nofaxSAFE
Human-in-the-loop approvals and notifications for AI coding agents via CLI, MCP, Claude Code, Codex and Cloudflare Workers.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/AKzar1el/nofax/actions/workflows/ci.yml) [](LICENSE) [](package.json) [](https://modelcontextprotocol.io/)
Human-in-the-loop approvals and notifications for AI coding agents, without running a Nofax SaaS.
Nofax is a small open-source bridge between an agent and a human. Local mode can pause an AI workflow, notify your phone, and return an explicit decision. An optional self-deployed Cloudflare Worker exposes a deliberately narrower remote MCP surface for one-way notifications and safe request inspection.
No Nofax account. No paid model API. No inbound port on your machine. MIT licensed.
Current status: local Nofax is on the stable0.2.xline. The optional Cloudflare Worker is the upcoming0.3.0remote surface and is developed alongside the local package.
Why Nofax
Agent workflows increasingly need a clean answer to one question: when automation reaches a human decision boundary, how does it ask without pretending that silence means approval?
Nofax keeps that boundary explicit:
- pending is never approval;
- timeout and transport failure fail closed;
- the first accepted terminal response wins;
- agent-specific hook schemas stay isolated in adapters;
- remote access is intentionally narrower than local access;
- Nofax does not grant authority the calling agent did not already have.
Two operating modes
6b2349578411OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add nofax -- npx -y [email protected] mcp
Exposed tools (7)
7 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
nofax_get_request | read | |
nofax_list_pending | read | |
nofax_notify | read | |
nofax_request_approval | read | |
nofax_request_choice | read | |
nofax_request_refinement | read | |
nofax_wait_for_response | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
zod, @cloudflare/vitest-plugin, @cloudflare/workers-types, typescript, vitest, wrangler
Gates applied: no_behavioural_pass.
6b2349578411full audit observations/trust-audit/mcp-server/akzar1el__nofax.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 6b2349578411 | SAFE | B | 89 | first audit |
Questions
What is the nofax MCP server?
Human-in-the-loop approvals and notifications for AI coding agents via CLI, MCP, Claude Code, Codex and Cloudflare Workers.
What tools does nofax expose?
7 in total: 7 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is nofax safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does nofax need?
No credential environment variables were found in its source, so it appears to need none.
How does nofax run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as nofax-remote-worker at 0.3.0.
How current is this page?
The grade is for one exact copy of the source (6b2349578411), read on 2026-10-11. The repository is watched and re-audited when it changes.