io.github.feedthrough/feedthrough
NPM · @FEEDTHROUGH/MCP · SCANNED SEP 20
Debug bridge inside your web app: an agent reads the DOM, console and network. Any browser.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to feedthrough/feedthrough). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 15 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability72
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3300 tokens (~206/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.feedthrough/feedthrough MCP server?
io.github.feedthrough/feedthrough runs locally as an npm package, launched with npx -y @feedthrough/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @feedthrough/mcp
claude mcp add feedthrough-feedthrough -- npx -y @feedthrough/mcp
{
"mcpServers": {
"feedthrough-feedthrough": {
"command": "npx",
"args": [
"-y",
"@feedthrough/mcp"
]
}
}
} {
"servers": {
"feedthrough-feedthrough": {
"command": "npx",
"args": [
"-y",
"@feedthrough/mcp"
]
}
}
} codex mcp add feedthrough-feedthrough -- npx -y @feedthrough/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"feedthrough-feedthrough": {
"type": "local",
"command": [
"npx",
"-y",
"@feedthrough/mcp"
],
"enabled": true
}
}
} openclaw mcp add feedthrough-feedthrough --command npx --arg -y --arg @feedthrough/mcp
mcp_servers:
feedthrough-feedthrough:
command: "npx"
args: ["-y", "@feedthrough/mcp"] {
"McpServers": {
"feedthrough-feedthrough": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@feedthrough/mcp"
]
}
}
} assistant mcp add feedthrough-feedthrough -t stdio -c npx -a -y @feedthrough/mcp
{
"mcpServers": {
"feedthrough-feedthrough": {
"command": "npx",
"args": [
"-y",
"@feedthrough/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −3
- Stability: pass → 0.80 functional
- 15 Sept 26 +1
- Stability: 0.97 → pass security
- Package version: 0.3.2 → 0.4.0 functional
- 14 Sept 26 0
- Package version: 0.3.2 → 0.4.0 functional
- 13 Sept 26 +1
- Package version: 0.3.2 → 0.4.0 functional
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@feedthrough/mcp@0.4.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | feedthrough/feedthrough |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/feedthrough/feedthrough/.github/workflows/publish.yml@refs/tags/v0.4.0 |
| Rekor log index | 2713208149 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:edd81a9dab1cf14a20a315b8e153329b571fbff0b08b3a87ba68cb68a381a24f611f2ab8052c6e9c83668729a7a0870bdf323ffe96ec63dfb8b8aae0b |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
click ~223
Click an element by calling its native click(), which fires a click event and runs the default activation: following a link, toggling a checkbox or radio, submitting a form. Prefer an id selector (#submit-btn) for reliable targeting. Note it does NOT synthesize the preceding pointer/mouse sequence (pointerdown / mousedown / mouseup) or move focus, so a handler wired specifically to those events rather than to click won't fire; for keyboard-driven activation use press_key instead. Behavior: if the selector matches nothing the call returns an error; it does not scroll the element into view, and it does not wait for any resulting navigation, network, or re-render to settle, returning as soon as the click is dispatched. Observe the effect with a follow-up get_console_logs / get_network_requests / query_dom. Returns the tag and id of the clicked element.
| Name | Type | Req | Description |
|---|---|---|---|
| selector | string | yes | A CSS selector for the element to click, e.g. '#submit-btn' or 'button[type=submit]'. If several match, the first in document order is clicked. |
No output schema declared.
No examples provided.
connection_status ~169
Check whether a browser with the Feedthrough bridge is currently connected. Returns a connected flag, a list of open tabs (id, url, which is active), and a 'server' block identifying this bridge: its name, version, and the port it actually bound. That port matters — if another agent session's server already held the default 8765, this one moved up, and the page will not find it until the app's dev server is started with FEEDTHROUGH_PORT set to the reported port. When a page is connected but behaving as though someone else is driving it, compare this name with the 'server' field from get_page_info: different names mean the tab is paired with another session's bridge. Call this first — every tool except get_instructions requires a connected browser.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
fill ~227
Set the value of an input, textarea, or select element. Focuses the element, assigns the value through the element's native value setter (so React/Vue controlled inputs register the change), then fires bubbling input and change events. The value is set in one shot, not typed character by character, so per-keystroke handlers (keydown / keypress / keyup / beforeinput) do NOT fire; to send Enter to submit or trigger a key shortcut, follow with press_key. Prefer an id selector (#search-input). If the selector matches nothing the call returns an error; it returns as soon as the events are dispatched and does not wait for downstream validation or re-renders. Returns the tag and the value that was set.
