io.github.nikolai-vysotskyi/trace-mcp
NPM · TRACE-MCP · SCANNED SEP 20
Code graph MCP: 81 languages, 88 frameworks, 72.7% fewer PR-review tokens, comprehension at parity
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security93
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does. View diagnostics → Partial
- 63 of 288 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to nikolai-vysotskyi/trace-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability80
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 6634 tokens (~174/item across 38 items; 29 tools + 9 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
- Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "get_diagnostics" implies "execute" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Fail
- An AI judge read all 31 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.nikolai-vysotskyi/trace-mcp server?
io.github.nikolai-vysotskyi/trace-mcp runs locally as an npm package, launched with npx -y trace-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · trace-mcp
claude mcp add nikolai-vysotskyi-trace-mcp -- npx -y trace-mcp
{
"mcpServers": {
"nikolai-vysotskyi-trace-mcp": {
"command": "npx",
"args": [
"-y",
"trace-mcp"
]
}
}
} {
"servers": {
"nikolai-vysotskyi-trace-mcp": {
"command": "npx",
"args": [
"-y",
"trace-mcp"
]
}
}
} codex mcp add nikolai-vysotskyi-trace-mcp -- npx -y trace-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"nikolai-vysotskyi-trace-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"trace-mcp"
],
"enabled": true
}
}
} openclaw mcp add nikolai-vysotskyi-trace-mcp --command npx --arg -y --arg trace-mcp
mcp_servers:
nikolai-vysotskyi-trace-mcp:
command: "npx"
args: ["-y", "trace-mcp"] {
"McpServers": {
"nikolai-vysotskyi-trace-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"trace-mcp"
]
}
}
} assistant mcp add nikolai-vysotskyi-trace-mcp -t stdio -c npx -a -y trace-mcp
{
"mcpServers": {
"nikolai-vysotskyi-trace-mcp": {
"command": "npx",
"args": [
"-y",
"trace-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- Known CVEs: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: 0.63 → unverified ▼ security
- Dependency health: 0.91 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 3.29.0 → 3.31.0 functional
- Package version: 3.29.0 → 3.30.1 functional
- Package version: 3.29.0 → 3.30.0 functional
- 19 Sept 26 +1
- Tool safety: pass → unverified ▼ security
- Stability: 0.60 → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 3.25.0 → 3.29.0 functional
- 18 Sept 26 +3
- GHSA-rgj7-g3m4-5g8c no longer affects this package ▲ security
- GHSA-f88m-g3jw-g9cj no longer affects this package ▲ security
- CVE-2026-39244 no longer affects this package ▲ security
- Known CVEs: fail → pass ▲ security
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 10 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- Package version: 3.23.2 → 3.25.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/trace-mcp@3.31.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | nikolai-vysotskyi/trace-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/nikolai-vysotskyi/trace-mcp/.github/workflows/release.yml@refs/heads/master |
| Rekor log index | 2903605453 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:4d22848235309186f55e83ab81f8b157f3d0fd13faeaf10e9ac026aa9b9db4761fc2f304cc14724a73aa6880002e1ac07969b906fd62379d599aaa093 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| postinstall | unreviewed | node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs |
Background: Why install scripts are a supply-chain risk →
Dependencies 288 packages
| Packages resolved | 288 |
|---|---|
| Stale | 63 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
batch ~129
Execute multiple trace-mcp tools in a single MCP request. Dispatches any registered tool by name, including tools this session's preset defers — so a deferred tool is callable here without a load_tools round-trip (tools.exclude stays a hard restriction). Use to reduce round-trips when you need several independent queries (e.g., get_outline for 3 files, or search + get_symbol together). Read-only (delegates to other tools). Returns JSON: { batch_results: [{ tool, result }], total }.
| Name | Type | Req | Description |
|---|---|---|---|
| calls | array | yes | Array of tool calls to execute (max 10) |
No output schema declared.
