# io.github.nikolai-vysotskyi/trace-mcp (npm · trace-mcp)

Code graph MCP: 81 languages, 88 frameworks, 72.7% fewer PR-review tokens, comprehension at parity

- Trust score: 48/100 (low)
- Change this week: −35
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-21

## Components

- npm · `trace-mcp`: 48/100 (this document), [markdown](https://verifymcp.io/servers/nikolai-vysotskyi-trace-mcp/trace-mcp.md), [page](https://verifymcp.io/servers/nikolai-vysotskyi-trace-mcp/trace-mcp)

## Channel facts

- Registry: `npm`
- Package: `trace-mcp`
- Version: `3.31.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-21.

- **Supply Chain Security**: 93/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does.
  - 63 of 288 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to nikolai-vysotskyi/trace-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 0/100
  - Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- **Tool Safety**: 0/100
  - Tool safety not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- **Capabilities**: 0/100
  - Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.

**Unverified: 5 categories.** Categories scored 0 because our sandbox run of this package has not given us the schema these checks need to read. That is a gap on our side rather than a finding about the package, and we only credit what we can confirm, so the score stands at 0 until the capture succeeds. We are working through the fleet, so this normally clears without any action from you.

## Install

### How do I install the io.github.nikolai-vysotskyi/trace-mcp server?

io.github.nikolai-vysotskyi/trace-mcp runs locally as an npm package, launched with npx -y trace-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add nikolai-vysotskyi-trace-mcp -- npx -y trace-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "nikolai-vysotskyi-trace-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "trace-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "nikolai-vysotskyi-trace-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "trace-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add nikolai-vysotskyi-trace-mcp -- npx -y trace-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nikolai-vysotskyi-trace-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "trace-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add nikolai-vysotskyi-trace-mcp --command npx --arg -y --arg trace-mcp
```

### Hermes

```yaml
mcp_servers:
  nikolai-vysotskyi-trace-mcp:
    command: "npx"
    args: ["-y", "trace-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "nikolai-vysotskyi-trace-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "trace-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add nikolai-vysotskyi-trace-mcp -t stdio -c npx -a -y trace-mcp
```

### Other

```json
{
  "mcpServers": {
    "nikolai-vysotskyi-trace-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "trace-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-21 (score 48, −40)

- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.67 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional] Package version: 3.31.0 → 3.31.1

### 2026-09-20 (score 88, 0)

- [security regression] Known CVEs: pass → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.63 → unverified
- [functional regression] Dependency health: 0.91 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional] Package version: 3.29.0 → 3.31.0
- [functional] Package version: 3.29.0 → 3.30.1
- [functional] Package version: 3.29.0 → 3.30.0

### 2026-09-19 (score 88, +1)

- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.60 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional] Package version: 3.25.0 → 3.29.0

### 2026-09-18 (score 87, +3)

- [security improvement] GHSA-rgj7-g3m4-5g8c no longer affects this package
- [security improvement] GHSA-f88m-g3jw-g9cj no longer affects this package
- [security improvement] CVE-2026-39244 no longer affects this package
- [security improvement] Known CVEs: fail → pass

### 2026-09-16 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-14 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-12 (score 82, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-11 (score 81, +15)

- [security improvement] Malware scan: unverified → pass

## MCP tools (29)

### `get_index_health` (~103 tokens)

Get index status, statistics, health, and pipeline progress (indexing, summarization, embedding). Includes the session projectRoot; when the index is empty, next_steps names the empty root and points at list_projects + call_project_tool for other registered projects. Read-only, no side effects. Use to verify the index is ready before running queries. Returns JSON: { status, stats, projectRoot, next_steps?, config, warnings, pipelineProgress, embedding }.

### `register_edit` (~137 tokens)

Notify trace-mcp that a file was edited. Reindexes the single file and invalidates search caches. Call after Edit/Write to keep index fresh — much lighter than full reindex. Also flags duplicate symbols — if `_duplication_warnings` appears, you may be recreating existing logic; review them. Each one is reported once per file, not on every edit; `check_duplication` re-asks. Mutates the index; idempotent. Returns JSON: { status, file, totalFiles, indexed, _duplication_warnings? }.

