4da Mcp Server

All signal. No feed.

4DA reads the internet for developers — privately, locally. Your codebase decides what's relevant.

It scans your codebase — Cargo.toml, package.json, go.mod, Git history — and scores every article, advisory, and release from 20+ sources against what you actually build. An item needs 2+ independent signals to survive. Everything else is rejected.

Benchmarked across 9 developer personas against a 245-item labeled corpus — 1,997 scored evaluations: 93% of content is rejected, and 98.9% of labeled noise is correctly rejected. Those are measured numbers, and you can reproduce them in one command. Your real rejection rate — computed from your own data, not ours — is shown in the Signal tab.

Saves and dismissals build a preference profile you can inspect, pin, or forget — and teach the Brief what to stop showing you. Relevance scoring itself stays grounded in your actual stack. And when the engine improves, it re-judges everything it already holds: yesterday's noise becomes tomorrow's signal.

The fastest way to try it

Already using Claude Code, Cursor, or Windsurf? One command:

npx @4da/mcp-server

This scans your project, detects your stack, and gives your AI assistant live vulnerability scanning, dependency health, upgrade planning, and ecosystem intelligence. No API keys. No accounts. Works standalone — no desktop app required. Full MCP documentation.

How It Works

Scoring

5 independent signal axes. An item must pass 2 or more to surface. Single-axis matches are hard-capped at 28% — no matter how strong one signal is, it cannot pass alone.

What passes the gate goes through 12 quality multipliers: content depth, novelty detection, competing tech penalties, title-body coherence, and intent scoring from recent work. Every constant is calibrated across 9 simulated developer personas with 245 labeled test items.

LLM Verification

After keyword scoring, an LLM layer verifies the top items against your full developer context — stack, dependencies, recent commits, anti-technologies, and engagement history. Strict 1-5 rubric:

• 5 = MUST-READ: Security alert for YOUR dependency, breaking change YOU must act on
• 3 = WORTH KNOWING: Useful tool that fits YOUR exact stack
• 1 = NOISE: Mentions your tech but isn't actionable

This is where the gold surfaces — articles the keyword pipeline misses because there's no keyword overlap, but the LLM understands the conceptual relevance to your specific project.

You own the compute. Use Ollama for free local inference (fully private), or bring your own Anthropic/OpenAI key. 4DA never pays for your compute, never stores your keys remotely, never makes API calls you didn't configure.

Anti-Gaming

Content creators who learn the scoring algorithm still can't game it:

• Title-body coherence: titles must deliver on what they promise. Claim "React + Rust + Tauri" but only discuss React? Penalty.
• Keyword concentration: repeating "Rust" four times in a title hurts your score.
• Confirmation gate: keyword-stuffing hits one axis. Without matching the user's codebase, installed packages, AND recent work — the gate rejects it.
• Grounded scoring: relevance keys on your actual dependency graph and stack — not popularity, not engagement. There is no behavioural signal to farm; content scores only when it matters to what you actually build.

No algorithm can be gamed when the scoring signal comes from your local filesystem. Your Cargo.lock doesn't lie.

Privacy & Trust

4DA is local-first and direct-to-provider. There is no 4DA-operated server, no analytics, and no user account system. Your indexed content, scores, and intelligence live in a SQLite database on your machine.

The only outbound traffic:

That's the whole list. There is no 4DA telemetry endpoint because there is no 4DA cloud.

Don't take our word for it:

Download

Pre-built binaries — no Rust toolchain required.

Every release publishes SHASUMS256.txt and per-file .sha256 sidecars. Verification instructions.

Windows users: SmartScreen will prompt on first launch (new application, building reputation). Click More info → Run anyway. Full details.

Or install the MCP server for Claude Code / Cursor / Windsurf:

npx @4da/mcp-server

Build from Source

git clone https://github.com/4DA-Systems/4DA.git
cd 4DA
pnpm install
pnpm tauri dev   # First build: 5-15 min. Dev server: localhost:4444.

Prerequisites: Rust (1.93.1 via rust-toolchain.toml), Node.js 20, pnpm 9.15. Platform-specific: Windows needs VS Build Tools 2022 with C++ workload. Full build guide.

First-run setup (API keys, context dirs, sources): Getting Started.

System Requirements

4DA runs on modest hardware. Private semantic search is built in — no GPU, no API key, and no first-run download required.

