@debugmcp/mcp-debugger
io.github.debugmcp/mcp-debugger · version 0.26.0 · 3,113 weekly npm downloads · audited 2026-11-03
Notes
Findings
No hidden-instruction or invisible-character findings in any tool, prompt, or resource description.
Claude Connectors Directory readiness
- ❌ Every tool has a title Missing on 29 of 29: create_debug_session, list_supported_languages, list_debug_sessions, set_breakpoint and 25 more
- ❌ Every tool declares readOnlyHint or destructiveHint Missing on 29 of 29: create_debug_session, list_supported_languages, list_debug_sessions, set_breakpoint and 25 more
- ✅ Tool names are 64 characters or fewer All within limit
- ❌ Descriptions avoid instructions about model behavior or other tools 12 of 29 descriptions reference other tools or tell the model what it must do: create_debug_session, remove_breakpoint, start_debugging, restart_debugging and 8 more
- ✅ No hidden instructions or invisible characters in tool metadata None found
Checks the directory's published tool requirements that are visible from tools/list. Passing them does not guarantee acceptance.
What this server's tools can do
- Has delete or destructive operations:
remove_breakpoint
Not a vulnerability by itself. It tells you what an injected prompt could ask this server to do, so you can decide which tools need approval.
Supply chain
- Install scripts: none
- npm provenance: yes
- Source repository linked: yes
- License: MIT
- Direct dependencies: 0
Tools (29)
| Name | Title | Hint | Description |
|---|---|---|---|
create_debug_session | none | Create a new debugging session. Passing port, processId or an adapterConfig that names a target (a debugger URI: vmServiceUri, websocketAddress, vmServiceInfoFile; or a Flutter deviceId, for an app running on an Android … | |
list_supported_languages | none | List all supported debugging languages with metadata | |
list_debug_sessions | none | List all active debugging sessions. Paused sessions include lastStop with the reason for the most recent stop (e.g. "breakpoint" vs "exception") | |
set_breakpoint | none | Set a breakpoint. Setting breakpoints on non-executable lines (structural, declarative) may lead to unexpected behavior | |
list_breakpoints | none | List all breakpoints in a session with their verified state and adapter-assigned ids. Session-global function breakpoints appear separately as functionBreakpoints (omitted when filtering by file). Works before launch (qu… | |
remove_breakpoint | none | Remove a breakpoint by breakpointId (returned by set_breakpoint / list_breakpoints), by function name, or by file + line (removes all breakpoints at that location). Takes effect immediately while the program is running o… | |
clear_breakpoints | none | Remove all breakpoints in a session, or all breakpoints in one file. Clearing zero breakpoints is success. Takes effect immediately while the program is running or paused | |
start_debugging | none | Start debugging a script. Answers when the launched program stops, when it ends, or after a short hold — whichever comes first, and the same way in every language: "paused" with a reason and, as wait_for_stop answers a s… | |
restart_debugging | none | Restart the debuggee: terminate the current program (if still running) and relaunch it with the same configuration as the last start_debugging. All current breakpoints are re-applied automatically. The get_output buffer … | |
attach_to_process | none | Attach to a running process for debugging. After the handshake the target is verified by polling for threads; if none are reported within verifyTimeout (~20s default) the attach fails and the proxy is torn down. When a r… | |
detach_from_process | none | Detach from the debugged process without terminating it | |
expose_session | none | Expose a debug session as a read-only DAP mirror endpoint on 127.0.0.1 so an IDE (e.g. VS Code) can attach as a second debug client and inspect live state: threads, stack, scopes, variables, evaluate. Returns host, port,… | |
unexpose_session | none | Close a session's DAP mirror endpoint and disconnect any attached IDE clients. Succeeds as a no-op if the session is not exposed | |
close_debug_session | none | Close a debugging session | |
step_over | none | Step over the current line. Waits briefly for the program to stop; if the step is still executing after ~5s (e.g. stepping over a long-running call), returns success with state "running" and pending:true — the step is st… | |
step_into | none | Step into the current call. Waits briefly for the program to stop; if the step is still executing after ~5s, returns success with state "running" and pending:true — the session becomes "paused" when the step completes (c… | |
step_out | none | Step out of the current function. Waits briefly for the program to stop; if the step is still executing after ~5s (e.g. the rest of the function is long-running), returns success with state "running" and pending:true — t… | |
continue_execution | none | Continue execution. Returns immediately after the adapter acknowledges; does not wait for the next stop. Call wait_for_stop to block until the program stops again or ends — it reports why (lastStop, e.g. "breakpoint" vs … | |
wait_for_stop | none | Block until the session next pauses or ends, then say why and where. Call it after continue_execution (which does not wait) and whenever a tool answers pending:true, instead of polling list_debug_sessions. Answers at onc… | |
pause_execution | none | Pause a running program. Waits briefly for the stop; if the program cannot stop within ~5s (e.g. blocked in native code, or an idle server waiting for input), returns success with pending:true and the session reports "pa… | |
list_threads | none | List all threads in the debugged process | |
get_variables | none | Get variables (scope is variablesReference: number). Responses are size-guarded: oversized values are cut (truncated:true) and very large scopes return a capped list with a truncation notice — pass names:[...] to fetch s… | |
get_local_variables | none | Get local variables for the shared inspection anchor. If the stopped thread is frameless, a sibling with policy-recognized user frames is preferred, adopted, and disclosed in note. At a breakpoint or step inside a frame … | |
get_stack_trace | none | Get stack trace. The response includes stopReason — why the session is paused. For an implicit frameless stopped thread, a sibling with policy-recognized user frames is preferred and adopted, with the switch disclosed in… | |
get_scopes | none | Get scopes for a stack frame | |
evaluate_expression | none | Evaluate expression in the current debug context. Without frameId, uses the same adopted top frame as stack and locals — at a breakpoint or step that is the frame the program stopped in even when the stack display would … | |
get_source_context | none | Get source context around a specific line in a file | |
get_output | none | Get debuggee output (stdout/stderr/console) captured for a session. Buffered per launch (last 1000 entries; adapter telemetry and known adapter-internal diagnostics — e.g. LLDB DWARF-parser noise — filtered out). Works w… | |
hot_reload | none | Apply changed code to the running program and keep its state — the adapter's own live update. Flutter: the SDK adapter's hot reload (the app must have started; the reassemble runs build(), so a breakpoint there is report… |
Check your own setup
npx mcpvetter scan --liveBadge
Add this to a README:
[](https://mcpvetter.com/servers/debugmcp-mcp-debugger)Publish this server?
Get the MCPVetter verified badge, a re-audit within 24 hours of every npm release, and an email whenever tools, findings, or Claude directory readiness change. $29 per server per month. You prove ownership first, free.