Input parameters:

- `file_path` (string, required): Relative path to the edited file

### `get_project_map` (~87 tokens)

Get project overview: detected frameworks, languages, file counts, structure. Read-only, no side effects. Call with summary_only=true at session start to orient yourself before diving into code. Use instead of manual ls/find. Returns JSON: { frameworks, languages, fileCount, symbolCount, structure }.

Input parameters:

- `summary_only` (boolean): Return only framework list + counts (default false)

### `search` (~601 tokens)

Search symbols by name, kind, or text. Use instead of Grep for functions, classes, methods, variables. For raw text/comment search use search_text; for references to a known symbol use find_usages. Read-only. Returns JSON: { items: [{ symbol_id, name, kind, fqn, signature, file, line, score }], total, search_mode } — mode-specific shape when mode!=single. Supports `output_format: "toon"`.

Input parameters:

- `decorator` (string): Filter to symbols carrying this decorator/annotation/attribute
- `detail_level` (string): Output verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default".
- `drill_from` (string): [mode="drill"] File path or symbol_id to restrict results to.
- `extends` (string): Filter to classes/interfaces extending this name
- `file_pattern` (string): Filter by file path pattern
- `fusion` (boolean): Enable Signal Fusion — multi-channel WRR ranking across lexical (BM25), structural (PageRank), similarity (embeddings), and identity match. Weights come from `tune_weights`.
- `fuzzy` (boolean): Typo-tolerant search. Auto-enabled when exact search returns 0 results.
- `fuzzy_threshold` (number): [fuzzy] Min trigram similarity (default 0.3)
- `implements` (string): Filter to classes implementing this interface
- `kind` (string): Filter by symbol kind (class, method, function, etc.)
- `language` (string): Filter by language
- `limit` (integer): Max results (default 20)
- `max_edit_distance` (integer): [fuzzy] Max edit distance (default 3)
- `mode` (string): single (default): top-K. tiered: high/medium/low buckets. drill: scoped to drill_from. flat: raw FTS, no PageRank. get: exact lookup. Omit to auto-pick.
- `offset` (integer): Offset for pagination
- `output_format` (string): "json" (default) or "toon" (lossless, 30-60% fewer tokens). "markdown" behaves as json here.
- `query` (string, required): Search query
- `retriever` (string): Run one named retrieval algorithm instead of the mode dispatcher. Ignores mode/filters/fuzzy/fusion; returns { retriever, items, total }.
- `semantic` (string): auto (default): hybrid if AI available. on: force hybrid. off: lexical-only. only: pure vector. Non-"off" needs an AI provider + one embed_repo run.
- `semantic_weight` (number): [semantic] 0 = lexical only, 0.5 = balanced (default), 1 = vector only.

### `suggest_queries` (~72 tokens)

Onboarding helper: shows top imported files, most connected symbols (PageRank), language stats, and example tool calls. Call this first when exploring an unfamiliar project. For a structured project map use get_project_map instead. Read-only. Returns JSON: { topFiles, topSymbols, languageStats, exampleQueries }.

### `get_symbol` (~194 tokens)

Look up a symbol by symbol_id or FQN and return its source code. Use instead of Read when you need one specific function/class/method — returns only the symbol, not the whole file. For multiple symbols at once, prefer get_context_bundle. Read-only. Returns JSON: { symbol_id, name, kind, fqn, signature, file, line_start, line_end, source }.

Input parameters:

- `fqn` (string): The fully qualified name to look up
- `max_lines` (integer): Truncate source to this many lines (omit for full source)
- `symbol_id` (string): The symbol_id to look up
- `verify_against_git` (boolean): Compare the indexed source against the current git HEAD slice; mismatches set `git_mismatch: true` in the response (index may be stale). Read-only. Silently skipped when git is unavailable or the fil…

### `get_outline` (~293 tokens)

Get all symbols for a file (signatures only, no bodies) — cheaper than Read for understanding a file before editing. Follow up with get_symbol to read one symbol's source. `nested: true` expands large top-level symbols (default ≥100 LOC) into inner declarations, each carrying `parentId` + `depth` (max 3). Read-only. Returns JSON: { path, language, symbols: [{ symbolId, name, kind, signature, lineStart, lineEnd, parentId?, depth? }] }. Supports `output_format: "toon"`.

