FibelSAFE
Docs first - everything else later
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Fibel publishes Markdown and host-rendered application pages in one documentation shell with native language routes, server-side search, raw Markdown sources, and a cookie-based light/dark theme.
It is built for product and developer documentation that should stay readable in the repository, work well as a website, and remain easy for tools such as LLMs to consume.
Quick start
Fibel targets Bun.
For an app project:
bun add @k2b/fibel bunx --bun @k2b/fibel init bunx --bun @k2b/fibel dev --port 5173
Open http://localhost:5173. The root path redirects to the configured default locale.
fibel dev watches the config, docs, and assets. After a successful rebuild, connected browser tabs reload automatically. Use --no-watch or --no-reload when a plain local server is enough.
Package migration
Fibel moved from @valentinkolb/fibel to @k2b/fibel in v0.2.0. Replace root imports with @k2b/fibel, plugin imports with @k2b/fibel/plugins, and CLI commands with bunx --bun @k2b/fibel. The previous package is deprecated and receives no further releases.
Agent skill
Fibel publishes one English Agent Skill for documentation work. Install it directly from the documentation website with the open-source Vercel Skills CLI:
bunx skills add https://fibel.dev
The concise skill gives agents the stable Fibel workflow and tells them to use the public MCP server for exact current API details. It answers in the user's language without maintaining translated copies of the skill.
When working from this repository:
bun install bun run src/cli.ts init bun run src/cli.ts dev --port 5173
What Fibel provides
- Documentation pages from
docs//**/*.md - Optional content collections with separate Markdown roots and navigation
- Optional date-sorted blog feeds backed by normal Markdown collections
- Framework-neutral custom pages with searchable Markdown content
- Optional So
a0f7ce742d96OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add fibel -- npx -y @k2b/[email protected]
{
"mcpServers": {
"fibel": {
"command": "npx",
"args": [
"-y",
"@k2b/[email protected]"
]
}
}
}Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
list_collections | read | |
read_doc | read | |
search_docs | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (5)
streamable-http
if curl --fail --silent --show-error http://127.0.0.1:3000/en/blog >/tmp/fibel-blog.html; then
curl --fail --silent --show-error http://127.0.0.1:3000/en/blog/documentation-interface \
const bytes = Uint8Array.from(atob(encoded), (char) => char.charCodeAt(0));
@k2b/nessi, @k2b/stdlib, bun-plugin-tailwind, marked, tailwindcss, zod, @k2b/ssr, @types/bun
Gates applied: no_behavioural_pass.
a0f7ce742d96full audit observations/trust-audit/mcp-server/k2b-dev__fibel.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | a0f7ce742d96 | SAFE | B | 89 | first audit |
Questions
What is the @k2b/fibel MCP server?
Docs first - everything else later
What tools does @k2b/fibel expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @k2b/fibel safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does @k2b/fibel need?
No credential environment variables were found in its source, so it appears to need none.
How does @k2b/fibel run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @k2b/fibel at 0.7.6.
How current is this page?
The grade is for one exact copy of the source (a0f7ce742d96), read on 2026-10-11. The repository is watched and re-audited when it changes.