Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.nikolai-vysotskyi/trace-mcp

NPM · TRACE-MCP · SCANNED SEP 20

Code graph MCP: 81 languages, 88 frameworks, 72.7% fewer PR-review tokens, comprehension at parity

Available components

+6 this week 88 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security93
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does. View diagnostics → Partial
  • 63 of 288 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to nikolai-vysotskyi/trace-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability80
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 6634 tokens (~174/item across 38 items; 29 tools + 9 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
  • Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "get_diagnostics" implies "execute" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Fail
  • An AI judge read all 31 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.nikolai-vysotskyi/trace-mcp server?

io.github.nikolai-vysotskyi/trace-mcp runs locally as an npm package, launched with npx -y trace-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · trace-mcp

# add to Claude Code
claude mcp add nikolai-vysotskyi-trace-mcp -- npx -y trace-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "nikolai-vysotskyi-trace-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "trace-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "nikolai-vysotskyi-trace-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "trace-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add nikolai-vysotskyi-trace-mcp -- npx -y trace-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nikolai-vysotskyi-trace-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "trace-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add nikolai-vysotskyi-trace-mcp --command npx --arg -y --arg trace-mcp
# ~/.hermes/config.yaml
mcp_servers:
  nikolai-vysotskyi-trace-mcp:
    command: "npx"
    args: ["-y", "trace-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "nikolai-vysotskyi-trace-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "trace-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add nikolai-vysotskyi-trace-mcp -t stdio -c npx -a -y trace-mcp
// mcp.json
{
  "mcpServers": {
    "nikolai-vysotskyi-trace-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "trace-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 0
    • Known CVEs: pass → unverified security
    • Tool safety: pass → unverified security
    • Stability: 0.63 → unverified security
    • Dependency health: 0.91 → unverified functional
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Schema quality: 100 → unverified functional
    • Package version: 3.29.0 → 3.31.0 functional
    • Package version: 3.29.0 → 3.30.1 functional
    • Package version: 3.29.0 → 3.30.0 functional
  • 19 Sept 26 +1
    • Tool safety: pass → unverified security
    • Stability: 0.60 → unverified security
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Schema quality: 100 → unverified functional
    • Package version: 3.25.0 → 3.29.0 functional
  • 18 Sept 26 +3
    • GHSA-rgj7-g3m4-5g8c no longer affects this package security
    • GHSA-f88m-g3jw-g9cj no longer affects this package security
    • CVE-2026-39244 no longer affects this package security
    • Known CVEs: fail → pass security
  • 16 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

  • 12 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Sept 26 +15
    • Malware scan: unverified → pass security
  • 10 Sept 26 −14
    • Malware scan: pass → unverified security
    • Package version: 3.23.2 → 3.25.0 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/trace-mcp@3.31.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo nikolai-vysotskyi/trace-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/nikolai-vysotskyi/trace-mcp/.github/workflows/release.yml@refs/heads/master
Rekor log index 2903605453
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:4d22848235309186f55e83ab81f8b157f3d0fd13faeaf10e9ac026aa9b9db4761fc2f304cc14724a73aa6880002e1ac07969b906fd62379d599aaa093

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
postinstall unreviewed node scripts/preflight-native.mjs && node scripts/postinstall-app.mjs && node scripts/postinstall-control-plane.mjs

Background: Why install scripts are a supply-chain risk →

Dependencies 288 packages
Packages resolved 288
Stale 63
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 29 exposed · ~5,770 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
batch ~129

Execute multiple trace-mcp tools in a single MCP request. Dispatches any registered tool by name, including tools this session's preset defers — so a deferred tool is callable here without a load_tools round-trip (tools.exclude stays a hard restriction). Use to reduce round-trips when you need several independent queries (e.g., get_outline for 3 files, or search + get_symbol together). Read-only (delegates to other tools). Returns JSON: { batch_results: [{ tool, result }], total }.

NameTypeReqDescription
callsarrayyesArray of tool calls to execute (max 10)

No output schema declared.

No examples provided.

find_usages ~285

Find all references to a symbol or file (imports, calls, renders, dispatches). Use instead of Grep for symbol usages — semantic, not text matches. For raw text use search_text; for a bidirectional call graph use get_call_graph. Weakly-grounded `text_matched` edges into a name-colliding target are dropped by default (phantom god-node filter); `include_ambiguous_text_matched: true` keeps them. Read-only. Returns JSON: { references: [{ edge_type, resolution_tier, file, symbol }], total, truncated?, ambiguous_filtered? } — page caps at 50, `total` counts all.