Input parameters:

- `detail_level` (string): Output verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default".
- `min_loc_for_nesting` (integer): Minimum (line_end - line_start) for a top-level symbol to be expanded when nested=true. Default 100.
- `nested` (boolean): Walk the body of each top-level symbol past min_loc_for_nesting and emit inner declarations as extra rows carrying `parentId` + `depth`. Default false.
- `output_format` (string): "json" (default) or "toon" (lossless, 30-60% fewer tokens). "markdown" is unsupported here and behaves as json.
- `path` (string, required): Relative file path

### `get_change_impact` (~277 tokens)

Full change impact report: risk score + mitigations, breaking change detection, enriched dependents (complexity, coverage, exports), module groups, affected tests, co-change hidden couplings. Pass symbol_ids to scope to changed symbols. Use before modifying code. For a quick risk score alone use assess_change_risk; for who-calls-what use get_call_graph. compact pages results; bundle recalls. Read-only. Returns JSON: { risk, dependents, affectedTests, breakingChanges, totalAffected }.

Input parameters:

- `bundle` (string): Handle; @N = page N.
- `compact` (boolean): Paged recall (opt-in).
- `decorator_filter` (string): Filter dependents to only those with this decorator/annotation/attribute (e.g. "Route", "Transactional", "csrf_protect")
- `depth` (integer): Max traversal depth (default 3)
- `file_path` (string): Relative file path to analyze
- `fqn` (string): Fully qualified name to analyze (alternative to symbol_id)
- `max_dependents` (integer): Cap on returned dependents (default 200)
- `symbol_id` (string): Symbol ID to analyze
- `symbol_ids` (array): Diff-aware: only analyze impact of these specific symbols (e.g. from get_changed_symbols)

### `get_context_bundle` (~174 tokens)

Get a symbol's source code + its import dependencies + optional callers, packed within a token budget. Supports batch queries with shared-import deduplication. Use instead of chaining get_symbol calls. For a single symbol without imports, use get_symbol — lighter. Read-only. Returns JSON: { primary: [{ symbol_id, file, source }], imports: [{ file, source }], token_usage }.

Input parameters:

- `fqn` (string): Alternative: look up by FQN
- `include_callers` (boolean): Include who calls these symbols (default false)
- `output_format` (string): Output format (default json).
- `symbol_id` (string): Single symbol ID
- `symbol_ids` (array): Batch: multiple symbol IDs
- `token_budget` (integer): Max tokens (default 8000)

### `get_feature_context` (~268 tokens)

Search code by keyword/topic → returns ranked source snippets within a token budget. Use when you need to READ actual code for a concept or feature. For structured task context with tests and entry points use get_task_context instead; for symbol metadata without source use search. Read-only. Returns JSON (default) or Markdown: { items: [{ symbol_id, name, file, source, score }], token_usage } | { content: "...markdown..." }. Supports `output_format: "toon"`. Capped by `memory.recall.timeoutMs` (default 5000ms); on timeout returns `{ items: [], token_usage, degraded: true }`.

Input parameters:

- `description` (string, required): Natural language description of the feature to find context for
- `detail_level` (string): Output verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default".
- `output_format` (string): "json" (default, structured items), "markdown" (fenced code blocks, ~15-20% cheaper), or "toon" (lossless, 30-60% fewer tokens).
- `token_budget` (integer): Max tokens for assembled context (default 4000)

### `get_task_context` (~232 tokens)

All-in-one context for starting a dev task: execution paths, tests, entry points, adapted by task type. Use as your FIRST call when beginning any new task — replaces manual chaining of search → get_symbol → Read. For narrower feature-code lookup use get_feature_context instead. Read-only. Returns JSON (default) or Markdown.

