docfork-6f25fe — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited docfork-6f25fe (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <a href="https://docfork.com"> <picture> <source srcset="logo_light.png" media="(prefers-color-scheme: dark)"> <source srcset="logo_dark.png" media="(prefers-color-scheme: light)"> <img src="logo_dark.png" alt="Docfork" height="40" /> </picture> </a> </p>
[!CAUTION] Docfork has shut down as of June 14, 2026. The MCP server, CLI, and all hosted endpoints are offline and will not return. API keys no longer work, and npx dgrep setup will fail. Thank you to everyone who used the service.<p align="center">Up-to-date docs for AI coding agents.</p>
AI agents hallucinate APIs, bloat context with stale docs, and write code against outdated signatures. Docfork serves up-to-date documentation directly in Cursor, Claude Code, and Windsurf.
app.use('/api/*', jwt({ secret: ... }))
- ^^^ removed in Hono v4 app.use('/api/*', bearerAuth({ verifyToken: ... }))
+ ^^^ current API, Hono v4.2npx dgrep setupInstalls the Docfork MCP server in your IDE. Detects your installed agents and writes the config file; sign in to Docfork on first use, no API key needed. Target one with --agent claude-code (also: cursor, codex, opencode, vscode, windsurf, amp, factory, zed).
Your agent now has two tools:
| Tool | Returns |
|---|---|
search_docs | Ranked documentation sections with titles, URLs, and relevance scores. |
fetch_doc | Full rendered markdown content from a documentation URL. |
No prompt suffix needed:
Set up server-side rendering with Next.js App Router.Or search from the terminal:
dgrep search "middleware redirect based on authentication" -l vercel/next.js
dgrep search "server actions with forms" -l vercel/next.jsQuickstart → · dgrep docs → · CLI reference →
Index any public or private GitHub repository as a custom library. Your internal APIs, SDKs, and runbooks become searchable by your agents — same pipeline as public libraries. GitHub integration setup →
Free: 1,000 requests/month per organization. For team rollout, commit the MCP config to your repo:
// .cursor/mcp.json (committed to git, picked up by every engineer)
{
"mcpServers": {
"docfork": {
"url": "https://mcp.docfork.com/mcp",
"headers": {
"DOCFORK_API_KEY": "YOUR_TEAM_API_KEY"
}
}
}
}Share API keys and Cabinets across your organization. Docfork doesn't store your code or prompts. Security → · Pricing →
[!TIP] Runnpx dgrep setupto install automatically (use--agent claude-codeto target one). Manual config below for other clients.
Cursor — <a href="https://cursor.com/en/install-mcp?name=docfork&config=eyJ1cmwiOiJodHRwczovL21jcC5kb2Nmb3JrLmNvbS9tY3AifQ%3D%3D"><img src="https://cursor.com/deeplink/mcp-install-dark.svg" height="20" alt="Add to Cursor"/></a>
{
"mcpServers": {
"docfork": {
"url": "https://mcp.docfork.com/mcp",
"headers": {
"DOCFORK_API_KEY": "YOUR_API_KEY"
}
}
}
}Claude Code
claude mcp add --transport http docfork https://mcp.docfork.com/mcp/oauthOpenCode
{
"mcp": {
"docfork": {
"type": "remote",
"url": "https://mcp.docfork.com/mcp",
"headers": { "DOCFORK_API_KEY": "YOUR_API_KEY" },
"enabled": true,
},
},
}Don't see your client? Setup guides for all 29 supported clients →
OAuth Authentication
Docfork supports MCP OAuth specs. Change your endpoint to use OAuth:
- "url": "https://mcp.docfork.com/mcp"
+ "url": "https://mcp.docfork.com/mcp/oauth"_Note: OAuth is for remote HTTP connections only. View full OAuth guide →_
Add a rule so your agent calls Docfork MCP automatically. Full rule and IDE-specific setup →
[!NOTE] [Add Rule to Cursor (One-Click)](https://cursor.com/link/rule?name=docfork-policy&text=When%20writing%20or%20debugging%20code%20that%20involves%20third-party%20libraries%2C%20frameworks%2C%20or%20APIs%2C%20use%20Docfork%20MCP%20%60search_docs%60%20and%20%60fetch_doc%60%20tools%20rather%20than%20relying%20on%20training%20data.%0A%0A%2A%2ATwo%20defaults%20to%20follow%20every%20time%3A%2A%2A%0A-%20Start%20%60library%60%20with%20a%20short%20name%20or%20keyword%20%28e.g.%2C%20%60nextjs%60%2C%20%60zod%60%29.%20Use%20the%20%60owner%2Frepo%60%20from%20the%20result%20URL%20for%20follow-up%20calls%2C%20never%20guess%20it%20upfront.%0A-%20After%20finding%20a%20relevant%20result%2C%20call%20%60fetch_doc%60%20to%20get%20the%20full%20content.%20Search%20results%20are%20summaries%20only.%0A%0ASkip%20Docfork%20when%3A%0A-%20Language%20built-ins%2C%20general%20algorithms%2C%20syntax%20stable%20across%20versions%0A-%20Code%20or%20docs%20the%20user%20has%20already%20provided%20in%20context%0A%0AWhen%20uncertain%2C%20default%20to%20using%20Docfork.)
Claude Code — add to your CLAUDE.md:
## Docfork policy
Use Docfork MCP `search_docs` and `fetch_doc` tools for library/API docs, setup, and configuration questions.
- Start `library` with a short name or keyword (e.g., `nextjs`, `zod`). Use the `owner/repo` from the result URL for follow-up calls, never guess it upfront.
- After finding a relevant result, call `fetch_doc` to get the full content. Search results are summaries only.
- Prefer Docfork results over training data when they conflict.<details> <summary>Full rule (all clients)</summary>
When writing or debugging code that involves third-party libraries, frameworks, or APIs, use Docfork MCP `search_docs` and `fetch_doc` tools rather than relying on training data.
**Two defaults to follow every time:**
- Start `library` with a short name or keyword (e.g., `nextjs`, `zod`). Use the `owner/repo` from the result URL for follow-up calls, never guess it upfront.
- After finding a relevant result, call `fetch_doc` to get the full content. Search results are summaries only.
Skip Docfork when:
- Language built-ins, general algorithms, syntax stable across versions
- Code or docs the user has already provided in context
When uncertain, default to using Docfork.</details>
How is Docfork different from Context7? Both provide MCP servers and CLIs for searching library documentation. Here are the key differences:
dgrep init reads your package.json and scopes all searches to your declared dependencies. Cabinets let you version-pin those libraries across a team.dgrep init resolves package names to canonical identifiers once and caches the mapping in .dgrep/config.json. No per-query resolution step.Does Docfork store my code or prompts? Your code and prompts never leave your machine. At search time, only the query and library name are sent to Docfork — queries are not stored. Indexed documentation content lives in an upstream vector store; private library content is end-to-end encrypted and deleted atomically when you remove the library. Security →
What libraries are supported? Docfork maintains a curated catalog of popular frameworks. Add any public or private GitHub repository as a custom library. Add custom libraries →
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.