No examples provided.
find_usages ~285
Find all references to a symbol or file (imports, calls, renders, dispatches). Use instead of Grep for symbol usages — semantic, not text matches. For raw text use search_text; for a bidirectional call graph use get_call_graph. Weakly-grounded `text_matched` edges into a name-colliding target are dropped by default (phantom god-node filter); `include_ambiguous_text_matched: true` keeps them. Read-only. Returns JSON: { references: [{ edge_type, resolution_tier, file, symbol }], total, truncated?, ambiguous_filtered? } — page caps at 50, `total` counts all.
| Name | Type | Req | Description |
|---|---|---|---|
| detail_level | string | – | Output verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default". |
| file_path | string | – | File path to find references for |
| fqn | string | – | Fully qualified name to find references for |
| include_ambiguous_text_matched | boolean | – | Keep text_matched edges whose target name collides with >=3 other symbols (default false — they produce phantom god-nodes). |
| limit | integer | – | Max references returned (default 50). |
| symbol_id | string | – | Symbol ID to find references for |
No output schema declared.
No examples provided.
get_call_graph ~143
Build a bidirectional call graph centered on a symbol (who calls it + what it calls). Each branch keeps its direction: depth 2 = callers of callers, callees of callees. Use to understand control flow through a function. For flat list of all references use find_usages instead. Read-only. Returns JSON: { root: { symbol_id, name, calls: [...], called_by: [...] } }.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Traversal depth on each side (default 2) |
| fqn | string | – | Fully qualified name to center the graph on |
| symbol_id | string | – | Symbol ID to center the graph on |
No output schema declared.
No examples provided.
get_change_impact ~277
Full change impact report: risk score + mitigations, breaking change detection, enriched dependents (complexity, coverage, exports), module groups, affected tests, co-change hidden couplings. Pass symbol_ids to scope to changed symbols. Use before modifying code. For a quick risk score alone use assess_change_risk; for who-calls-what use get_call_graph. compact pages results; bundle recalls. Read-only. Returns JSON: { risk, dependents, affectedTests, breakingChanges, totalAffected }.
| Name | Type | Req | Description |
|---|---|---|---|
| bundle | string | – | Handle; @N = page N. |
| compact | boolean | – | Paged recall (opt-in). |
| decorator_filter | string | – | Filter dependents to only those with this decorator/annotation/attribute (e.g. "Route", "Transactional", "csrf_protect") |
| depth | integer | – | Max traversal depth (default 3) |
| file_path | string | – | Relative file path to analyze |
| fqn | string | – | Fully qualified name to analyze (alternative to symbol_id) |
| max_dependents | integer | – | Cap on returned dependents (default 200) |
| symbol_id | string | – | Symbol ID to analyze |
| symbol_ids | array | – | Diff-aware: only analyze impact of these specific symbols (e.g. from get_changed_symbols) |
No output schema declared.
No examples provided.
get_context_bundle ~174
Get a symbol's source code + its import dependencies + optional callers, packed within a token budget. Supports batch queries with shared-import deduplication. Use instead of chaining get_symbol calls. For a single symbol without imports, use get_symbol — lighter. Read-only. Returns JSON: { primary: [{ symbol_id, file, source }], imports: [{ file, source }], token_usage }.
| Name | Type | Req | Description |
|---|---|---|---|
| fqn | string | – | Alternative: look up by FQN |
| include_callers | boolean | – | Include who calls these symbols (default false) |
| output_format | string | – | Output format (default json). |
| symbol_id | string | – | Single symbol ID |
| symbol_ids | array | – | Batch: multiple symbol IDs |
| token_budget | integer | – | Max tokens (default 8000) |
No output schema declared.
No examples provided.
get_coverage_report ~61
Technology profile of the project: detected frameworks/ORMs/UI libs from manifests (package.json, composer.json, etc.), which are covered by trace-mcp plugins, and coverage gaps. Read-only. Returns JSON: { detected, covered, gaps }.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_diagnostics ~113
Execute type-checker (tsc, mypy, pyright) and map errors to enclosing AST symbols. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| checker | string | – | Checker (tsc, mypy, pyright) |
| file_path | string | – | Filter by file path |
| max_files | integer | – | Max files reported |
| max_per_file | integer | – | Max errors per file |
| reduce_output | boolean | – | Shrink long output to a receipt |
| timeout_ms | integer | – | Timeout in ms |
No output schema declared.