Input parameters:

- `detail_level` (string): Output verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default".
- `focus` (string): Context strategy: minimal (fast, essential only), broad (default, wide net), deep (follow full execution chains)
- `include_tests` (boolean): Include relevant test files (default true)
- `output_format` (string): "json" (default, structured fields) or "markdown" (single LLM-optimized document with code fences, ~15-20% cheaper).
- `task` (string, required): Natural language description of the task
- `token_budget` (integer): Max tokens (default 8000)

### `find_usages` (~285 tokens)

Find all references to a symbol or file (imports, calls, renders, dispatches). Use instead of Grep for symbol usages — semantic, not text matches. For raw text use search_text; for a bidirectional call graph use get_call_graph. Weakly-grounded `text_matched` edges into a name-colliding target are dropped by default (phantom god-node filter); `include_ambiguous_text_matched: true` keeps them. Read-only. Returns JSON: { references: [{ edge_type, resolution_tier, file, symbol }], total, truncated?, ambiguous_filtered? } — page caps at 50, `total` counts all.

Input parameters:

- `detail_level` (string): Output verbosity. "minimal" saves ~40-60% tokens (drops scores, fqn, signatures, summaries). Use to pick a candidate before get_symbol. Default: "default".
- `file_path` (string): File path to find references for
- `fqn` (string): Fully qualified name to find references for
- `include_ambiguous_text_matched` (boolean): Keep text_matched edges whose target name collides with >=3 other symbols (default false — they produce phantom god-nodes).
- `limit` (integer): Max references returned (default 50).
- `symbol_id` (string): Symbol ID to find references for

### `get_call_graph` (~143 tokens)

Build a bidirectional call graph centered on a symbol (who calls it + what it calls). Each branch keeps its direction: depth 2 = callers of callers, callees of callees. Use to understand control flow through a function. For flat list of all references use find_usages instead. Read-only. Returns JSON: { root: { symbol_id, name, calls: [...], called_by: [...] } }.

Input parameters:

- `depth` (integer): Traversal depth on each side (default 2)
- `fqn` (string): Fully qualified name to center the graph on
- `symbol_id` (string): Symbol ID to center the graph on

### `search_text` (~312 tokens)

Full-text search across all indexed files. Supports regex, glob file patterns, language filter. Use for finding strings, comments, TODOs, config values, error messages — anything not captured as a symbol. For symbol search (functions, classes) use search instead. Read-only. Returns JSON: { files: [{ file, language, hits: [{ line, column, match, context }] }], total_matches } — hits grouped per file, so a long path is paid once. Pass `grouping: "flat"` for the ungrouped matches[] shape.

Input parameters:

- `case_sensitive` (boolean): Case-sensitive search (default false)
- `context_lines` (integer): Lines of context before/after each match (default 0 — set higher if you need surrounding code)
- `file_pattern` (string): Glob filter, e.g. "src/**/*.ts"
- `grouping` (string): Payload shape. "by_file" (default) groups hits per file, so a long path is paid once; "flat" is a single matches[] array.
- `is_regex` (boolean): Treat query as regex (default false)
- `language` (string): Filter by language (e.g. "typescript", "python")
- `max_results` (integer): Max matches to return (default 50)
- `query` (string, required): Search string or regex pattern
- `timeout_ms` (integer): Wall-clock budget in ms — caps a catastrophic-backtracking regex. Default 2000; 0 disables.

### `get_diagnostics` (~113 tokens)

Execute type-checker (tsc, mypy, pyright) and map errors to enclosing AST symbols. Read-only.

Input parameters:

- `checker` (string): Checker (tsc, mypy, pyright)
- `file_path` (string): Filter by file path
- `max_files` (integer): Max files reported
- `max_per_file` (integer): Max errors per file
- `reduce_output` (boolean): Shrink long output to a receipt
- `timeout_ms` (integer): Timeout in ms

### `mine_sessions` (~360 tokens)

Mine Claude Code / Claw Code session logs for architectural decisions, tech choices, bug root causes, and preferences. Strategies: "regex" (default, free, ~20-40% recall), "llm" (higher recall, costs tokens), "hybrid" (regex + LLM safety net). Skips already-mined sessions unless force=true. Mutates the decision store; idempotent. Returns JSON: { mined, decisions_extracted, sessions_processed, strategy?, llm_sessions?, llm_decisions_extracted? }.

