Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

JVMind MAT Heap Dump Analyzer

PYPI · JVMIND-MAT-MCP

Analyze Java heap dumps locally with Eclipse MAT, including live JVM capture.

Available components

+3 this week 71 Trust /100

Last scanned (3 hours ago)

Scores higher than 67% of PyPI servers

Category Monitoring and Observability

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security50
  • Malware scan not yet available for this package.Unverified
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
  • 1 of 33 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to kengrary/web_mat_project). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 12 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability64
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 2312 tokens (~121/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management63
  • Stability observed for 19 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage76
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 15% of tool parameters carry a description.Partial
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 −14
    • Malware scan: pass → unverified ▼ security
  • 4 Nov 26 +15
    • Malware scan: unverified → pass ▲ security
  • 3 Nov 26 −14
    • Malware scan: pass → unverified ▼ security
  • 31 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

  • 30 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 29 Oct 26 −14
    • Malware scan: pass → unverified ▼ security
  • 27 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

  • 26 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed pypi/jvmind-mat-mcp@0.2.1

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem pypi
Reason Verified
Discovered via Registry attestation endpoint
Source repo kengrary/web_mat_project
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/kengrary/web_mat_project/.github/workflows/publish-mcp.yml@refs/tags/mcp-v0.2.1
Rekor log index 3420502503
Predicate type PyPI publish attestation https://docs.pypi.org/attestations/publish/v1
Subject digest sha256:7eebc85134f5d16c8bb86fa7d895117aef431b99cc111692a8c0148cfdb6b6dd

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted setuptools.build_meta

Background: Why install scripts are a supply-chain risk →

Dependencies 33 packages
Packages resolved 33
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 19 exposed · ~2,061 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
close_heapdump ~66

Release a heap dump handle. Set stop_service=true to also stop the MAT helper process. / 释放堆转储句柄;stop_service=true 时同时停止 MAT 辅助进程。

NameTypeReqDescription
report_idstringyes–
stop_serviceboolean––
NameTypeReqDescription
resultstringyes–

No examples provided.

dump_java_heap ~182

Capture a LIVE heap dump from a running JVM and start MAT parsing. First call with confirm=false (default) to preview the target, output directory, disk space, and timeout; call again with confirm=true to execute. A live dump triggers a Full GC and may pause the target JVM. The dump is written to output_dir (default: current working directory) and is automatically opened for MAT parsing. / 从运行中的 JVM 抓取 live 堆转储并自动开始 MAT 解析。先用默认 confirm=false 预览目标、输出目录、磁盘空间和超时,再用 confirm=true 执行。live dump 会触发 一次 Full GC,可能暂停目标 JVM;默认输出到当前目录。

NameTypeReqDescription
confirmboolean––
output_dir–––
pidintegeryes–
timeout–––
NameTypeReqDescription
resultstringyes–

No examples provided.

get_heapdump_status ~43

Get parse status and progress for a heap dump report. / 查询堆转储报告的解析状态与进度。

NameTypeReqDescription
report_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

list_heapdumps ~40

List heap dumps known to this MCP server with their status. / 列出本 MCP 服务已知的堆转储及其状态。

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes–

No examples provided.

list_java_processes ~87

Discover local Java processes that can be attached for a live heap dump. Returns pid, main class, command, and masked JVM arguments. The managed MAT helper is excluded. / 主动发现本机可 attach 的 Java 进程,返回 pid、主类、命令行和已掩码的 JVM 参数;MAT 辅助进程会被排除。

Input schema present but exposes no named parameters.