| Name | Type | Req | Description |
|---|---|---|---|
| selector | string | yes | A CSS selector for the input, textarea, or select to fill, e.g. '#email' or 'input[name=q]'. |
| value | string | yes | The full value to set. It replaces the field's current contents (it is not appended); for a <select>, pass the target option's value attribute. |
No output schema declared.
No examples provided.
get_console_logs ~367
Return console output captured since the bridge connected. Covers every console method — log/warn/error/info/debug plus dir, table, assert, trace, count, countReset, time/timeEnd/timeLog, group/groupCollapsed/groupEnd, and clear. Each entry has a 'level' (the closest of the five standard levels); rich methods also carry a 'method' field, and console.trace() plus failing console.assert() entries include a 'stack'. Uncaught exceptions and unhandled promise rejections are also captured (level 'error', method 'uncaught' / 'unhandledrejection') even though the app never logged them. When the app is noisy with framework or deprecation warnings, pass levels: ['error'] (or ['error', 'warn']) so the real errors aren't buried, and use 'match' to narrow by content. Pass 'since' (a ms timestamp from an earlier entry's 'ts', or Date.now() before an action) to see only what happened after that point. Read-only: it returns a passively captured buffer and neither clears the console nor changes the page. Always check this early — app errors and debug output often identify the root cause immediately.
| Name | Type | Req | Description |
|---|---|---|---|
| levels | array | – | Restrict to these levels, e.g. ['error'] to skip noisy warn/info/debug, or ['error', 'warn'] for both. Omit for all levels. |
| limit | integer | – | Cap the result to the N most-recent entries, e.g. 50. Omit to return everything captured since the bridge connected. |
| match | string | – | Case-insensitive substring filter on the serialized message content |
| since | number | – | Only entries with ts >= this (ms epoch). Scope to 'what happened after I did X'. |
No output schema declared.
No examples provided.
get_html ~123
Return the outerHTML of an element (capped at 50 KB). Use this when the summarised query_dom output isn't enough and you need to see the actual markup/structure of a region. Read-only: it only reads the DOM and makes no changes, and it returns an error if the selector matches nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| selector | string | yes | A CSS selector for the region to dump, e.g. '#app' or '.modal'. If several match, the first in document order is used. Scope it tightly: the outerHTML is capped at 50 KB. |
No output schema declared.
No examples provided.
get_instructions ~79
Returns the Feedthrough usage guide as a Markdown text document, with sections for the recommended workflow, tool-ordering tips, and selector advice. Read-only and takes no arguments; it does not touch the page or require a connected browser. Call it at the start of a debugging session if you are unfamiliar with Feedthrough or want a quick refresher.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_network_requests ~194
Return all fetch and XHR requests captured since the bridge connected, including URL, method, HTTP status, duration, request and response headers, and request and response bodies (bodies capped at 10 KB each — anything longer is truncated with a marker; binary responses are summarised). Use this to find failed requests (4xx/5xx), wrong URLs, slow calls, or to inspect what the app actually sent or received. Use 'filter' to narrow by URL/method and 'since' (a ms timestamp) to see only requests that fired after an action. Read-only: it returns a passively captured log and does not issue or modify any requests.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | Filter by URL substring or HTTP method, e.g. 'api' or 'POST' |
| since | number | – | Only requests with ts >= this (ms epoch). Scope to 'what fired after I did X'. |
No output schema declared.
