# debuff (npm · @debuffjp/mcp)

Let coding agents play, test and tune your 2D web game: live state, explained errors, replays, fuzz.

- Trust score: 90/100 (high trust)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `@debuffjp/mcp`: 90/100 (this document), [markdown](https://verifymcp.io/servers/jp-debuff-debuff/debuffjp-mcp.md), [page](https://verifymcp.io/servers/jp-debuff-debuff/debuffjp-mcp)

## Channel facts

- Registry: `npm`
- Package: `@debuffjp/mcp`
- Version: `0.29.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 99/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 33 of 155 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to debuffjp/debuff).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 79/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3395 tokens (~130/item across 26 items; 26 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 60/100
  - Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 84% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 26 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 27 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the debuff MCP server?

debuff runs locally as an npm package, launched with npx -y @debuffjp/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add jp-debuff-debuff -- npx -y @debuffjp/mcp
```

### Cursor

```json
{
  "mcpServers": {
    "jp-debuff-debuff": {
      "command": "npx",
      "args": [
        "-y",
        "@debuffjp/mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "jp-debuff-debuff": {
      "command": "npx",
      "args": [
        "-y",
        "@debuffjp/mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add jp-debuff-debuff -- npx -y @debuffjp/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "jp-debuff-debuff": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@debuffjp/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add jp-debuff-debuff --command npx --arg -y --arg @debuffjp/mcp
```

### Hermes

```yaml
mcp_servers:
  jp-debuff-debuff:
    command: "npx"
    args: ["-y", "@debuffjp/mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "jp-debuff-debuff": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@debuffjp/mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add jp-debuff-debuff -t stdio -c npx -a -y @debuffjp/mcp
```

### Other

```json
{
  "mcpServers": {
    "jp-debuff-debuff": {
      "command": "npx",
      "args": [
        "-y",
        "@debuffjp/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 90, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-03 (score 89, +15)

- [security improvement] Malware scan: unverified → pass
- [functional] Package version: 0.28.0 → 0.29.0
- [functional] Package version: 0.28.0 → 0.28.1

### 2026-11-02 (score 74, −14)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 0.27.0 → 0.28.0

### 2026-11-01 (score 88, +26)

- [security regression] Stability: 0.43 → unverified
- [security regression] Tool safety: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [security improvement] Known CVEs: unverified → pass
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional improvement] Dependency health: unverified → 0.91
- [functional] Package version: 0.26.0 → 0.27.0
- [functional] Package version: 0.26.0 → 0.26.2
- [functional] Package version: 0.26.0 → 0.26.1

### 2026-10-31 (score 62, 0)

- [security improvement] Malware scan: unverified → pass
- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → 0.91
- [functional] Package version: 0.24.0 → 0.26.0
- [functional] Package version: 0.24.0 → 0.24.3
- [functional] Package version: 0.24.0 → 0.24.2

### 2026-10-30 (score 62, −25)

- [security regression] Known CVEs: pass → unverified
- [security regression] Malware scan: pass → unverified
- [functional regression] Schema quality: 2650 → 3016
- [functional regression] Dependency health: 0.91 → unverified
- [functional] Package version: 0.21.1 → 0.24.0
- [functional] Package version: 0.21.1 → 0.23.0

### 2026-10-29 (score 87, +26)

- [security improvement] Malware scan: unverified → pass
- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → 0.91

### 2026-10-28 (score 61, +1)

- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → 0.91
- [functional] Package version: 0.19.0 → 0.21.1
- [functional] Package version: 0.19.0 → 0.21.0
- [functional] Package version: 0.19.0 → 0.20.0

## MCP tools (26)

### `inspect_project` (~53 tokens)

Inspect project

Summary of the project: dependencies, plugins and their contributions, assets, last build size.

Input parameters:

- `root` (string): Project root. Absolute path, or relative to the server's root. Default: the server's root.

### `doctor` (~144 tokens)

Check setup

Check the project's setup in one pass: Node, debuff package versions, node_modules, debuff.config.ts, assets, saves.json, agent files and the browser. Every check has an id, ok, a message and a fix; ok is false only when a required check failed. Call it when another tool fails on setup. live: true also starts the dev server and waits for the game's dev hooks (about 5 to 15 s).

Input parameters:

- `live` (boolean): Also boot the game and check its dev hooks. Default false.
- `root` (string): Project root. Absolute path, or relative to the server's root. Default: the server's root.