NameTypeReqDescription
resultstringyes–

No examples provided.

mat_connection_pools ~69

Diagnose DB connection pools (active/idle counts + leaked connections held > thresholdMs). / 诊断数据库连接池(活跃/空闲数 + 持有超过 thresholdMs 的泄漏连接)。

NameTypeReqDescription
report_idstringyes–
thresholdMsinteger––
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_diagnose_oom ~85

Run comprehensive OOM diagnosis (async) combining leak suspects + SQL-in-threads + dominator analysis. / 综合 OOM 诊断(异步),聚合泄漏嫌疑、线程中的 SQL、支配树分析。

NameTypeReqDescription
culpritPctinteger––
onlyRiskyboolean––
report_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_dominator ~74

Dominator tree: list biggest retained-heap dominators, drill down by passing parent objectId. / 支配树:列出 retained 最大的支配者,传 parent=objectId 可下钻。

NameTypeReqDescription
parentstring––
report_idstringyes–
topinteger––
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_histogram ~104

Class histogram sorted by shallow/retained/count. Top-N by default; pass top to override. objectSet reuses a prior OQL/RS result. / 按 shallow/retained/count 排序的类直方图,默认 Top-20。objectSet 可复用先前 OQL/RS 结果。

NameTypeReqDescription
objectSet–––
report_idstringyes–
sortstring––
topinteger––
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_leak_suspects ~76

Run LeakHunter (async) — returns leak suspects with retained size and description. SLOW: may take a minute. / 运行 LeakHunter(异步),返回疑似泄漏点及 retained 大小与描述。慢查询,可能耗时数十秒。

NameTypeReqDescription
report_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_object ~76

Inspect a single object (class, fields, statics, in/out refs, GC root). Required: object id. / 检查单个对象(类、字段、静态字段、入/出引用、GC Root)。必须传 object id。

NameTypeReqDescription
idstringyes–
report_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_oql ~155

Run an OQL query against the heap (slow!). Returns rows + a reusable resultSetId. Examples: "SELECT * FROM com.example.Foo s", "SELECT s.id.toString() FROM java.lang.String s". OQL can read arbitrary strings from the heap; handle results as private data. / 执行 OQL 查询(较慢)。返回行和可复用的 resultSetId。示例:SELECT * FROM com.example.Foo s。OQL 可读取堆内任意字符串,注意隐私。

NameTypeReqDescription
limitinteger––
qstringyes–
report_idstringyes–
sortstring––
viewstring––
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_overview ~100

Show heap overview (used/committed/live heap, object/class/classloader counts, JDK version, leak suspect count). Always call this first to understand a heapdump. / 展示堆总览(已用/已提交/存活堆、对象/类/类加载器数量、JDK 版本、泄漏嫌疑数量)。分析 heapdump 时先调用本工具。

NameTypeReqDescription
report_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_path2gc ~270

Read-only, synchronous lookup of the shortest reference chains from one object to GC roots, explaining why that object is still reachable and not collected. Returns up to five linear paths plus MAT's path tree. Typical flow: get an object id from mat_object, mat_histogram, mat_dominator, or a mat_leak_suspects preferredObjectId, confirm it with mat_object, then call this tool. Use mat_dominator instead when you want to know which object retains an entire subtree; use mat_leak_suspects when you do not yet have a specific object. Requires the report_id of a parsed dump (status=DONE).

NameTypeReqDescription
excludeWeakSoftboolean–true (default) ignores paths through weak, soft, and phantom references, so only strong references that actually pin the object are shown. false includes reference types the GC may clear.
objectstringyesMAT object id as a decimal integer, copied from the objectId / preferredObjectId field of mat_object, mat_histogram, mat_dominator, or mat_leak_suspects. This endpoint does not accept 0x-prefixed hex.
report_idstringyesReport ID returned by open_heapdump or dump_java_heap; the dump must have finished parsing (status must be DONE).
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_sql_in_threads ~221

Read-only scan of thread stacks for JDBC PreparedStatement objects and SQL strings, used to spot long-running or heavy queries held by threads at OOM time. Requires the report_id of a parsed dump (status=DONE). Results are sorted risky-first, then by the owning thread's retained heap, and include threadId, threadName, threadRetainedBytes, frame, source, objectId, sql, risk (risky|harmless|unknown), and reason. With onlyRisky=true, heartbeat/validation statements such as SELECT 1, SELECT 'x', /* ping */ and VALUES(1) are filtered out; pass onlyRisky=false to see all SQL-like strings.

