debuff
NPM · @DEBUFFJP/MCP
Let coding agents play, test and tune your 2D web game: live state, explained errors, replays, fuzz.
Available components
Last scanned (4 hours ago)
Scores higher than 93% of npm servers
Category Testing and QA
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 33 of 155 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to debuffjp/debuff). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability79
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3395 tokens (~130/item across 26 items; 26 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management60
- Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 84% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 26 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 27 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- Package version: 0.28.0 → 0.29.0 functional
- Package version: 0.28.0 → 0.28.1 functional
- 2 Nov 26 −14
- Malware scan: pass → unverified ▼ security
- Package version: 0.27.0 → 0.28.0 functional
- 1 Nov 26 +26
- Stability: 0.43 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Dependency health: unverified → 0.91 ▲ functional
- Package version: 0.26.0 → 0.27.0 functional
- Package version: 0.26.0 → 0.26.2 functional
- Package version: 0.26.0 → 0.26.1 functional
- 31 Oct 26 0
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.91 ▲ functional
- Package version: 0.24.0 → 0.26.0 functional
- Package version: 0.24.0 → 0.24.3 functional
- Package version: 0.24.0 → 0.24.2 functional
- 30 Oct 26 −25
- Known CVEs: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Schema quality: 2650 → 3016 ▼ functional
- Dependency health: 0.91 → unverified ▼ functional
- Package version: 0.21.1 → 0.24.0 functional
- Package version: 0.21.1 → 0.23.0 functional
- 29 Oct 26 +26
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.91 ▲ functional
- 28 Oct 26 +1
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.91 ▲ functional
- Package version: 0.19.0 → 0.21.1 functional
- Package version: 0.19.0 → 0.21.0 functional
- Package version: 0.19.0 → 0.20.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@debuffjp/mcp@0.29.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | debuffjp/debuff |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/debuffjp/debuff/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 3657385125 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:e481b0c4e61c212001da2e3c0e6e59f1ec6cfd91616ad2b069bac6b88977b1b3b9da3e6bc9808f14cc30d7576111f508064d7b013d29275efac380759 |
Background: How many MCP packages publish verified provenance →
Dependencies 155 packages
| Packages resolved | 155 |
|---|---|
| Stale | 33 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
build Production build ~114
Build for production and return the size report (raw, gzip, brotli per file). `leaks` lists dev-only code found in the output; it must be empty. `saves` compares the game's saves with saves.json: an error means players would lose saved progress. Don't accept save changes yourself; tell the human (they run `debuff build --accept-saves`).
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Project root. Absolute path, or relative to the server's root. Default: the server's root. |
No output schema declared.
No examples provided.
doctor Check setup ~144
Check the project's setup in one pass: Node, debuff package versions, node_modules, debuff.config.ts, assets, saves.json, agent files and the browser. Every check has an id, ok, a message and a fix; ok is false only when a required check failed. Call it when another tool fails on setup. live: true also starts the dev server and waits for the game's dev hooks (about 5 to 15 s).
| Name | Type | Req | Description |
|---|---|---|---|
| live | boolean | – | Also boot the game and check its dev hooks. Default false. |
| root | string | – | Project root. Absolute path, or relative to the server's root. Default: the server's root. |
No output schema declared.
No examples provided.
fuzz Fuzz playtest ~201
Play the game headlessly with random but plausible input (movement keys held, action keys tapped) to find runtime errors, stuck states and back-and-forth loops. Each finding includes the explained error (kind, source-mapped file:line, hint) and `repro`: a scenario file that replays it exactly. Pass that file to run_scenarios to reproduce, then again after fixing to verify. The same seed gives the same inputs.
| Name | Type | Req | Description |
|---|---|---|---|
| keys | array | – | KeyboardEvent.code values to press. Default: arrows, WASD, Space, Enter, Z, X. |
| root | string | – | Project root. Absolute path, or relative to the server's root. Default: the server's root. |
| runs | integer | – | Independent runs. Default 3. |
| seconds | number | – | Simulated seconds of play per run. Default 60. |
| seed | integer | – | Input seed; reuse it to repeat a run exactly. |
No output schema declared.
No examples provided.
game_capture Capture frame ~160
Screenshot of the current frame as a PNG image. With `path`, also saves it to that file in the project. social: true letterboxes it into 1200×675 (16:9), the size X and Bluesky show for post images and link cards; save those under .debuff/captures/ and `debuff ship press` adds them to the press kit.
| Name | Type | Req | Description |
|---|---|---|---|
| background | string | – | Letterbox colour with social, as CSS (default #000000). |
| path | string | – | Save the PNG here, relative to the project root (e.g. public/thumbnail.png). Overwrites. |
| social | boolean | – | Letterbox into 1200×675, scaled by whole pixels so pixel art stays crisp. |
No output schema declared.
No examples provided.
game_clip Record a clip ~149
Video clips of the live game for devlogs, store pages and press kits. action start keeps a rolling recording of the last 15 s; save writes what it has (between about 7 and 15 s) to .debuff/captures/<name>.mp4 (WebM in browsers that can't record MP4) and keeps recording; stop ends it. Play or drive the game with game_input between start and save. Live mode only: clips record real time. The human posts; never post anywhere yourself.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| name | string | – | File name for save, without extension (letters, digits, - and _). Default clip-<timestamp>. |
No output schema declared.