No examples provided.
get_page_info ~137
Return basic page context: current URL, document title, readyState, viewport size, scroll position, user agent, and a 'server' block naming which Feedthrough bridge this page is connected to (name, port, version — null against a pre-0.4 bridge). Read-only and non-destructive: it only reads page state and makes no changes. Useful to orient at the start of a session or confirm a navigation happened. If several agent sessions are running on this machine, check 'server.name' against connection_status: a mismatch means this tab is talking to another session's server, so you are driving the wrong app.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
hover ~254
Hover over an element by dispatching synthetic, bubbling mouseover and mouseenter events from inside the page. This triggers JavaScript hover handlers (onMouseEnter / onMouseOver), so hover-only UI that mounts on hover (tooltips, popovers, dropdown and submenus) appears in the DOM; follow up with query_dom, get_html, or inspect_element to read what was revealed. Three limits to know: it does NOT activate the CSS :hover pseudo-class (that is driven by the real cursor, not synthetic events), so styles or content shown purely via :hover in CSS will not change; no mouseout / mouseleave is sent, so the hovered state stays until the app tears it down or you interact elsewhere; and the events are dispatched whether or not the element is visible or in the viewport (it is not scrolled into view), so a successful call does not by itself confirm anything rendered. If the selector matches nothing the call returns an error. Returns the tag of the hovered element.
| Name | Type | Req | Description |
|---|---|---|---|
| selector | string | yes | A CSS selector for the element to hover, e.g. '#menu-trigger' or '.tooltip-anchor'. Target the element that owns the hover handler (often the trigger, not the popup). |
No output schema declared.
No examples provided.
inspect_element ~470
Return full details about a single element: tag, id, classes, all attributes, text content, bounding rect (top/right/bottom/left/width/height + page scroll and an inViewport flag), a compact ancestor 'path' (e.g. 'body > main > div#app > button.cta'), a curated set of computed styles (layout, box model, typography, positioning, flex/grid), an 'overflow' block when content is clipped/overflowing (scroll vs client size + per-axis x/y flags), a 'clipped' block when an ancestor's overflow cuts the element off (the clipping ancestor + which edges), an effective-visibility check ('visible' boolean, with a 'hiddenReason' such as 'ancestor div#modal display:none' or 'opacity:0' when not visible, accounting for ancestors), an occlusion check ('hittable' boolean from a center-point hit-test, with 'occludedBy' naming the element actually on top when something covers it), an 'a11y' block (resolved role, best-effort accessible name, and key states like expanded/checked/selected/disabled/hidden/tabindex), a 'pseudo' block with ::before/::after content when set (icon fonts, generated text), and live form state where applicable (an input's current value, checked, disabled, etc.). Pass 'properties' to additionally read any specific computed CSS properties by name — they come back under 'requested'. Use this to understand why an element looks wrong or isn't behaving as expected. Read-only: it only reads element state and never changes the page, and it returns an error if the selector matches nothing. Note: addEventListener-registered event handlers cannot be read from the page; only inline on* handler attributes appear (in 'attributes').
| Name | Type | Req | Description |
|---|---|---|---|
| properties | array | – | Extra computed CSS properties to read by name (kebab-case), e.g. ['transform', 'z-index', 'margin-top']. They come back under a 'requested' object, in addition to the curated default set. |
| selector | string | yes | A CSS selector that should resolve to one element, e.g. '#submit-btn' or 'main .card:first-child'. If several match, the first in document order is inspected. |
No output schema declared.
No examples provided.
press_key ~274
Dispatch a key press (keydown/keypress/keyup) on an element — e.g. Enter to submit a search, Escape to close a modal, Tab to move focus, or ArrowUp/ArrowDown in a list. Use named keys (Enter, Escape, Tab, Backspace, Delete, ArrowUp/Down/Left/Right) or a single character. Note: this fires key handlers but does NOT insert text into inputs — use 'fill' to set an input's value, then press_key for the submit/shortcut. If the selector matches nothing the call returns an error; it dispatches the key events and returns without waiting for any resulting navigation or re-render.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | A named key or a single character. Named keys: Enter, Escape, Tab, Backspace, Delete, ArrowUp, ArrowDown, ArrowLeft, ArrowRight (case-sensitive, as in the DOM KeyboardEvent 'key' value). Any other si… |
| selector | string | yes | A CSS selector for the element that receives the key, e.g. '#search-input'. Target a focused or focusable element: Enter on a focused input submits its form, Escape on an open dialog closes it, Tab m… |
No output schema declared.
