Predictive Debugger
NPM · PREDICTIVE-DEBUGGER · SCANNED SEP 26
Predicts where JavaScript and TypeScript code will fail at runtime, for coding agents.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability65
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1637 tokens (~272/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the Predictive Debugger MCP server?
Predictive Debugger runs locally as an npm package, launched with npx -y predictive-debugger. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · predictive-debugger
claude mcp add speedosdk-predictive-debugger -- npx -y predictive-debugger
{
"mcpServers": {
"speedosdk-predictive-debugger": {
"command": "npx",
"args": [
"-y",
"predictive-debugger"
]
}
}
} {
"servers": {
"speedosdk-predictive-debugger": {
"command": "npx",
"args": [
"-y",
"predictive-debugger"
]
}
}
} codex mcp add speedosdk-predictive-debugger -- npx -y predictive-debugger
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"speedosdk-predictive-debugger": {
"type": "local",
"command": [
"npx",
"-y",
"predictive-debugger"
],
"enabled": true
}
}
} openclaw mcp add speedosdk-predictive-debugger --command npx --arg -y --arg predictive-debugger
mcp_servers:
speedosdk-predictive-debugger:
command: "npx"
args: ["-y", "predictive-debugger"] {
"McpServers": {
"speedosdk-predictive-debugger": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"predictive-debugger"
]
}
}
} assistant mcp add speedosdk-predictive-debugger -t stdio -c npx -a -y predictive-debugger
{
"mcpServers": {
"speedosdk-predictive-debugger": {
"command": "npx",
"args": [
"-y",
"predictive-debugger"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Sept 26 69
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 26 Sept 2026 · Analysed npm/predictive-debugger@0.8.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
analyze_file Analyze one source file ~98
Return static complexity metrics and a heuristic risk score (0-1) for a single JavaScript or TypeScript file. Deterministic and fast — no model call. Call this when reviewing a file to find out where the structural risk sits (nested loops, long functions, async boundaries, unguarded mutation) before reading the whole file yourself.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | yes | Absolute path to a .js/.jsx/.ts/.tsx file |
No output schema declared.
No examples provided.
analyze_logs Find anomalous log lines ~101
Score a log file's lines by severity and how unusual their wording is, and return the anomalies, worst first. Deterministic — no model call, no API key. Call this when you have a log file and want the handful of lines worth reading rather than the whole file.
| Name | Type | Req | Description |
|---|---|---|---|
| logFile | string | yes | Absolute path to the log file |
| threshold | number | – | Anomaly score cutoff, 0-1 (default 0.5) |
No output schema declared.
No examples provided.
list_providers Show available CLI providers ~43
Report which supported CLIs (Claude Code, