MCP100 IndexTesting / Debugging
WatchlistFirst-party MCP

Fallow

by fallow-rs

Reviewed October 5, 2026

Testing / DebuggingSoftware & Technology

Watchlist tracking

Reviewed for relevance and future tracking value.

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Deterministic codebase graph analysis exposed through fallow-mcp: Do graph-backed explanations retain traceable evidence as framework detection and exit contracts evolve?

Reviewed · Documentation review; complete setup workflow not independently tested

Best fit

Teams and agents auditing JavaScript/TypeScript code quality and architecture.

What we know

A Rust-native static-analysis and codebase-intelligence tool with CLI, LSP and MCP launcher.

Maintenance / activity evidence

  • fallow 3.31.0 published 2026-09-30T17:09:16.979Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

  • Installation and comprehensive security have not been independently audited.
  • Reads project source/config. Writes: fallow fix can modify code.
  • Authentication not yet verified.
  • Sensitive access: Source code
  • Local analysis is bounded, but fix actions modify source and optional cloud features add external data flow.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

5,010 repository stars · 5.2M package downloads / 30 days

Stars observed Oct 6, 2026. Downloads observed Oct 6, 2026.

All limitations / Review context

Do graph-backed explanations retain traceable evidence as framework detection and exit contracts evolve?

The bounded review of the publisher's documented Deterministic codebase graph analysis exposed through fallow-mcp and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

  • Local analysis is bounded, but fix actions modify source and optional cloud features add external data flow.
  • Reads project source/config.
  • Analysis is local unless optional cloud features are used.
  • Reviewed write actions: fallow fix can modify code
  • Sensitive access: Source code
  • Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
  • Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
  • Documented tool authority and any remote data handling must be checked before installation or use.
  • Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
  • Static analysis is not runtime coverage.
  • Auto-fix can modify code; preview changes first.

Original activity observations

  • fallow 3.31.0 published 2026-09-30T17:09:16.979Z
Technical identity
npm/fallow
Exact implementation source
https://www.npmjs.com/package/fallow ↗
Reviewed resource type
Testing / Debugging
Repository identity
fallow-rs/fallow
Package identity
npm:fallow

Evidence & Sources

Evidence basis
Recorded source evidence
Setup runtime verification
Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed · Latest source observation

  • Package registry ↗

    fallow

    Recorded package identity, distribution or download evidence.

    Includes references whose attribution is not established.

  • GitHub repository ↗

    fallow-rs/fallow

    Repository reference; implementation attribution is not established for every document.

    Includes references whose attribution is not established.

  • Evidence source ↗

    docs.fallow.tools/

    Source material retained for this review.

    Includes references whose attribution is not established.