NameTypeReqDescription
detail_levelstringOutput verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default".
file_pathstringFile path to find references for
fqnstringFully qualified name to find references for
include_ambiguous_text_matchedbooleanKeep text_matched edges whose target name collides with >=3 other symbols (default false — they produce phantom god-nodes).
limitintegerMax references returned (default 50).
symbol_idstringSymbol ID to find references for

No output schema declared.

No examples provided.

get_call_graph ~143

Build a bidirectional call graph centered on a symbol (who calls it + what it calls). Each branch keeps its direction: depth 2 = callers of callers, callees of callees. Use to understand control flow through a function. For flat list of all references use find_usages instead. Read-only. Returns JSON: { root: { symbol_id, name, calls: [...], called_by: [...] } }.

NameTypeReqDescription
depthintegerTraversal depth on each side (default 2)
fqnstringFully qualified name to center the graph on
symbol_idstringSymbol ID to center the graph on

No output schema declared.

No examples provided.

get_change_impact ~277

Full change impact report: risk score + mitigations, breaking change detection, enriched dependents (complexity, coverage, exports), module groups, affected tests, co-change hidden couplings. Pass symbol_ids to scope to changed symbols. Use before modifying code. For a quick risk score alone use assess_change_risk; for who-calls-what use get_call_graph. compact pages results; bundle recalls. Read-only. Returns JSON: { risk, dependents, affectedTests, breakingChanges, totalAffected }.

NameTypeReqDescription
bundlestringHandle; @N = page N.
compactbooleanPaged recall (opt-in).
decorator_filterstringFilter dependents to only those with this decorator/annotation/attribute (e.g. "Route", "Transactional", "csrf_protect")
depthintegerMax traversal depth (default 3)
file_pathstringRelative file path to analyze
fqnstringFully qualified name to analyze (alternative to symbol_id)
max_dependentsintegerCap on returned dependents (default 200)
symbol_idstringSymbol ID to analyze
symbol_idsarrayDiff-aware: only analyze impact of these specific symbols (e.g. from get_changed_symbols)

No output schema declared.

No examples provided.

get_context_bundle ~174

Get a symbol's source code + its import dependencies + optional callers, packed within a token budget. Supports batch queries with shared-import deduplication. Use instead of chaining get_symbol calls. For a single symbol without imports, use get_symbol — lighter. Read-only. Returns JSON: { primary: [{ symbol_id, file, source }], imports: [{ file, source }], token_usage }.

NameTypeReqDescription
fqnstringAlternative: look up by FQN
include_callersbooleanInclude who calls these symbols (default false)
output_formatstringOutput format (default json).
symbol_idstringSingle symbol ID
symbol_idsarrayBatch: multiple symbol IDs
token_budgetintegerMax tokens (default 8000)

No output schema declared.

No examples provided.

get_coverage_report ~61

Technology profile of the project: detected frameworks/ORMs/UI libs from manifests (package.json, composer.json, etc.), which are covered by trace-mcp plugins, and coverage gaps. Read-only. Returns JSON: { detected, covered, gaps }.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_diagnostics ~113

Execute type-checker (tsc, mypy, pyright) and map errors to enclosing AST symbols. Read-only.

NameTypeReqDescription
checkerstringChecker (tsc, mypy, pyright)
file_pathstringFilter by file path
max_filesintegerMax files reported
max_per_fileintegerMax errors per file
reduce_outputbooleanShrink long output to a receipt
timeout_msintegerTimeout in ms

No output schema declared.

No examples provided.

get_feature_context ~268

Search code by keyword/topic → returns ranked source snippets within a token budget. Use when you need to READ actual code for a concept or feature. For structured task context with tests and entry points use get_task_context instead; for symbol metadata without source use search. Read-only. Returns JSON (default) or Markdown: { items: [{ symbol_id, name, file, source, score }], token_usage } | { content: "...markdown..." }. Supports `output_format: "toon"`. Capped by `memory.recall.timeoutMs` (default 5000ms); on timeout returns `{ items: [], token_usage, degraded: true }`.

NameTypeReqDescription
descriptionstringyesNatural language description of the feature to find context for
detail_levelstringOutput verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default".
output_formatstring"json" (default, structured items), "markdown" (fenced code blocks, ~15-20% cheaper), or "toon" (lossless, 30-60% fewer tokens).
token_budgetintegerMax tokens for assembled context (default 4000)

No output schema declared.