No examples provided.
get_feature_context ~268
Search code by keyword/topic → returns ranked source snippets within a token budget. Use when you need to READ actual code for a concept or feature. For structured task context with tests and entry points use get_task_context instead; for symbol metadata without source use search. Read-only. Returns JSON (default) or Markdown: { items: [{ symbol_id, name, file, source, score }], token_usage } | { content: "...markdown..." }. Supports `output_format: "toon"`. Capped by `memory.recall.timeoutMs` (default 5000ms); on timeout returns `{ items: [], token_usage, degraded: true }`.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | Natural language description of the feature to find context for |
| detail_level | string | – | Output verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default". |
| output_format | string | – | "json" (default, structured items), "markdown" (fenced code blocks, ~15-20% cheaper), or "toon" (lossless, 30-60% fewer tokens). |
| token_budget | integer | – | Max tokens for assembled context (default 4000) |
No output schema declared.
No examples provided.
get_index_health ~103
Get index status, statistics, health, and pipeline progress (indexing, summarization, embedding). Includes the session projectRoot; when the index is empty, next_steps names the empty root and points at list_projects + call_project_tool for other registered projects. Read-only, no side effects. Use to verify the index is ready before running queries. Returns JSON: { status, stats, projectRoot, next_steps?, config, warnings, pipelineProgress, embedding }.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_optimization_report ~102
Detect token waste patterns in AI agent sessions: repeated file reads, Bash grep instead of search, large file reads, unused trace-mcp tools. Provides savings estimates. Read-only. For usage/cost overview use get_session_analytics; for A/B savings comparison use get_real_savings. Returns JSON: { patterns: [{ type, description, savings_estimate }], total_waste }.
| Name | Type | Req | Description |
|---|---|---|---|
| period | string | – | Time period (default: week) |
No output schema declared.
No examples provided.
get_outline ~293
Get all symbols for a file (signatures only, no bodies) — cheaper than Read for understanding a file before editing. Follow up with get_symbol to read one symbol's source. `nested: true` expands large top-level symbols (default ≥100 LOC) into inner declarations, each carrying `parentId` + `depth` (max 3). Read-only. Returns JSON: { path, language, symbols: [{ symbolId, name, kind, signature, lineStart, lineEnd, parentId?, depth? }] }. Supports `output_format: "toon"`.
| Name | Type | Req | Description |
|---|---|---|---|
| detail_level | string | – | Output verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default". |
| min_loc_for_nesting | integer | – | Minimum (line_end - line_start) for a top-level symbol to be expanded when nested=true. Default 100. |
| nested | boolean | – | Walk the body of each top-level symbol past min_loc_for_nesting and emit inner declarations as extra rows carrying `parentId` + `depth`. Default false. |
| output_format | string | – | "json" (default) or "toon" (lossless, 30-60% fewer tokens). "markdown" is unsupported here and behaves as json. |
| path | string | yes | Relative file path |
No output schema declared.
No examples provided.
get_preset_info ~62
Show active tool preset, available presets, which tools are registered in this session, and which are deferred (loadable via load_tools). Read-only. Returns JSON: { active_preset, registered_tools, tool_names, available_presets, deferred_tools }.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_project_map ~87
Get project overview: detected frameworks, languages, file counts, structure. Read-only, no side effects. Call with summary_only=true at session start to orient yourself before diving into code. Use instead of manual ls/find. Returns JSON: { frameworks, languages, fileCount, symbolCount, structure }.
| Name | Type | Req | Description |
|---|---|---|---|
| summary_only | boolean | – | Return only framework list + counts (default false) |
No output schema declared.
No examples provided.
get_real_savings ~89
A/B comparison: how many tokens could be saved by using trace-mcp instead of raw Read/Bash file reads. Per-file breakdown. Read-only. For pattern-based waste detection use get_optimization_report instead. Returns JSON: { files: [{ file, raw_tokens, compact_tokens, savings }], total_savings }.
| Name | Type | Req | Description |
|---|---|---|---|
| period | string | – | Time period (default: week) |
No output schema declared.
