPF_DOCS_ROOTFPF_DOWNLOAD_SPEC_OUTPUTFPF_E2E_BASE_URLFPF_E2E_MCP_BASE_URLFPF_HOSTED_MCP_DISABLED— false Emergency hosted /api/mcp/ shutoff; returns 503 before loading the MCP runtime.FPF_PRODUCTION_SMOKE_FORMATFPF_PRODUCTION_SMOKE_MCP_BASE_URLFPF_PRODUCTION_SMOKE_TIMEOUT_MSFPF_PRODUCTION_SMOKE_WEBSITE_BASE_URLFPF_PUBLISH_CHANNELFPF_PUBLISH_SOURCE_PATH— a gitignored local publish source: .fpf-upstream/FPF-Spec.md, or any local checkout viaFPF_QUERY_DEFAULT_MODE— verbose Default mode for query_fpf_spec and ask_fpf.FPF_RUNTIME_LOG_PATH— .runtime/logs/fpf-runtime.log Structured runtime/MCP logs.FPF_SPEC_SOURCE_PATH— 1. hashes the spec file at and reuses the snapshot if the hash matchesFPF_SYNC_MONITOR_FORMATFPF_SYNC_MONITOR_MAX_DRIFT_HOURS— 10 Allowed upstream-to-production drift before monitor failure.FPF_SYNC_MONITOR_STATUS_URLFPF_UPSTREAM_OWNER— ailev GitHub owner for upstream publication provenance and downloads.FPF_UPSTREAM_REF— main Branch, tag, or SHA used by spec:download and publish:current.FPF_UPSTREAM_REPO— FPF GitHub repo for upstream publication provenance and downloads.FPF_UPSTREAM_SPEC_PATH— FPF-Spec.md Path to the spec inside the upstream repo.FPF_USAGE_REPORT_FORMATFPF_USAGE_REPORT_LIMITFPF_USAGE_REPORT_LOG_PATHFPF_USAGE_REPORT_OUTPUTFPF_USAGE_REPORT_SOURCEFPF_USAGE_REPORT_VERCEL_LIMITFPF_USAGE_REPORT_VERCEL_PROJECTFPF_USAGE_REPORT_VERCEL_TIMEOUT_MSFPF_USAGE_REPORT_VERCEL_TOKENFPF_USAGE_REPORT_WINDOWFPF_VERCEL_FUNCTION_DURATION_USD_PER_GBHRFPF_VERCEL_PROJECT— fpf-reference-mcp Vercel MCP/API project checked by monitor:vercel:spend.FPF_VERCEL_SCOPE— _none_ (example: venikmans-projects) Vercel team scope for metrics and deploy commands. No built-in code default; seeded in .env.example.FPF_VERCEL_SPEND_LEGACY_PATHFPF_VERCEL_SPEND_MAX_ERROR_INVOCATIONS— 0 Maximum function invocations allowed with non-empty Vercel error_code.FPF_VERCEL_SPEND_MAX_FUNCTION_DURATION_GBHR— 0.25 Maximum Function Duration GB-hours allowed in the lookback window.FPF_VERCEL_SPEND_MAX_LEGACY_INVOCATIONS— 0 Maximum function invocations allowed for the legacy MCP route.FPF_VERCEL_SPEND_MONITOR_FORMATFPF_VERCEL_SPEND_WINDOW_MINUTES— 30 Metrics lookback window for spend guardrails.GITHUB_OUTPUTGITHUB_STEP_SUMMARYGITHUB_TOKENVERCEL[](https://m8ven.ai/mcp/venikman-fpf-memory-15av4d)