No examples provided.

get_index_health ~103

Get index status, statistics, health, and pipeline progress (indexing, summarization, embedding). Includes the session projectRoot; when the index is empty, next_steps names the empty root and points at list_projects + call_project_tool for other registered projects. Read-only, no side effects. Use to verify the index is ready before running queries. Returns JSON: { status, stats, projectRoot, next_steps?, config, warnings, pipelineProgress, embedding }.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_optimization_report ~102

Detect token waste patterns in AI agent sessions: repeated file reads, Bash grep instead of search, large file reads, unused trace-mcp tools. Provides savings estimates. Read-only. For usage/cost overview use get_session_analytics; for A/B savings comparison use get_real_savings. Returns JSON: { patterns: [{ type, description, savings_estimate }], total_waste }.

NameTypeReqDescription
periodstringTime period (default: week)

No output schema declared.

No examples provided.

get_outline ~293

Get all symbols for a file (signatures only, no bodies) — cheaper than Read for understanding a file before editing. Follow up with get_symbol to read one symbol's source. `nested: true` expands large top-level symbols (default ≥100 LOC) into inner declarations, each carrying `parentId` + `depth` (max 3). Read-only. Returns JSON: { path, language, symbols: [{ symbolId, name, kind, signature, lineStart, lineEnd, parentId?, depth? }] }. Supports `output_format: "toon"`.

NameTypeReqDescription
detail_levelstringOutput verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default".
min_loc_for_nestingintegerMinimum (line_end - line_start) for a top-level symbol to be expanded when nested=true. Default 100.
nestedbooleanWalk the body of each top-level symbol past min_loc_for_nesting and emit inner declarations as extra rows carrying `parentId` + `depth`. Default false.
output_formatstring"json" (default) or "toon" (lossless, 30-60% fewer tokens). "markdown" is unsupported here and behaves as json.
pathstringyesRelative file path

No output schema declared.

No examples provided.

get_preset_info ~62

Show active tool preset, available presets, which tools are registered in this session, and which are deferred (loadable via load_tools). Read-only. Returns JSON: { active_preset, registered_tools, tool_names, available_presets, deferred_tools }.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_project_map ~87

Get project overview: detected frameworks, languages, file counts, structure. Read-only, no side effects. Call with summary_only=true at session start to orient yourself before diving into code. Use instead of manual ls/find. Returns JSON: { frameworks, languages, fileCount, symbolCount, structure }.

NameTypeReqDescription
summary_onlybooleanReturn only framework list + counts (default false)

No output schema declared.

No examples provided.

get_real_savings ~89

A/B comparison: how many tokens could be saved by using trace-mcp instead of raw Read/Bash file reads. Per-file breakdown. Read-only. For pattern-based waste detection use get_optimization_report instead. Returns JSON: { files: [{ file, raw_tokens, compact_tokens, savings }], total_savings }.

NameTypeReqDescription
periodstringTime period (default: week)

No output schema declared.

No examples provided.

get_session_analytics ~106

Analyze AI agent session logs: token usage, cost breakdown by tool/server, top files, models used. Parses Claude Code JSONL logs automatically. Read-only. For waste detection use get_optimization_report; for cost trends use get_usage_trends. Returns JSON: { sessions, tokens, cost_usd, tools, models, topFiles }.

NameTypeReqDescription
periodstringTime period (default: week)
session_idstringSpecific session ID to analyze

No output schema declared.

No examples provided.

get_session_stats ~70

Token savings stats for this session: per-tool call counts, estimated token savings, reduction percentage, dedup savings, and per-tool latency (p50/p95/max/error_rate). Read-only. Returns JSON: { session: { ..., latency_per_tool }, cumulative, dedup_saved_tokens, report }.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_symbol ~194

Look up a symbol by symbol_id or FQN and return its source code. Use instead of Read when you need one specific function/class/method — returns only the symbol, not the whole file. For multiple symbols at once, prefer get_context_bundle. Read-only. Returns JSON: { symbol_id, name, kind, fqn, signature, file, line_start, line_end, source }.

NameTypeReqDescription
fqnstringThe fully qualified name to look up
max_linesintegerTruncate source to this many lines (omit for full source)
symbol_idstringThe symbol_id to look up
verify_against_gitbooleanCompare the indexed source against the current git HEAD slice; mismatches set `git_mismatch: true` in the response (index may be stale). Read-only. Silently skipped when git is unavailable or the fil…

No output schema declared.