No examples provided.
get_session_analytics ~106
Analyze AI agent session logs: token usage, cost breakdown by tool/server, top files, models used. Parses Claude Code JSONL logs automatically. Read-only. For waste detection use get_optimization_report; for cost trends use get_usage_trends. Returns JSON: { sessions, tokens, cost_usd, tools, models, topFiles }.
| Name | Type | Req | Description |
|---|---|---|---|
| period | string | – | Time period (default: week) |
| session_id | string | – | Specific session ID to analyze |
No output schema declared.
No examples provided.
get_session_stats ~70
Token savings stats for this session: per-tool call counts, estimated token savings, reduction percentage, dedup savings, and per-tool latency (p50/p95/max/error_rate). Read-only. Returns JSON: { session: { ..., latency_per_tool }, cumulative, dedup_saved_tokens, report }.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_symbol ~194
Look up a symbol by symbol_id or FQN and return its source code. Use instead of Read when you need one specific function/class/method — returns only the symbol, not the whole file. For multiple symbols at once, prefer get_context_bundle. Read-only. Returns JSON: { symbol_id, name, kind, fqn, signature, file, line_start, line_end, source }.
| Name | Type | Req | Description |
|---|---|---|---|
| fqn | string | – | The fully qualified name to look up |
| max_lines | integer | – | Truncate source to this many lines (omit for full source) |
| symbol_id | string | – | The symbol_id to look up |
| verify_against_git | boolean | – | Compare the indexed source against the current git HEAD slice; mismatches set `git_mismatch: true` in the response (index may be stale). Read-only. Silently skipped when git is unavailable or the fil… |
No output schema declared.
No examples provided.
get_task_context ~232
All-in-one context for starting a dev task: execution paths, tests, entry points, adapted by task type. Use as your FIRST call when beginning any new task — replaces manual chaining of search → get_symbol → Read. For narrower feature-code lookup use get_feature_context instead. Read-only. Returns JSON (default) or Markdown.
| Name | Type | Req | Description |
|---|---|---|---|
| detail_level | string | – | Output verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default". |
| focus | string | – | Context strategy: minimal (fast, essential only), broad (default, wide net), deep (follow full execution chains) |
| include_tests | boolean | – | Include relevant test files (default true) |
| output_format | string | – | "json" (default, structured fields) or "markdown" (single LLM-optimized document with code fences, ~15-20% cheaper). |
| task | string | yes | Natural language description of the task |
| token_budget | integer | – | Max tokens (default 8000) |
No output schema declared.
No examples provided.
get_usage_trends ~90
Daily token usage time-series: sessions, tokens, estimated cost, tool calls per day. For spotting cost spikes. Read-only. For detailed session breakdown use get_session_analytics instead. Returns JSON: { days, daily: [{ date, sessions, tokens, cost_usd, tool_calls }], totals }.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Number of days to show (default: 30) |
No output schema declared.
No examples provided.
invalidate_decision ~100
Mark a decision as no longer valid. The decision remains in the knowledge graph for historical queries but is excluded from active queries. Use when a decision is superseded or reversed. Mutates the decision store; idempotent. Returns JSON: { invalidated: { id, title, valid_until } }.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Decision ID to invalidate |
| valid_until | string | – | ISO timestamp when decision became invalid (default: now) |
No output schema declared.
No examples provided.
load_tools ~137
Load tools this session's preset deferred, by preset name and/or explicit tool names. Call with no arguments to list what is deferred. Emits notifications/tools/list_changed and returns the loaded tools' schemas, so they are usable even if your client ignores that notification (call them through `batch`). Returns JSON: { loaded, already_loaded, unknown, blocked, tools, hint }.
| Name | Type | Req | Description |
|---|---|---|---|
| preset | string | – | Preset whose members to load (minimal, standard, review, architecture, full). "full" loads everything deferred. |
| tools | array | – | Explicit tool names to load. Unions with `preset` when both are given. |
No output schema declared.