### `list_assets` (~60 tokens)

List assets

Run the asset pipeline: every asset id, type, size and importer, plus generated files, warnings and possibly unused ids.

Input parameters:

- `root` (string): Project root. Absolute path, or relative to the server's root. Default: the server's root.

### `typecheck` (~92 tokens)

Type-check

Type-check the project with its own tsc (no emit, no browser needed). Returns diagnostics: file (relative to the root), line, column, TypeScript code and message. Run it after editing code; vite doesn't type-check, so the game can run with type errors.

Input parameters:

- `root` (string): Project root. Absolute path, or relative to the server's root. Default: the server's root.

### `build` (~114 tokens)

Production build

Build for production and return the size report (raw, gzip, brotli per file). `leaks` lists dev-only code found in the output; it must be empty. `saves` compares the game's saves with saves.json: an error means players would lose saved progress. Don't accept save changes yourself; tell the human (they run `debuff build --accept-saves`).

Input parameters:

- `root` (string): Project root. Absolute path, or relative to the server's root. Default: the server's root.

### `run_tests` (~152 tokens)

Run logic tests

Run the logic tests in tests/**/*.test.ts (keiko): the real game in Node, no browser, in milliseconds. Each failure has its message, the source line, and the game's tick, scene and state when it failed. While iterating pass `files` or `filter` to run only what your change touches, and run everything once when the work is done. Write a test for each mechanic you add.

Input parameters:

- `files` (array): Test files relative to the root. Default: all.
- `filter` (string): Only run tests whose name contains this text.
- `root` (string): Project root. Absolute path, or relative to the server's root. Default: the server's root.

### `run_scenarios` (~131 tokens)

Run scenarios

Run scenarios/*.json (or the given files) in a headless browser. Returns per-step results, runtime errors, captures and final state. Pass `files` while iterating; a full run starts a browser, so run it once when the work is done.

Input parameters:

- `files` (array): Scenario files relative to the root. Default: all.
- `root` (string): Project root. Absolute path, or relative to the server's root. Default: the server's root.
- `update` (boolean): Accept new captures as baselines. Only when the human has approved the visual change.

### `fuzz` (~201 tokens)

Fuzz playtest

Play the game headlessly with random but plausible input (movement keys held, action keys tapped) to find runtime errors, stuck states and back-and-forth loops. Each finding includes the explained error (kind, source-mapped file:line, hint) and `repro`: a scenario file that replays it exactly. Pass that file to run_scenarios to reproduce, then again after fixing to verify. The same seed gives the same inputs.

Input parameters:

- `keys` (array): KeyboardEvent.code values to press. Default: arrows, WASD, Space, Enter, Z, X.
- `root` (string): Project root. Absolute path, or relative to the server's root. Default: the server's root.
- `runs` (integer): Independent runs. Default 3.
- `seconds` (number): Simulated seconds of play per run. Default 60.
- `seed` (integer): Input seed; reuse it to repeat a run exactly.

### `game_start` (~243 tokens)

Start game

Connect to the game. auto (default): attach to the human's live game if `debuff dev` has it open in a browser, else start a private headless copy, paused. Returns the mode, state and how many notes the human has flagged. Replaces any running session. A headless copy holds a browser (about ten Chromium processes) until game_stop, so call that when you are done; it also closes after 15 idle minutes.

Input parameters:

- `mode` (string): Default auto.
- `page` (string): Path to open in headless mode. Default "/".
- `reducedMotion` (boolean): Force game.reducedMotion on or off for this session. Default: leave it; the state's reducedMotion says what it is. When true, games may freeze animations.
- `root` (string): Project root. Absolute path, or relative to the server's root. Default: the server's root.
- `viewport` (array): Headless only: browser viewport [width, height] in CSS pixels. Default [960, 540]. Try [390, 844] to test a scale: "expand" game in phone portrait.

### `game_state` (~60 tokens)

Game state

Current scene, tick, time, logical width and height, renderer, frame stats, the scene's inspect() data and plugin inspect data. reducedMotion true means the game may freeze or tone down its animations (reducedMotionForced: game_start forced it).

### `game_step` (~63 tokens)

Advance time

Advance the simulation by fixed steps (60 per second by default) and return the new state.