No examples provided.
query_dom ~137
Query the page with a CSS selector and return a summary of every matching element (tag, id, classes, text content). Good for counting list items, checking what's rendered, or finding the right selector before calling inspect_element or click. Read-only: it only reads the DOM and never changes the page. Returns an empty list (not an error) when nothing matches, so it is also a safe existence check.
| Name | Type | Req | Description |
|---|---|---|---|
| selector | string | yes | A CSS selector matched against the whole document, e.g. '.todo-item', '#search-input', or 'nav a'. Returns every match, so it also works as a count or existence check. |
No output schema declared.
No examples provided.
reset_overrides ~55
Undo every set_style / set_attribute / set_text change the bridge has applied since it connected, restoring the original values. Best effort: elements the framework has since re-created may not roll back (a page reload always fully resets).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
set_attribute ~225
Set or remove an attribute on an element to preview a change (toggle disabled, swap a class, set an aria-* attribute). Pass value=null to remove the attribute. Live preview only — not saved to source, resets on reload. If the attribute is one a framework controls (class, value, checked, disabled, …) the result includes a 'frameworkWarning' that it may be reverted on the next render — relay it. Reset with reset_overrides.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | The attribute name to set or remove, e.g. 'disabled', 'class', 'aria-expanded', 'hidden', or a 'data-*' attribute. |
| selector | string | yes | A CSS selector for the target element, e.g. '#menu' or 'button.cta'. If several match, the first in document order is used. |
| value | string|null | yes | The new value as a string, or null to remove the attribute entirely. For boolean attributes like 'disabled' or 'hidden', any non-null string (even '') sets them; use null to unset. |
No output schema declared.
No examples provided.
set_style ~214
Set one or more inline CSS properties on an element to PREVIEW a visual change live (e.g. shrink a label that doesn't fit, adjust padding or width). This edits the running DOM only — it is NOT saved to source and resets on reload — so tell the user it's a preview, and once they're happy, make the real change in the CSS/component source. Inline styles override the stylesheet and usually survive re-renders. The result includes a 'note' to relay; reset with reset_overrides.
| Name | Type | Req | Description |
|---|---|---|---|
| properties | object | yes | A map of CSS property to value, applied as inline styles. Property names are kebab-case and values are full CSS strings, e.g. { 'font-size': '13px', 'white-space': 'nowrap' }. Pass an empty string as… |
| selector | string | yes | A CSS selector for the element to restyle, e.g. '#banner' or '.cta'. If several match, the first in document order is used. |
No output schema declared.
No examples provided.
set_text ~152
Replace an element's text content to preview wording/label changes. Live preview only — not saved to source, resets on reload. textContent is almost always framework-controlled, so the result includes a 'frameworkWarning' that React/Vue/etc. will likely overwrite it on the next render — relay that, and persist real changes in the source. Reset with reset_overrides.
| Name | Type | Req | Description |
|---|---|---|---|
| selector | string | yes | A CSS selector for the element to relabel, e.g. '#title' or '.cta-label'. If several match, the first in document order is used. |
| text | string | yes | The replacement text, inserted as plain text (not parsed as HTML). Replaces all existing child content of the element. |
No output schema declared.
No examples provided.
What is the io.github.feedthrough/feedthrough MCP server?
io.github.feedthrough/feedthrough is an MCP server listed in the public MCP registry as io.github.feedthrough/feedthrough. Debug bridge inside your web app: an agent reads the DOM, console and network. Any browser. This page covers its npm package (@feedthrough/mcp).
Is the io.github.feedthrough/feedthrough MCP server safe to use?
io.github.feedthrough/feedthrough scores 93 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.feedthrough/feedthrough MCP server expose?
io.github.feedthrough/feedthrough exposes 16 tools: get_instructions, connection_status, get_console_logs, get_network_requests, query_dom, and 11 more. Their descriptions and schemas cost roughly 3,300 tokens of context every time the server is loaded.
Is the io.github.feedthrough/feedthrough MCP server still maintained?
io.github.feedthrough/feedthrough is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.feedthrough/feedthrough MCP server under?
io.github.feedthrough/feedthrough declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.