No examples provided.

get_task_context ~232

All-in-one context for starting a dev task: execution paths, tests, entry points, adapted by task type. Use as your FIRST call when beginning any new task — replaces manual chaining of search → get_symbol → Read. For narrower feature-code lookup use get_feature_context instead. Read-only. Returns JSON (default) or Markdown.

NameTypeReqDescription
detail_levelstringOutput verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default".
focusstringContext strategy: minimal (fast, essential only), broad (default, wide net), deep (follow full execution chains)
include_testsbooleanInclude relevant test files (default true)
output_formatstring"json" (default, structured fields) or "markdown" (single LLM-optimized document with code fences, ~15-20% cheaper).
taskstringyesNatural language description of the task
token_budgetintegerMax tokens (default 8000)

No output schema declared.

No examples provided.

get_usage_trends ~90

Daily token usage time-series: sessions, tokens, estimated cost, tool calls per day. For spotting cost spikes. Read-only. For detailed session breakdown use get_session_analytics instead. Returns JSON: { days, daily: [{ date, sessions, tokens, cost_usd, tool_calls }], totals }.

NameTypeReqDescription
daysintegerNumber of days to show (default: 30)

No output schema declared.

No examples provided.

invalidate_decision ~100

Mark a decision as no longer valid. The decision remains in the knowledge graph for historical queries but is excluded from active queries. Use when a decision is superseded or reversed. Mutates the decision store; idempotent. Returns JSON: { invalidated: { id, title, valid_until } }.

NameTypeReqDescription
idintegeryesDecision ID to invalidate
valid_untilstringISO timestamp when decision became invalid (default: now)

No output schema declared.

No examples provided.

load_tools ~137

Load tools this session's preset deferred, by preset name and/or explicit tool names. Call with no arguments to list what is deferred. Emits notifications/tools/list_changed and returns the loaded tools' schemas, so they are usable even if your client ignores that notification (call them through `batch`). Returns JSON: { loaded, already_loaded, unknown, blocked, tools, hint }.

NameTypeReqDescription
presetstringPreset whose members to load (minimal, standard, review, architecture, full). "full" loads everything deferred.
toolsarrayExplicit tool names to load. Unions with `preset` when both are given.

No output schema declared.

No examples provided.

mine_sessions ~360

Mine Claude Code / Claw Code session logs for architectural decisions, tech choices, bug root causes, and preferences. Strategies: "regex" (default, free, ~20-40% recall), "llm" (higher recall, costs tokens), "hybrid" (regex + LLM safety net). Skips already-mined sessions unless force=true. Mutates the decision store; idempotent. Returns JSON: { mined, decisions_extracted, sessions_processed, strategy?, llm_sessions?, llm_decisions_extracted? }.

NameTypeReqDescription
forcebooleanRe-mine already processed sessions (default: false)
incremental_cursorbooleanPer-call override for `memory.mining.incrementalCursor`. true (default) reuses byte-offset cursors for appended turns; false falls back to legacy mined/unmined semantics.
min_confidencenumberLegacy reject floor — drops decisions below this. Superseded by reject_threshold; kept for back-compat.
project_rootstringOnly mine sessions for this project path (default: all projects)
reject_thresholdnumberReject floor (default: config decisions.reject_threshold, fallback 0.45). Decisions in [reject_threshold, review_threshold) queue for review; below it, dropped.
review_thresholdnumberAuto-approve cutoff (default: config decisions.review_threshold, fallback 0.75). Decisions ≥ this enter the active graph immediately.
strategystringExtraction strategy: regex (default, free/fast/low recall), llm (AI provider, costs tokens, higher recall), hybrid (regex + LLM safety net). Falls back to regex with a warning if no AI provider is co…

No output schema declared.

No examples provided.

plan_turn ~206

Opening-move router for new tasks. Combines BM25/PageRank search + session journal (negative evidence + focus signals) + framework-aware insertion-point suggestions + change-risk + turn-budget advisor into ONE call. Returns verdict (exists/partial/missing/ambiguous), confidence, ranked targets with provenance, scaffold hints when missing, and recommended next tool calls. Call this FIRST on a new task to break the empty-result hallucination chain. Read-only. For broader task context with source code use get_task_context instead. Returns JSON: { verdict, confidence, targets, scaffoldHints, nextSteps }.

NameTypeReqDescription
intentstringOptional intent hint; auto-classified from task if omitted
max_targetsintegerCap on returned targets (default 5)
skip_riskbooleanSkip change-risk assessment for the top target (default false)
taskstringyesNatural-language task description (e.g. "add a webhook endpoint for stripe payments")

No output schema declared.