No examples provided.
game_command Run a game command ~100
Run a command the game registered with devTools({ commands }) (warp to a level, grant an item, select a cell), like a scenario's { command, args } step; recorded in replays. Prefer it over computing screen coordinates for game_input. An unknown name lists the registered ones. Returns the command's result and the new state.
| Name | Type | Req | Description |
|---|---|---|---|
| args | array | – | JSON arguments, passed in order. |
| name | string | yes | Command name. |
No output schema declared.
No examples provided.
game_errors Runtime errors ~105
Runtime errors since the game started, explained: kind (your-code, debuff-usage, debuff-bug, outside), where (source file:line, source-mapped), a hint, the loop phase and tick, and a repeat count. A loop error stops the game; fix it, then game_pause false to resume. For debuff-bug, tell the human and share reportUrl rather than working around it. Type errors aren't runtime errors: use typecheck.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
game_frames Frame breakdown ~133
Recent frames, oldest first: intervalMs (what the player feels), updateMs, renderMs, steps (>1 means catching up), quads, drawCalls and longTaskMs (browser-reported main-thread stalls). Use it to explain stutter; in headless mode times reflect stepping, not real play. summary: true returns percentiles and the 3 slowest frames instead of every frame.
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | Default 60. |
| summary | boolean | – | Count, p50/p95/max of updateMs, renderMs, quads and drawCalls, and the 3 slowest frames. |
No output schema declared.
No examples provided.
game_input Send input ~216
Keyboard, pointer, wheel or touch input. press/release take a KeyboardEvent.code (e.g. Space, ArrowLeft, KeyZ), or PointerRight / PointerMiddle for mouse buttons. tap/pointer_down/pointer_move take logical x, y; tap and pointer_down also take kind (mouse, touch or pen). wheel takes dy (and dx) in CSS pixels. touch_down/touch_move take id, x, y (touch_down also kind: touch or pen); touch_up takes id. Input takes effect on the next game_step.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| code | string | – | For press/release. |
| dx | number | – | For wheel: horizontal scroll. |
| dy | number | – | For wheel: vertical scroll, positive = down. |
| id | integer | – | Touch contact id for touch_down/touch_move/touch_up. |
| kind | string | – | Pointer kind for tap, pointer_down and touch_down. |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
game_notes Human notes ~41
Moments the human flagged in the overlay (live mode): their words, the tick, the scene's inspect() state then, and the frames leading up to it.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
game_params List params ~32
Every tunable param group: schema (type, default, min, max, units, description) and current values.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
game_pause Pause or resume ~35
Pause or resume a live game (headless games are always paused). game_step also pauses first.
| Name | Type | Req | Description |
|---|---|---|---|
| paused | boolean | yes | – |
No output schema declared.
No examples provided.
game_profile Frame profile ~117
Why the game stutters, from myaku: frame-time percentiles (p50/p95/p99), hitches per minute, and the worst hitches explained. Each has a cause (script, gc, upload, compile, layout, throttled, hidden, unknown), a confidence, the script and function to look at when known, and a hint. Spans show time in debuff's update and render. Prefer this over game_frames to explain stutter; measure in live mode, since headless stepping doesn't reflect real play.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
game_replay Save a replay ~112
Everything played since the game loaded (keys, pointer, param changes) up to `toTick` (default: now), saved as a scenario in .debuff/replays/ that replays it exactly. Use a note's `tick` to reproduce what the human saw when they flagged it, then run_scenarios with the returned file. `warnings` lists anything a replay can't reproduce (for example slow motion).
| Name | Type | Req | Description |
|---|---|---|---|
| toTick | integer | – | Last tick to include. Default: the current tick. |
No output schema declared.
No examples provided.
game_rewind Rewind the live game ~111
Live mode only. Take the human's game back (or forward, within the known session) to `tick`: the page reloads, replays the session's inputs to that tick and stays paused, so the state is exactly what it was then. Use a note's `tick` to look at the moment the human flagged. The page needs a second to reload; then use game_state or game_capture.
| Name | Type | Req | Description |
|---|---|---|---|
| tick | integer | yes | Tick to go to, e.g. a note's tick. |
No output schema declared.
No examples provided.
game_set_param Set param ~59
Set a tunable param live. Values are validated against the param's type and range. Changes last until game_start or a reload.
| Name | Type | Req | Description |
|---|---|---|---|
| group | string | yes | – |
| key | string | yes | – |
| value | number|boolean | yes | – |
No output schema declared.
No examples provided.
game_start Start game ~243
Connect to the game. auto (default): attach to the human's live game if `debuff dev` has it open in a browser, else start a private headless copy, paused. Returns the mode, state and how many notes the human has flagged. Replaces any running session. A headless copy holds a browser (about ten Chromium processes) until game_stop, so call that when you are done; it also closes after 15 idle minutes.