Input parameters:

- `force` (boolean): Re-mine already processed sessions (default: false)
- `incremental_cursor` (boolean): Per-call override for `memory.mining.incrementalCursor`. true (default) reuses byte-offset cursors for appended turns; false falls back to legacy mined/unmined semantics.
- `min_confidence` (number): Legacy reject floor — drops decisions below this. Superseded by reject_threshold; kept for back-compat.
- `project_root` (string): Only mine sessions for this project path (default: all projects)
- `reject_threshold` (number): Reject floor (default: config decisions.reject_threshold, fallback 0.45). Decisions in [reject_threshold, review_threshold) queue for review; below it, dropped.
- `review_threshold` (number): Auto-approve cutoff (default: config decisions.review_threshold, fallback 0.75). Decisions ≥ this enter the active graph immediately.
- `strategy` (string): Extraction strategy: regex (default, free/fast/low recall), llm (AI provider, costs tokens, higher recall), hybrid (regex + LLM safety net). Falls back to regex with a warning if no AI provider is co…

### `remember_decision` (~293 tokens)

Live agent write into the decision knowledge graph. Confidence-scores the input and routes it through the memoir review queue: high-confidence rows enter the active graph immediately, mid-confidence rows queue for human approval, low-confidence rows are dropped without persistence. Per-session dedup + rate-limit. Use during a session to capture decisions in real time. For manual high-confidence writes use add_decision; for post-hoc extraction from session logs use mine_sessions. Returns JSON: { id, review_status, confidence, deduplicated? }.

Input parameters:

- `content` (string, required): Full decision text — reasoning, context, tradeoffs
- `file_path` (string): File path this decision is about
- `git_branch`: Git branch this decision belongs to. Omit to auto-detect, or pass null to make it branch-agnostic.
- `service_name` (string): Subproject name this decision is about (e.g., "auth-api", "user-service")
- `session_id` (string): Session identifier for dedup/rate-limit (default: "_default")
- `symbol_id` (string): Symbol FQN this decision is about (e.g., "src/auth/provider.ts::AuthProvider#class")
- `tags` (array): Tags for categorization (e.g., ["auth", "security"])
- `title` (string, required): Short summary of the decision
- `type` (string, required): Decision type

### `query_decisions` (~674 tokens)

Query the decision knowledge graph. Filter by type, subproject, code symbol, file path, tag, or time — answers "why was this architecture chosen?" with the actual decision record. Use service_name to scope to a subproject. Defaults to auto+human-approved decisions; use include_pending or review_status for other tiers. Rows carry `cluster_ids` when part of a topical cluster (see `clusters_summary`). Read-only. Returns JSON: { decisions: [{ id, title, type, content, tags, review_status, cluster_ids? }], clusters_summary?, total_results }. Supports `output_format: "toon"`. Capped by `memory.recall.timeoutMs` (default 5000ms); on timeout returns `{ decisions: [], total_results: 0, degraded: true }`.

Input parameters:

- `as_of` (string): Only decisions active at this ISO timestamp
- `file_path` (string): Filter by linked file path
- `git_branch` (string): Branch filter: "current" (default) = current branch + branch-agnostic; "all" = every branch; any other value = that branch + branch-agnostic.
- `include_invalidated` (boolean): Include invalidated decisions (default: false)
- `include_pending` (boolean): Also return decisions in the review queue (review_status="pending"). Default: false — only auto-approved and approved rows are returned.
- `index_only` (boolean): Progressive disclosure (default false). true omits full `content` — just id, title, type, anchors, tags, ~1-line `summary`. Pick ids cheaply, then pull full content with `get_decision`.
- `limit` (integer): Max results (default: 50)
- `order_by` (string): Result ordering: "recency" (default, valid_from DESC), "created_at" DESC, or "heat" (time-decay favoring frequently-recalled + fresh; degrades to recency if disabled in config).
- `output_format` (string): Output format. "json" (default), "markdown" (LLM-friendly fenced markdown, tool-specific), or "toon" (Token-Oriented Object Notation — 30-60% fewer tokens on tabular data, lossless).
- `review_status` (string): Restrict to a single review tier (overrides default + include_pending). Use "pending" to fetch the review queue.
- `search` (string): Full-text search query (FTS5 with porter stemming)
- `service_name` (string): Filter by subproject name (e.g., "auth-api")
- `symbol_id` (string): Filter by linked symbol FQN
- `tag` (string): Filter by tag
- `type` (string): Filter by decision type
- `verification` (string): Filter by verification verdict (implies verify=true). "stale" = any flagged row; "ok" = verified-fresh only. Omit to return all rows annotated in place.
- `verify` (boolean): Staleness verification (default true). Checks each `symbol_id`-linked decision against the live index + git history; deleted/renamed/materially-changed code is flagged `verification` + `stale: true`.…

