# com.faable/mcp Deploy apps from GitHub, read build/runtime logs, and manage your app's users from your AI agent. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 4.17.0 - **Author:** com.faable - **License:** Unknown - **Endpoints:** streamable-http https://mcp.faable.com/mcp - **Source:** https://github.com/faablecloud/faable - **Endpoint health:** reachable (last checked 2026-10-18T04:25:44.622Z, 1 sample) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 1 day ## Security scan **Assessment scope:** Hosted endpoint only: Forge can assess who publishes it and whether it answers, not the code behind it. No CVE, dependency or source analysis applies, so nothing here is a clean bill for that code. - **Status:** probed (endpoint answered; no code examined) - **Scanned:** 2026-10-18T04:24:41.787Z - **Version scanned:** HEAD - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `faable` - `whoami` — The Faable account this server acts as, the active project and its Auth tenant. Use it first when unsure whether the user is logged in or which project is activ - `list_projects` — The user's Faable projects. Apps, domains and Auth tenants live in a project; pass its id as `project` to the other tools. - `list_apps` — The apps of a project, with their live phase, URL and linked repository. Start here to find the app the user means. - `get_app` — One app: phase, URL, repository, deploy branch and mode, detected stack, and its newest deployment (which may have failed while an older one keeps serving). Use - `list_deployments` — Recent deployments of an app, newest first, with phase, commit and the first line of any failure reason. Use it to find the deployment behind 'my last deploy fa - `get_deployment` — Everything recorded about one deployment: phase, commit, detected stack, the runnable artifact, the FULL failure reason and, when it failed, `fault` — whether i - `get_build_logs` — The build output of a deployment — the first thing to read when a deploy failed and the user asks why. The cause is usually at the end. Without `deployment`, th - `get_runtime_logs` — What the running app printed (last 24 hours, up to 200 lines). Use it when the app is up but misbehaving, or crashes after starting. A deployment retired more t - `get_app_traffic` — Requests the app served: status codes, busiest paths and failing paths. Trails reality by up to 15 minutes. - `get_usage` — This billing period's usage of a project: plan, apps, domains, deployments and egress. - `get_quota` — Today's deploy allowance of a project and the builds held waiting for it. Use it when a deploy did not start: a held build is waiting, not failing. - `list_domains` — Custom domains of an app and whether their DNS is verified. - `check_domain` — DNS diagnostic of one custom domain: the CNAME it expects, what DNS answers today, and why it is not verified yet. `prevalidation_cname.ready` says whether the - `list_secrets` — The environment variables set on an app. Names only — values are masked and this tool can never reveal them. Use it to check whether a variable the app needs is - `list_auth_tenants` — The Faable Auth tenants (user directories) of a project. Most projects have one and every Auth tool uses it; with several, pass the right one as `tenant`. - `list_auth_logins` — Who logged in to the app's Faable Auth, newest first: one row per login with the user's email, when, from which IP and with which method. Answers 'who logged in - `count_auth_users` — How many users of the Auth tenant match: logged in since a time ('how many users logged in today / this week'), signed up since a time ('how many sign-ups this - `list_auth_users` — Users of the Auth tenant. Find one by email or text, list the suspended ones, or sort: `-last_login` (most recent login first), `last_login` (longest without lo - `get_auth_user` — One user of the Auth tenant by id or email: profile, verification, suspension (and why), last login and login count, and the social identities they sign in with - `list_auth_logs` — The Auth tenant's audit log, newest first: logins, failed logins (`status: failed`), sign-ups, password resets, admin changes (`type` prefix `admin.user`). Filt - `list_auth_sessions` — The devices a user is signed in on (one row per login session): IP, device, last activity and whether it is still active. - `list_auth_connections` — How users can log in to the Auth tenant: social providers (Google, GitHub…), passwordless (email or SMS codes) and username/password, and which are enabled. - `list_auth_clients` — The applications (OAuth clients) of the Auth tenant: web apps, SPAs, native apps and machine-to-machine clients. - `list_github_repos` — The GitHub repositories Faable can deploy: those the Faable GitHub App is installed on. Use it before create_app to find the repository the user means. When the - `deploy_app` — Build and deploy the latest commit of the app's deploy branch on Faable's servers — the same as a git push. Nothing is uploaded from this machine. With `wait`, - `create_app` — Create an app from a GitHub repository in a project, link it and start its first deploy (the dashboard's Create & connect). Needs the Faable GitHub App installe - `redeploy` — Rebuild a failed deployment from the source it recorded. Without `deployment`, the newest failed one. Refused for code older than what production serves. - `cancel_deployment` — Stop a deployment that is still queued or building. Production keeps serving what it served. Without `deployment`, the one in flight. - `set_secrets` — Add or update environment variables of an app. The app restarts to apply them when a value changed. Returns the names added, updated and unchanged — never the v - `add_domain` — Attach a custom domain to an app. Returns the CNAME record the user must create at their DNS provider; Faable verifies it and issues the certificate on its own. - `configure_repo` — Change the deploy branch, the monorepo root directory ("" clears it) or the deploy mode (push: every push; ci: once CI tags a release; workflow: the repo's own - `link_repo` - `delete_app` - `deploy_directory` - `suspend_auth_user` - `reinstate_auth_user` - `revoke_auth_sessions` - `update_auth_client_fields` - `send_password_setup` ## Install **Verdict: review** — Installable, but 3 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - Hosted endpoint only: Forge can assess who publishes it and whether it answers, not the code behind it. No CVE, dependency or source analysis applies, so nothing here is a clean bill for that code. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mcp\": {\n \"type\": \"http\",\n \"url\": \"https://mcp.faable.com/mcp\"\n }\n }\n}" ``` ## Blast radius Moderate to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on someone else's infrastructure. - Floor 32, ceiling 56 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/com.faable%2Fmcp - Install plan: https://forgeregistry.com/api/v1/packages/com.faable%2Fmcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/com.faable%2Fmcp - HTML page: https://forgeregistry.com/registry/com.faable%2Fmcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.