No examples provided.

query_decisions ~674

Query the decision knowledge graph. Filter by type, subproject, code symbol, file path, tag, or time — answers "why was this architecture chosen?" with the actual decision record. Use service_name to scope to a subproject. Defaults to auto+human-approved decisions; use include_pending or review_status for other tiers. Rows carry `cluster_ids` when part of a topical cluster (see `clusters_summary`). Read-only. Returns JSON: { decisions: [{ id, title, type, content, tags, review_status, cluster_ids? }], clusters_summary?, total_results }. Supports `output_format: "toon"`. Capped by `memory.recall.timeoutMs` (default 5000ms); on timeout returns `{ decisions: [], total_results: 0, degraded: true }`.

NameTypeReqDescription
as_ofstringOnly decisions active at this ISO timestamp
file_pathstringFilter by linked file path
git_branchstringBranch filter: "current" (default) = current branch + branch-agnostic; "all" = every branch; any other value = that branch + branch-agnostic.
include_invalidatedbooleanInclude invalidated decisions (default: false)
include_pendingbooleanAlso return decisions in the review queue (review_status="pending"). Default: false — only auto-approved and approved rows are returned.
index_onlybooleanProgressive disclosure (default false). true omits full `content` — just id, title, type, anchors, tags, ~1-line `summary`. Pick ids cheaply, then pull full content with `get_decision`.
limitintegerMax results (default: 50)
order_bystringResult ordering: "recency" (default, valid_from DESC), "created_at" DESC, or "heat" (time-decay favoring frequently-recalled + fresh; degrades to recency if disabled in config).
output_formatstringOutput format. "json" (default), "markdown" (LLM-friendly fenced markdown, tool-specific), or "toon" (Token-Oriented Object Notation — 30-60% fewer tokens on tabular data, lossless).
review_statusstringRestrict to a single review tier (overrides default + include_pending). Use "pending" to fetch the review queue.
searchstringFull-text search query (FTS5 with porter stemming)
service_namestringFilter by subproject name (e.g., "auth-api")
symbol_idstringFilter by linked symbol FQN
tagstringFilter by tag
typestringFilter by decision type
verificationstringFilter by verification verdict (implies verify=true). "stale" = any flagged row; "ok" = verified-fresh only. Omit to return all rows annotated in place.
verifybooleanStaleness verification (default true). Checks each `symbol_id`-linked decision against the live index + git history; deleted/renamed/materially-changed code is flagged `verification` + `stale: true`.…

No output schema declared.

No examples provided.

register_edit ~137

Notify trace-mcp that a file was edited. Reindexes the single file and invalidates search caches. Call after Edit/Write to keep index fresh — much lighter than full reindex. Also flags duplicate symbols — if `_duplication_warnings` appears, you may be recreating existing logic; review them. Each one is reported once per file, not on every edit; `check_duplication` re-asks. Mutates the index; idempotent. Returns JSON: { status, file, totalFiles, indexed, _duplication_warnings? }.

NameTypeReqDescription
file_pathstringyesRelative path to the edited file

No output schema declared.

No examples provided.

remember_decision ~293

Live agent write into the decision knowledge graph. Confidence-scores the input and routes it through the memoir review queue: high-confidence rows enter the active graph immediately, mid-confidence rows queue for human approval, low-confidence rows are dropped without persistence. Per-session dedup + rate-limit. Use during a session to capture decisions in real time. For manual high-confidence writes use add_decision; for post-hoc extraction from session logs use mine_sessions. Returns JSON: { id, review_status, confidence, deduplicated? }.

NameTypeReqDescription
contentstringyesFull decision text — reasoning, context, tradeoffs
file_pathstringFile path this decision is about
git_branchGit branch this decision belongs to. Omit to auto-detect, or pass null to make it branch-agnostic.
service_namestringSubproject name this decision is about (e.g., "auth-api", "user-service")
session_idstringSession identifier for dedup/rate-limit (default: "_default")
symbol_idstringSymbol FQN this decision is about (e.g., "src/auth/provider.ts::AuthProvider#class")
tagsarrayTags for categorization (e.g., ["auth", "security"])
titlestringyesShort summary of the decision
typestringyesDecision type

No output schema declared.

No examples provided.

search ~601

Search symbols by name, kind, or text. Use instead of Grep for functions, classes, methods, variables. For raw text/comment search use search_text; for references to a known symbol use find_usages. Read-only. Returns JSON: { items: [{ symbol_id, name, kind, fqn, signature, file, line, score }], total, search_mode } — mode-specific shape when mode!=single. Supports `output_format: "toon"`.