### `invalidate_decision` (~100 tokens)

Mark a decision as no longer valid. The decision remains in the knowledge graph for historical queries but is excluded from active queries. Use when a decision is superseded or reversed. Mutates the decision store; idempotent. Returns JSON: { invalidated: { id, title, valid_until } }.

Input parameters:

- `id` (integer, required): Decision ID to invalidate
- `valid_until` (string): ISO timestamp when decision became invalid (default: now)

### `get_preset_info` (~62 tokens)

Show active tool preset, available presets, which tools are registered in this session, and which are deferred (loadable via load_tools). Read-only. Returns JSON: { active_preset, registered_tools, tool_names, available_presets, deferred_tools }.

### `load_tools` (~137 tokens)

Load tools this session's preset deferred, by preset name and/or explicit tool names. Call with no arguments to list what is deferred. Emits notifications/tools/list_changed and returns the loaded tools' schemas, so they are usable even if your client ignores that notification (call them through `batch`). Returns JSON: { loaded, already_loaded, unknown, blocked, tools, hint }.

Input parameters:

- `preset` (string): Preset whose members to load (minimal, standard, review, architecture, full). "full" loads everything deferred.
- `tools` (array): Explicit tool names to load. Unions with `preset` when both are given.

### `get_session_analytics` (~106 tokens)

Analyze AI agent session logs: token usage, cost breakdown by tool/server, top files, models used. Parses Claude Code JSONL logs automatically. Read-only. For waste detection use get_optimization_report; for cost trends use get_usage_trends. Returns JSON: { sessions, tokens, cost_usd, tools, models, topFiles }.

Input parameters:

- `period` (string): Time period (default: week)
- `session_id` (string): Specific session ID to analyze

### `get_optimization_report` (~102 tokens)

Detect token waste patterns in AI agent sessions: repeated file reads, Bash grep instead of search, large file reads, unused trace-mcp tools. Provides savings estimates. Read-only. For usage/cost overview use get_session_analytics; for A/B savings comparison use get_real_savings. Returns JSON: { patterns: [{ type, description, savings_estimate }], total_waste }.

Input parameters:

- `period` (string): Time period (default: week)

### `get_coverage_report` (~61 tokens)

Technology profile of the project: detected frameworks/ORMs/UI libs from manifests (package.json, composer.json, etc.), which are covered by trace-mcp plugins, and coverage gaps. Read-only. Returns JSON: { detected, covered, gaps }.

### `get_real_savings` (~89 tokens)

A/B comparison: how many tokens could be saved by using trace-mcp instead of raw Read/Bash file reads. Per-file breakdown. Read-only. For pattern-based waste detection use get_optimization_report instead. Returns JSON: { files: [{ file, raw_tokens, compact_tokens, savings }], total_savings }.

Input parameters:

- `period` (string): Time period (default: week)

### `get_usage_trends` (~90 tokens)

Daily token usage time-series: sessions, tokens, estimated cost, tool calls per day. For spotting cost spikes. Read-only. For detailed session breakdown use get_session_analytics instead. Returns JSON: { days, daily: [{ date, sessions, tokens, cost_usd, tool_calls }], totals }.