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | – | Default auto. |
| page | string | – | Path to open in headless mode. Default "/". |
| reducedMotion | boolean | – | Force game.reducedMotion on or off for this session. Default: leave it; the state's reducedMotion says what it is. When true, games may freeze animations. |
| root | string | – | Project root. Absolute path, or relative to the server's root. Default: the server's root. |
| viewport | array | – | Headless only: browser viewport [width, height] in CSS pixels. Default [960, 540]. Try [390, 844] to test a scale: "expand" game in phone portrait. |
No output schema declared.
No examples provided.
game_state Game state ~60
Current scene, tick, time, logical width and height, renderer, frame stats, the scene's inspect() data and plugin inspect data. reducedMotion true means the game may freeze or tone down its animations (reducedMotionForced: game_start forced it).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
game_step Advance time ~63
Advance the simulation by fixed steps (60 per second by default) and return the new state.
| Name | Type | Req | Description |
|---|---|---|---|
| quiet | boolean | – | Leave out the scene's inspect() state and plugin data, to keep the result short. |
| steps | integer | yes | Fixed simulation steps to run. |
No output schema declared.
No examples provided.
game_stop Stop game ~28
Headless: close the browser and dev server. Live: resume the human's game and disconnect.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
inspect_project Inspect project ~53
Summary of the project: dependencies, plugins and their contributions, assets, last build size.
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Project root. Absolute path, or relative to the server's root. Default: the server's root. |
No output schema declared.
No examples provided.
list_assets List assets ~60
Run the asset pipeline: every asset id, type, size and importer, plus generated files, warnings and possibly unused ids.
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Project root. Absolute path, or relative to the server's root. Default: the server's root. |
No output schema declared.
No examples provided.
report_papercut Report papercut ~315
Report tooling friction in debuff, keiko, myaku, spryte or debuff.jp to the public board at papercuts.debuff.jp: a slow or flaky tool, a missing API, confusing docs. Call it on your own, without being asked, whenever a debuff tool cost you time, once you are unstuck; then tell the human in one line. It checks for duplicates first: when it returns action "similar", call again with hit set to the matching id (that adds your minutes to it) or with force: true if none is the same problem. Write the title as the symptom. Never include secrets, file contents or personal data: open entries are public.
| Name | Type | Req | Description |
|---|---|---|---|
| area | string | – | Package, command or page: "cli test", "docs/assets". |
| body | string | – | What happened. With hit, a short note for the hit. |
| force | boolean | – | File it even when similar papercuts exist. |
| hit | integer | – | Add a hit to this papercut id instead of filing a new one. |
| kind | string | – | – |
| minutes | number | – | Minutes it cost you this time. |
| repo | string | – | Default debuff. |
| title | string | yes | The symptom, at least 8 characters: "vitest times out on tsc tests under load". |
| workaround | string | – | What got you unstuck. With hit, it fills the papercut's workaround when it has none. |
No output schema declared.
No examples provided.
run_scenarios Run scenarios ~131
Run scenarios/*.json (or the given files) in a headless browser. Returns per-step results, runtime errors, captures and final state. Pass `files` while iterating; a full run starts a browser, so run it once when the work is done.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | – | Scenario files relative to the root. Default: all. |
| root | string | – | Project root. Absolute path, or relative to the server's root. Default: the server's root. |
| update | boolean | – | Accept new captures as baselines. Only when the human has approved the visual change. |
No output schema declared.
No examples provided.
run_tests Run logic tests ~152
Run the logic tests in tests/**/*.test.ts (keiko): the real game in Node, no browser, in milliseconds. Each failure has its message, the source line, and the game's tick, scene and state when it failed. While iterating pass `files` or `filter` to run only what your change touches, and run everything once when the work is done. Write a test for each mechanic you add.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | – | Test files relative to the root. Default: all. |
| filter | string | – | Only run tests whose name contains this text. |
| root | string | – | Project root. Absolute path, or relative to the server's root. Default: the server's root. |
No output schema declared.
No examples provided.
typecheck Type-check ~92
Type-check the project with its own tsc (no emit, no browser needed). Returns diagnostics: file (relative to the root), line, column, TypeScript code and message. Run it after editing code; vite doesn't type-check, so the game can run with type errors.
| Name | Type | Req | Description |
|---|---|---|---|
| root | string | – | Project root. Absolute path, or relative to the server's root. Default: the server's root. |
No output schema declared.
No examples provided.
How do I install the debuff MCP server?
debuff runs locally as an npm package, launched with npx -y @debuffjp/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @debuffjp/mcp
claude mcp add jp-debuff-debuff -- npx -y @debuffjp/mcp
What is the debuff MCP server?
debuff is an MCP server listed in the public MCP registry as jp.debuff/debuff. Let coding agents play, test and tune your 2D web game: live state, explained errors, replays, fuzz. This page covers its npm package (@debuffjp/mcp).
Is the debuff MCP server safe to use?
debuff scores 90 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the debuff MCP server expose?
debuff exposes 26 tools: inspect_project, doctor, list_assets, typecheck, build, and 21 more. Their descriptions and schemas cost roughly 3,026 tokens of context every time the server is loaded.
Is the debuff MCP server still maintained?
debuff is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the debuff MCP server under?
debuff declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.