NameTypeReqDescription
decoratorstringFilter to symbols carrying this decorator/annotation/attribute
detail_levelstringOutput verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default".
drill_fromstring[mode="drill"] File path or symbol_id to restrict results to.
extendsstringFilter to classes/interfaces extending this name
file_patternstringFilter by file path pattern
fusionbooleanEnable Signal Fusion — multi-channel WRR ranking across lexical (BM25), structural (PageRank), similarity (embeddings), and identity match. Weights come from `tune_weights`.
fuzzybooleanTypo-tolerant search. Auto-enabled when exact search returns 0 results.
fuzzy_thresholdnumber[fuzzy] Min trigram similarity (default 0.3)
implementsstringFilter to classes implementing this interface
kindstringFilter by symbol kind (class, method, function, etc.)
languagestringFilter by language
limitintegerMax results (default 20)
max_edit_distanceinteger[fuzzy] Max edit distance (default 3)
modestringsingle (default): top-K. tiered: high/medium/low buckets. drill: scoped to drill_from. flat: raw FTS, no PageRank. get: exact lookup. Omit to auto-pick.
offsetintegerOffset for pagination
output_formatstring"json" (default) or "toon" (lossless, 30-60% fewer tokens). "markdown" behaves as json here.
querystringyesSearch query
retrieverstringRun one named retrieval algorithm instead of the mode dispatcher. Ignores mode/filters/fuzzy/fusion; returns { retriever, items, total }.
semanticstringauto (default): hybrid if AI available. on: force hybrid. off: lexical-only. only: pure vector. Non-"off" needs an AI provider + one embed_repo run.
semantic_weightnumber[semantic] 0 = lexical only, 0.5 = balanced (default), 1 = vector only.

No output schema declared.

No examples provided.

search_text ~312

Full-text search across all indexed files. Supports regex, glob file patterns, language filter. Use for finding strings, comments, TODOs, config values, error messages — anything not captured as a symbol. For symbol search (functions, classes) use search instead. Read-only. Returns JSON: { files: [{ file, language, hits: [{ line, column, match, context }] }], total_matches } — hits grouped per file, so a long path is paid once. Pass `grouping: "flat"` for the ungrouped matches[] shape.

NameTypeReqDescription
case_sensitivebooleanCase-sensitive search (default false)
context_linesintegerLines of context before/after each match (default 0 — set higher if you need surrounding code)
file_patternstringGlob filter, e.g. "src/**/*.ts"
groupingstringPayload shape. "by_file" (default) groups hits per file, so a long path is paid once; "flat" is a single matches[] array.
is_regexbooleanTreat query as regex (default false)
languagestringFilter by language (e.g. "typescript", "python")
max_resultsintegerMax matches to return (default 50)
querystringyesSearch string or regex pattern
timeout_msintegerWall-clock budget in ms — caps a catastrophic-backtracking regex. Default 2000; 0 disables.

No output schema declared.

No examples provided.

suggest_queries ~72

Onboarding helper: shows top imported files, most connected symbols (PageRank), language stats, and example tool calls. Call this first when exploring an unfamiliar project. For a structured project map use get_project_map instead. Read-only. Returns JSON: { topFiles, topSymbols, languageStats, exampleQueries }.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

Common questions

What is the io.github.nikolai-vysotskyi/trace-mcp server?

io.github.nikolai-vysotskyi/trace-mcp is listed in the public MCP registry as io.github.nikolai-vysotskyi/trace-mcp. Code graph MCP: 81 languages, 88 frameworks, 72.7% fewer PR-review tokens, comprehension at parity. This page covers its npm package (trace-mcp).

Is the io.github.nikolai-vysotskyi/trace-mcp server safe to use?

io.github.nikolai-vysotskyi/trace-mcp scores 88 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.nikolai-vysotskyi/trace-mcp server expose?

io.github.nikolai-vysotskyi/trace-mcp exposes 29 tools: get_index_health, register_edit, get_project_map, search, suggest_queries, and 24 more. Their descriptions and schemas cost roughly 5,770 tokens of context every time the server is loaded.

Is the io.github.nikolai-vysotskyi/trace-mcp server still maintained?

io.github.nikolai-vysotskyi/trace-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.nikolai-vysotskyi/trace-mcp server under?

io.github.nikolai-vysotskyi/trace-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.