Input parameters:

- `quiet` (boolean): Leave out the scene's inspect() state and plugin data, to keep the result short.
- `steps` (integer, required): Fixed simulation steps to run.

### `game_command` (~100 tokens)

Run a game command

Run a command the game registered with devTools({ commands }) (warp to a level, grant an item, select a cell), like a scenario's { command, args } step; recorded in replays. Prefer it over computing screen coordinates for game_input. An unknown name lists the registered ones. Returns the command's result and the new state.

Input parameters:

- `args` (array): JSON arguments, passed in order.
- `name` (string, required): Command name.

### `game_input` (~216 tokens)

Send input

Keyboard, pointer, wheel or touch input. press/release take a KeyboardEvent.code (e.g. Space, ArrowLeft, KeyZ), or PointerRight / PointerMiddle for mouse buttons. tap/pointer_down/pointer_move take logical x, y; tap and pointer_down also take kind (mouse, touch or pen). wheel takes dy (and dx) in CSS pixels. touch_down/touch_move take id, x, y (touch_down also kind: touch or pen); touch_up takes id. Input takes effect on the next game_step.

Input parameters:

- `action` (string, required)
- `code` (string): For press/release.
- `dx` (number): For wheel: horizontal scroll.
- `dy` (number): For wheel: vertical scroll, positive = down.
- `id` (integer): Touch contact id for touch_down/touch_move/touch_up.
- `kind` (string): Pointer kind for tap, pointer_down and touch_down.
- `x` (number)
- `y` (number)

### `game_params` (~32 tokens)

List params

Every tunable param group: schema (type, default, min, max, units, description) and current values.

### `game_set_param` (~59 tokens)

Set param

Set a tunable param live. Values are validated against the param's type and range. Changes last until game_start or a reload.

Input parameters:

- `group` (string, required)
- `key` (string, required)
- `value` (number|boolean, required)

### `game_capture` (~160 tokens)

Capture frame

Screenshot of the current frame as a PNG image. With `path`, also saves it to that file in the project. social: true letterboxes it into 1200×675 (16:9), the size X and Bluesky show for post images and link cards; save those under .debuff/captures/ and `debuff ship press` adds them to the press kit.

Input parameters:

- `background` (string): Letterbox colour with social, as CSS (default #000000).
- `path` (string): Save the PNG here, relative to the project root (e.g. public/thumbnail.png). Overwrites.
- `social` (boolean): Letterbox into 1200×675, scaled by whole pixels so pixel art stays crisp.

### `game_clip` (~149 tokens)

Record a clip

Video clips of the live game for devlogs, store pages and press kits. action start keeps a rolling recording of the last 15 s; save writes what it has (between about 7 and 15 s) to .debuff/captures/<name>.mp4 (WebM in browsers that can't record MP4) and keeps recording; stop ends it. Play or drive the game with game_input between start and save. Live mode only: clips record real time. The human posts; never post anywhere yourself.

Input parameters:

- `action` (string, required)
- `name` (string): File name for save, without extension (letters, digits, - and _). Default clip-<timestamp>.

### `game_pause` (~35 tokens)

Pause or resume

Pause or resume a live game (headless games are always paused). game_step also pauses first.

Input parameters:

- `paused` (boolean, required)

### `game_frames` (~133 tokens)

Frame breakdown

Recent frames, oldest first: intervalMs (what the player feels), updateMs, renderMs, steps (>1 means catching up), quads, drawCalls and longTaskMs (browser-reported main-thread stalls). Use it to explain stutter; in headless mode times reflect stepping, not real play. summary: true returns percentiles and the 3 slowest frames instead of every frame.

Input parameters:

- `count` (integer): Default 60.
- `summary` (boolean): Count, p50/p95/max of updateMs, renderMs, quads and drawCalls, and the 3 slowest frames.

### `game_profile` (~117 tokens)

Frame profile

Why the game stutters, from myaku: frame-time percentiles (p50/p95/p99), hitches per minute, and the worst hitches explained. Each has a cause (script, gc, upload, compile, layout, throttled, hidden, unknown), a confidence, the script and function to look at when known, and a hint. Spans show time in debuff's update and render. Prefer this over game_frames to explain stutter; measure in live mode, since headless stepping doesn't reflect real play.

### `game_notes` (~41 tokens)

Human notes

Moments the human flagged in the overlay (live mode): their words, the tick, the scene's inspect() state then, and the frames leading up to it.