• OS: Windows 10 (1803+) / 11, macOS 10.15+, Ubuntu 22.04+ (WebKitGTK 4.1).
• One installer (~110 MB). The local embedding model ships inside it — no separate download, works fully offline on first run.
• Baseline = private on-device semantic search. Cloud AI adds AI-written briefings + deeper reranking via your own API key. Local AI runs everything offline (Ollama or a downloaded model).

Architecture

Your Codebase                    External Sources
     |                                |
     v                                v
+-----------+                +--------------+
|    ACE    |                |  20+ Source   |
| Scanner + |                |  Adapters     |
| Git Watch |                |  (background) |
+-----+-----+               +------+-------+
      |                            |
      v                            v
+------------------------------------------+
|         5-Axis Scoring Engine            |
|                                          |
|  context --+                             |
|  interest --+- confirmation gate (2+/5)  |
|  ace -------+                            |
|  dependency-+  x quality x novelty       |
|  learned ---+  x domain  x intent        |
+------------------+-----------------------+
                   |
                   v
          +-----------------+
          |  What survived  |
          +-----------------+

Pricing

Free — $0 forever. No credit card. No account. No expiration.

• All 20+ sources, full 5-axis scoring engine, AI daily briefings (BYOK), natural language search (BYOK), Developer DNA profiling, Score Autopsy (5-axis breakdown), signal chain analysis, channels, the OSV security floor, Learned Preferences, MCP server (14 tools), CLI

Signal — $12 AUD/month, $99 AUD/year, or $299 AUD once for a Lifetime license (14-day free trial).

• Everything in Free, plus: blind spot detection with AI assessment, and knowledge gap detection — the analysis layer computed from your dependency graph and reading history

Free is not a demo. It's the full scoring engine, all sources, Learned Preferences, and MCP integration.

The STREETS Playbook — 7 modules on turning developer skills into independent income — is free on the open web. No download, no email.

Features

npx @4da/mcp-server

4da briefing               # Latest AI briefing
4da signals                # All classified signals
4da signals --critical     # Critical/high priority only
4da gaps                   # Knowledge gaps in your dependencies
4da health                 # Project dependency health
4da status                 # Database stats

Screenshots

Brief — today's top picks and live signal stream scored against your stack

Preemption — forward-looking intelligence: CVEs, breaking changes, dependency risks

Blind Spots — coverage gaps and high-relevance items you never saw

Signal — the items that earn their place, confirmed through 2+ independent axes

Development

4DA is built by a solo engineer with AI-assisted development (Claude Code), with external audits from gpt 5.4 and 5.5. The test suite (3,400+ tests across Rust and TypeScript) and CI pipeline verify correctness on every commit. The scoring algorithm is hand-designed and benchmarked against 9 developer personas with labeled test data.

pnpm tauri dev              # Dev server (localhost:4444)
cargo test                  # Rust tests (from src-tauri/)
pnpm test                   # Frontend tests
pnpm validate:all           # Full validation (lint + types + tests + build)

Benchmarks

The scoring numbers in this README are measured, not asserted — run the suite and check them yourself. The persona simulation scores a 245-item labeled corpus against 9 simulated developer personas (Rust systems, Python ML, fullstack TypeScript, DevOps/SRE, mobile, bootstrap/first-run, power user, stack switcher, niche specialist), skipping items labeled deliberately borderline, for 1,997 scored evaluations.

cd src-tauri
cargo test scoring::simulation -- --nocapture   # 9-persona simulation (the headline numbers)
cargo test scoring::benchmark -- --nocapture    # 2-profile pipeline benchmark

scoring::simulation prints a quality dashboard with the aggregate confusion matrix. On the current pipeline:

Recall is low by design: roughly 70% of the "relevant" denominator is tangential/adjacency content a precision-first brief is meant to drop. The load-bearing figure is recall on items labeled strongly relevant — security advisories and releases for declared dependencies — which is 71.3% (72/101) and is reported separately by the same suite.

What CI enforces is a floor, not the headline. The suite asserts aggregate precision >= 0.70, aggregate F1 >= 0.40, and noise rejection >= 80% for every one of the 9 personas; a regression past any of those fails the build. The percentages above are the measured values on top of those floors, so re-run the command against whatever revision you have checked out rather than trusting this table.

Source: src-tauri/src/scoring/simulation/ (corpus, persona definitions, domain embeddings, enrichment data) and src-tauri/src/scoring/benchmark.rs.

License

FSL-1.1-Apache-2.0 — source available. Free to use, inspect, and modify for any purpose except building a competing product. Every release converts to Apache 2.0 three years after publication — after that, no restrictions at all.