NameTypeReqDescription
onlyRiskyboolean–true (default) drops harmless heartbeat/validation SQL (SELECT 1, SELECT 'x', /* ping */, VALUES(1)); false returns every SQL-like string found.
report_idstringyesReport ID returned by open_heapdump or dump_java_heap; the dump must have finished parsing (status must be DONE).
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_threadlocals ~70

Inspect thread locals grouped by valueClass (default) or thread. Useful for finding thread-local leaks. / 按 valueClass(默认)或 thread 分组查看 ThreadLocal,常用于发现 ThreadLocal 泄漏。

NameTypeReqDescription
groupBystring––
report_idstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_threads ~104

List threads (name/state/daemon/frameCount), or drill into a thread's stack frames (pass thread=id) or frame locals (pass frame=idx). / 列出线程(名/状态/daemon/帧数),或下钻到某线程的栈帧(传 thread=id)、某帧的局部变量(再传 frame=idx)。

NameTypeReqDescription
frame–––
report_idstringyes–
thread–––
NameTypeReqDescription
resultstringyes–

No examples provided.

mat_top_consumers ~138

Read-only Top Consumers report: biggest individual objects plus retained-size breakdowns by class, class loader, and package. Use this as a quick 'who is using the most memory' overview after mat_overview. Prefer mat_histogram when you need a sortable list of every class with instance counts and shallow/retained sizes, and mat_dominator when you need to walk the object graph downward from a specific parent object. Requires the report_id of a parsed dump (status=DONE).

NameTypeReqDescription
report_idstringyesReport ID returned by open_heapdump or dump_java_heap; the dump must have finished parsing (status must be DONE).
NameTypeReqDescription
resultstringyes–

No examples provided.

open_heapdump ~101

Open a local Java heap dump (.hprof) by absolute path. Starts MAT indexing in the background and returns a report_id immediately with status=PARSING. Poll get_heapdump_status until DONE. / 按绝对路径打开本地 Java 堆转储(.hprof)。后台启动 MAT 解析并立即返回 report_id 与 status=PARSING,用 get_heapdump_status 轮询直到 DONE。

NameTypeReqDescription
pathstringyes–
NameTypeReqDescription
resultstringyes–

No examples provided.

Install

How do I install the JVMind MAT Heap Dump Analyzer MCP server?

JVMind MAT Heap Dump Analyzer runs locally as a PyPI package, launched with uvx jvmind-mat-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · jvmind-mat-mcp

# add to Claude Code
claude mcp add kengrary-jvmind-mat -- uvx jvmind-mat-mcp
Common questions

What is the JVMind MAT Heap Dump Analyzer MCP server?

JVMind MAT Heap Dump Analyzer is an MCP server listed in the public MCP registry as io.github.kengrary/jvmind-mat. Analyze Java heap dumps locally with Eclipse MAT, including live JVM capture. This page covers its PyPI package (jvmind-mat-mcp).

Is the JVMind MAT Heap Dump Analyzer MCP server safe to use?

JVMind MAT Heap Dump Analyzer scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the JVMind MAT Heap Dump Analyzer MCP server expose?

JVMind MAT Heap Dump Analyzer exposes 19 tools: open_heapdump, get_heapdump_status, list_heapdumps, close_heapdump, list_java_processes, and 14 more. Their descriptions and schemas cost roughly 2,061 tokens of context every time the server is loaded.

Is the JVMind MAT Heap Dump Analyzer MCP server still maintained?

JVMind MAT Heap Dump Analyzer is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the JVMind MAT Heap Dump Analyzer MCP server under?

JVMind MAT Heap Dump Analyzer declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.