No examples provided.
mine_sessions ~360
Mine Claude Code / Claw Code session logs for architectural decisions, tech choices, bug root causes, and preferences. Strategies: "regex" (default, free, ~20-40% recall), "llm" (higher recall, costs tokens), "hybrid" (regex + LLM safety net). Skips already-mined sessions unless force=true. Mutates the decision store; idempotent. Returns JSON: { mined, decisions_extracted, sessions_processed, strategy?, llm_sessions?, llm_decisions_extracted? }.
| Name | Type | Req | Description |
|---|---|---|---|
| force | boolean | – | Re-mine already processed sessions (default: false) |
| incremental_cursor | boolean | – | Per-call override for `memory.mining.incrementalCursor`. true (default) reuses byte-offset cursors for appended turns; false falls back to legacy mined/unmined semantics. |
| min_confidence | number | – | Legacy reject floor — drops decisions below this. Superseded by reject_threshold; kept for back-compat. |
| project_root | string | – | Only mine sessions for this project path (default: all projects) |
| reject_threshold | number | – | Reject floor (default: config decisions.reject_threshold, fallback 0.45). Decisions in [reject_threshold, review_threshold) queue for review; below it, dropped. |
| review_threshold | number | – | Auto-approve cutoff (default: config decisions.review_threshold, fallback 0.75). Decisions ≥ this enter the active graph immediately. |
| strategy | string | – | Extraction strategy: regex (default, free/fast/low recall), llm (AI provider, costs tokens, higher recall), hybrid (regex + LLM safety net). Falls back to regex with a warning if no AI provider is co… |
No output schema declared.
No examples provided.
plan_turn ~206
Opening-move router for new tasks. Combines BM25/PageRank search + session journal (negative evidence + focus signals) + framework-aware insertion-point suggestions + change-risk + turn-budget advisor into ONE call. Returns verdict (exists/partial/missing/ambiguous), confidence, ranked targets with provenance, scaffold hints when missing, and recommended next tool calls. Call this FIRST on a new task to break the empty-result hallucination chain. Read-only. For broader task context with source code use get_task_context instead. Returns JSON: { verdict, confidence, targets, scaffoldHints, nextSteps }.
| Name | Type | Req | Description |
|---|---|---|---|
| intent | string | – | Optional intent hint; auto-classified from task if omitted |
| max_targets | integer | – | Cap on returned targets (default 5) |
| skip_risk | boolean | – | Skip change-risk assessment for the top target (default false) |
| task | string | yes | Natural-language task description (e.g. "add a webhook endpoint for stripe payments") |
No output schema declared.
No examples provided.
query_decisions ~674
Query the decision knowledge graph. Filter by type, subproject, code symbol, file path, tag, or time — answers "why was this architecture chosen?" with the actual decision record. Use service_name to scope to a subproject. Defaults to auto+human-approved decisions; use include_pending or review_status for other tiers. Rows carry `cluster_ids` when part of a topical cluster (see `clusters_summary`). Read-only. Returns JSON: { decisions: [{ id, title, type, content, tags, review_status, cluster_ids? }], clusters_summary?, total_results }. Supports `output_format: "toon"`. Capped by `memory.recall.timeoutMs` (default 5000ms); on timeout returns `{ decisions: [], total_results: 0, degraded: true }`.
