gfcSAFE
git-for-context — LLM context dedup: unchanged file re-reads collapse to hash-verified stubs, changed files return diffs. OpenCode plugin + zero-dep MCP server. Measured −34% per-turn context.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Docs site: https://jjjorfi.github.io/gfc/ — the interactive version: scrolly chapters that walk the mechanism, an A/B read simulator (with vs without GFC), and animated benchmark bars.
LLM coding agents re-read the same files over and over. The transcript is a linear replay: every turn re-pays for content the model has already seen. GFC treats the transcript like git treats a working tree — ship the model a diff against what it already saw, never a full re-checkout.
Zero per-turn overhead: no tools registered in OpenCode, no prompt additions. Nothing happens unless a duplicate read was about to happen — which is exactly where it pays.
Measured
72-run A/B benchmark on opencode free-tier models (3 models × 4 scenarios × 3 reps, fresh sessions, all attempts counted, no outlier removal). Full protocol in bench/.
f4e967931705OBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add gfc -- npx -y [email protected]
{
"mcpServers": {
"gfc": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
gfc_read | read | Read a file with git-for-context dedup: re-reading an unchanged file returns a short [GFC] stub, and a changed file returns a diff vs what you last saw. Prefer this over cat/head/sed/tail for reading files. Returns 1-based numbered lines. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (1)
curl -fsSL https://raw.githubusercontent.com/jjjorfi/gfc/master/install.sh | bash
Gates applied: no_behavioural_pass.
f4e967931705full audit observations/trust-audit/mcp-server/jjjorfi__gfc.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | f4e967931705 | SAFE | B | 89 | first audit |
Questions
What is the gfc MCP server?
git-for-context — LLM context dedup: unchanged file re-reads collapse to hash-verified stubs, changed files return diffs. OpenCode plugin + zero-dep MCP server. Measured −34% per-turn context.
What tools does gfc expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is gfc safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does gfc need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (f4e967931705), read on 2026-10-14. The repository is watched and re-audited when it changes.