### `game_replay` (~112 tokens)

Save a replay

Everything played since the game loaded (keys, pointer, param changes) up to `toTick` (default: now), saved as a scenario in .debuff/replays/ that replays it exactly. Use a note's `tick` to reproduce what the human saw when they flagged it, then run_scenarios with the returned file. `warnings` lists anything a replay can't reproduce (for example slow motion).

Input parameters:

- `toTick` (integer): Last tick to include. Default: the current tick.

### `game_rewind` (~111 tokens)

Rewind the live game

Live mode only. Take the human's game back (or forward, within the known session) to `tick`: the page reloads, replays the session's inputs to that tick and stays paused, so the state is exactly what it was then. Use a note's `tick` to look at the moment the human flagged. The page needs a second to reload; then use game_state or game_capture.

Input parameters:

- `tick` (integer, required): Tick to go to, e.g. a note's tick.

### `game_errors` (~105 tokens)

Runtime errors

Runtime errors since the game started, explained: kind (your-code, debuff-usage, debuff-bug, outside), where (source file:line, source-mapped), a hint, the loop phase and tick, and a repeat count. A loop error stops the game; fix it, then game_pause false to resume. For debuff-bug, tell the human and share reportUrl rather than working around it. Type errors aren't runtime errors: use typecheck.

### `game_stop` (~28 tokens)

Stop game

Headless: close the browser and dev server. Live: resume the human's game and disconnect.

### `report_papercut` (~315 tokens)

Report papercut

Report tooling friction in debuff, keiko, myaku, spryte or debuff.jp to the public board at papercuts.debuff.jp: a slow or flaky tool, a missing API, confusing docs. Call it on your own, without being asked, whenever a debuff tool cost you time, once you are unstuck; then tell the human in one line. It checks for duplicates first: when it returns action "similar", call again with hit set to the matching id (that adds your minutes to it) or with force: true if none is the same problem. Write the title as the symptom. Never include secrets, file contents or personal data: open entries are public.

Input parameters:

- `area` (string): Package, command or page: "cli test", "docs/assets".
- `body` (string): What happened. With hit, a short note for the hit.
- `force` (boolean): File it even when similar papercuts exist.
- `hit` (integer): Add a hit to this papercut id instead of filing a new one.
- `kind` (string)
- `minutes` (number): Minutes it cost you this time.
- `repo` (string): Default debuff.
- `title` (string, required): The symptom, at least 8 characters: "vitest times out on tsc tests under load".
- `workaround` (string): What got you unstuck. With hit, it fills the papercut's workaround when it has none.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/jp-debuff-debuff/debuffjp-mcp#diagnostics

## Score history

- 2026-11-05: 90
- 2026-11-04: 90
- 2026-11-03: 89
- 2026-11-02: 74
- 2026-11-01: 88
- 2026-10-31: 62
- 2026-10-30: 62
- 2026-10-29: 87
- 2026-10-28: 61
- 2026-10-27: 60
- 2026-10-26: 86
- 2026-10-25: 85
- 2026-10-24: 85
- 2026-10-23: 59
- 2026-10-22: 73
- 2026-10-21: 58
- 2026-10-20: 57
- 2026-10-19: 72
- 2026-10-18: 60

## Common questions

### What is the debuff MCP server?

debuff is an MCP server listed in the public MCP registry as jp.debuff/debuff. Let coding agents play, test and tune your 2D web game: live state, explained errors, replays, fuzz. This page covers its npm package (@debuffjp/mcp).

### Is the debuff MCP server safe to use?

debuff scores 90 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the debuff MCP server expose?

debuff exposes 26 tools: inspect_project, doctor, list_assets, typecheck, build, and 21 more. Their descriptions and schemas cost roughly 3,026 tokens of context every time the server is loaded.

### Is the debuff MCP server still maintained?

debuff is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the debuff MCP server under?

debuff declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@debuffjp/mcp
- Socket report: https://socket.dev/npm/package/@debuffjp/mcp
- Repository: https://github.com/debuffjp/debuff
- Website: https://debuff.jp/docs/agents
- Changelog RSS feed: https://verifymcp.io/servers/jp-debuff-debuff/debuffjp-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/jp-debuff-debuff/debuffjp-mcp.json
- HTML version of this page: https://verifymcp.io/servers/jp-debuff-debuff/debuffjp-mcp