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | string | – | Only decisions active at this ISO timestamp |
| file_path | string | – | Filter by linked file path |
| git_branch | string | – | Branch filter: "current" (default) = current branch + branch-agnostic; "all" = every branch; any other value = that branch + branch-agnostic. |
| include_invalidated | boolean | – | Include invalidated decisions (default: false) |
| include_pending | boolean | – | Also return decisions in the review queue (review_status="pending"). Default: false — only auto-approved and approved rows are returned. |
| index_only | boolean | – | Progressive disclosure (default false). true omits full `content` — just id, title, type, anchors, tags, ~1-line `summary`. Pick ids cheaply, then pull full content with `get_decision`. |
| limit | integer | – | Max results (default: 50) |
| order_by | string | – | Result ordering: "recency" (default, valid_from DESC), "created_at" DESC, or "heat" (time-decay favoring frequently-recalled + fresh; degrades to recency if disabled in config). |
| output_format | string | – | Output format. "json" (default), "markdown" (LLM-friendly fenced markdown, tool-specific), or "toon" (Token-Oriented Object Notation — 30-60% fewer tokens on tabular data, lossless). |
| review_status | string | – | Restrict to a single review tier (overrides default + include_pending). Use "pending" to fetch the review queue. |
| search | string | – | Full-text search query (FTS5 with porter stemming) |
| service_name | string | – | Filter by subproject name (e.g., "auth-api") |
| symbol_id | string | – | Filter by linked symbol FQN |
| tag | string | – | Filter by tag |
| type | string | – | Filter by decision type |
| verification | string | – | Filter by verification verdict (implies verify=true). "stale" = any flagged row; "ok" = verified-fresh only. Omit to return all rows annotated in place. |
| verify | boolean | – | Staleness verification (default true). Checks each `symbol_id`-linked decision against the live index + git history; deleted/renamed/materially-changed code is flagged `verification` + `stale: true`.… |
No output schema declared.
No examples provided.
register_edit ~137
Notify trace-mcp that a file was edited. Reindexes the single file and invalidates search caches. Call after Edit/Write to keep index fresh — much lighter than full reindex. Also flags duplicate symbols — if `_duplication_warnings` appears, you may be recreating existing logic; review them. Each one is reported once per file, not on every edit; `check_duplication` re-asks. Mutates the index; idempotent. Returns JSON: { status, file, totalFiles, indexed, _duplication_warnings? }.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Relative path to the edited file |
No output schema declared.
No examples provided.
remember_decision ~293
Live agent write into the decision knowledge graph. Confidence-scores the input and routes it through the memoir review queue: high-confidence rows enter the active graph immediately, mid-confidence rows queue for human approval, low-confidence rows are dropped without persistence. Per-session dedup + rate-limit. Use during a session to capture decisions in real time. For manual high-confidence writes use add_decision; for post-hoc extraction from session logs use mine_sessions. Returns JSON: { id, review_status, confidence, deduplicated? }.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | Full decision text — reasoning, context, tradeoffs |
| file_path | string | – | File path this decision is about |
| git_branch | – | – | Git branch this decision belongs to. Omit to auto-detect, or pass null to make it branch-agnostic. |
| service_name | string | – | Subproject name this decision is about (e.g., "auth-api", "user-service") |
| session_id | string | – | Session identifier for dedup/rate-limit (default: "_default") |
| symbol_id | string | – | Symbol FQN this decision is about (e.g., "src/auth/provider.ts::AuthProvider#class") |
| tags | array | – | Tags for categorization (e.g., ["auth", "security"]) |
| title | string | yes | Short summary of the decision |
| type | string | yes | Decision type |
No output schema declared.
No examples provided.
search ~601
Search symbols by name, kind, or text. Use instead of Grep for functions, classes, methods, variables. For raw text/comment search use search_text; for references to a known symbol use find_usages. Read-only. Returns JSON: { items: [{ symbol_id, name, kind, fqn, signature, file, line, score }], total, search_mode } — mode-specific shape when mode!=single. Supports `output_format: "toon"`.