Input parameters:

- `days` (integer): Number of days to show (default: 30)

### `get_session_stats` (~70 tokens)

Token savings stats for this session: per-tool call counts, estimated token savings, reduction percentage, dedup savings, and per-tool latency (p50/p95/max/error_rate). Read-only. Returns JSON: { session: { ..., latency_per_tool }, cumulative, dedup_saved_tokens, report }.

### `plan_turn` (~206 tokens)

Opening-move router for new tasks. Combines BM25/PageRank search + session journal (negative evidence + focus signals) + framework-aware insertion-point suggestions + change-risk + turn-budget advisor into ONE call. Returns verdict (exists/partial/missing/ambiguous), confidence, ranked targets with provenance, scaffold hints when missing, and recommended next tool calls. Call this FIRST on a new task to break the empty-result hallucination chain. Read-only. For broader task context with source code use get_task_context instead. Returns JSON: { verdict, confidence, targets, scaffoldHints, nextSteps }.

Input parameters:

- `intent` (string): Optional intent hint; auto-classified from task if omitted
- `max_targets` (integer): Cap on returned targets (default 5)
- `skip_risk` (boolean): Skip change-risk assessment for the top target (default false)
- `task` (string, required): Natural-language task description (e.g. "add a webhook endpoint for stripe payments")

### `batch` (~129 tokens)

Execute multiple trace-mcp tools in a single MCP request. Dispatches any registered tool by name, including tools this session's preset defers — so a deferred tool is callable here without a load_tools round-trip (tools.exclude stays a hard restriction). Use to reduce round-trips when you need several independent queries (e.g., get_outline for 3 files, or search + get_symbol together). Read-only (delegates to other tools). Returns JSON: { batch_results: [{ tool, result }], total }.

Input parameters:

- `calls` (array, required): Array of tool calls to execute (max 10)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/nikolai-vysotskyi-trace-mcp/trace-mcp#diagnostics

## Score history

- 2026-09-21: 48
- 2026-09-20: 88
- 2026-09-19: 88
- 2026-09-18: 87
- 2026-09-17: 84
- 2026-09-16: 84
- 2026-09-15: 83
- 2026-09-14: 83
- 2026-09-13: 82
- 2026-09-12: 82
- 2026-09-11: 81
- 2026-09-10: 66
- 2026-09-09: 80
- 2026-09-08: 80
- 2026-09-07: 71
- 2026-09-06: 64
- 2026-09-05: 63
- 2026-09-04: 78
- 2026-09-03: 62
- 2026-09-02: 53
- 2026-09-01: 77
- 2026-08-31: 76
- 2026-08-30: 45
- 2026-08-29: 37

## Common questions

### What is the io.github.nikolai-vysotskyi/trace-mcp server?

io.github.nikolai-vysotskyi/trace-mcp is listed in the public MCP registry as io.github.nikolai-vysotskyi/trace-mcp. Code graph MCP: 81 languages, 88 frameworks, 72.7% fewer PR-review tokens, comprehension at parity. This page covers its npm package (trace-mcp).

### Is the io.github.nikolai-vysotskyi/trace-mcp server safe to use?

io.github.nikolai-vysotskyi/trace-mcp scores 48 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.nikolai-vysotskyi/trace-mcp server expose?

io.github.nikolai-vysotskyi/trace-mcp exposes 29 tools: get_index_health, register_edit, get_project_map, search, suggest_queries, and 24 more. Their descriptions and schemas cost roughly 5,770 tokens of context every time the server is loaded.

### Is the io.github.nikolai-vysotskyi/trace-mcp server still maintained?

io.github.nikolai-vysotskyi/trace-mcp is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.nikolai-vysotskyi/trace-mcp server under?

io.github.nikolai-vysotskyi/trace-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/trace-mcp
- Socket report: https://socket.dev/npm/package/trace-mcp
- Repository: https://github.com/nikolai-vysotskyi/trace-mcp
- Website: https://trace-mcp.com/
- Changelog RSS feed: https://verifymcp.io/servers/nikolai-vysotskyi-trace-mcp/trace-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/nikolai-vysotskyi-trace-mcp/trace-mcp.json
- HTML version of this page: https://verifymcp.io/servers/nikolai-vysotskyi-trace-mcp/trace-mcp