| Name | Type | Req | Description |
|---|---|---|---|
| decorator | string | – | Filter to symbols carrying this decorator/annotation/attribute |
| detail_level | string | – | Output verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default". |
| drill_from | string | – | [mode="drill"] File path or symbol_id to restrict results to. |
| extends | string | – | Filter to classes/interfaces extending this name |
| file_pattern | string | – | Filter by file path pattern |
| fusion | boolean | – | Enable Signal Fusion — multi-channel WRR ranking across lexical (BM25), structural (PageRank), similarity (embeddings), and identity match. Weights come from `tune_weights`. |
| fuzzy | boolean | – | Typo-tolerant search. Auto-enabled when exact search returns 0 results. |
| fuzzy_threshold | number | – | [fuzzy] Min trigram similarity (default 0.3) |
| implements | string | – | Filter to classes implementing this interface |
| kind | string | – | Filter by symbol kind (class, method, function, etc.) |
| language | string | – | Filter by language |
| limit | integer | – | Max results (default 20) |
| max_edit_distance | integer | – | [fuzzy] Max edit distance (default 3) |
| mode | string | – | single (default): top-K. tiered: high/medium/low buckets. drill: scoped to drill_from. flat: raw FTS, no PageRank. get: exact lookup. Omit to auto-pick. |
| offset | integer | – | Offset for pagination |
| output_format | string | – | "json" (default) or "toon" (lossless, 30-60% fewer tokens). "markdown" behaves as json here. |
| query | string | yes | Search query |
| retriever | string | – | Run one named retrieval algorithm instead of the mode dispatcher. Ignores mode/filters/fuzzy/fusion; returns { retriever, items, total }. |
| semantic | string | – | auto (default): hybrid if AI available. on: force hybrid. off: lexical-only. only: pure vector. Non-"off" needs an AI provider + one embed_repo run. |
| semantic_weight | number | – | [semantic] 0 = lexical only, 0.5 = balanced (default), 1 = vector only. |
No output schema declared.
No examples provided.
search_text ~312
Full-text search across all indexed files. Supports regex, glob file patterns, language filter. Use for finding strings, comments, TODOs, config values, error messages — anything not captured as a symbol. For symbol search (functions, classes) use search instead. Read-only. Returns JSON: { files: [{ file, language, hits: [{ line, column, match, context }] }], total_matches } — hits grouped per file, so a long path is paid once. Pass `grouping: "flat"` for the ungrouped matches[] shape.
| Name | Type | Req | Description |
|---|---|---|---|
| case_sensitive | boolean | – | Case-sensitive search (default false) |
| context_lines | integer | – | Lines of context before/after each match (default 0 — set higher if you need surrounding code) |
| file_pattern | string | – | Glob filter, e.g. "src/**/*.ts" |
| grouping | string | – | Payload shape. "by_file" (default) groups hits per file, so a long path is paid once; "flat" is a single matches[] array. |
| is_regex | boolean | – | Treat query as regex (default false) |
| language | string | – | Filter by language (e.g. "typescript", "python") |
| max_results | integer | – | Max matches to return (default 50) |
| query | string | yes | Search string or regex pattern |
| timeout_ms | integer | – | Wall-clock budget in ms — caps a catastrophic-backtracking regex. Default 2000; 0 disables. |
No output schema declared.
No examples provided.
suggest_queries ~72
Onboarding helper: shows top imported files, most connected symbols (PageRank), language stats, and example tool calls. Call this first when exploring an unfamiliar project. For a structured project map use get_project_map instead. Read-only. Returns JSON: { topFiles, topSymbols, languageStats, exampleQueries }.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the io.github.nikolai-vysotskyi/trace-mcp server?
io.github.nikolai-vysotskyi/trace-mcp is listed in the public MCP registry as io.github.nikolai-vysotskyi/trace-mcp. Code graph MCP: 81 languages, 88 frameworks, 72.7% fewer PR-review tokens, comprehension at parity. This page covers its npm package (trace-mcp).
Is the io.github.nikolai-vysotskyi/trace-mcp server safe to use?
io.github.nikolai-vysotskyi/trace-mcp scores 88 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.nikolai-vysotskyi/trace-mcp server expose?
io.github.nikolai-vysotskyi/trace-mcp exposes 29 tools: get_index_health, register_edit, get_project_map, search, suggest_queries, and 24 more. Their descriptions and schemas cost roughly 5,770 tokens of context every time the server is loaded.
Is the io.github.nikolai-vysotskyi/trace-mcp server still maintained?
io.github.nikolai-vysotskyi/trace-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.nikolai-vysotskyi/trace-mcp server under?
io.github.nikolai-vysotskyi/trace-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.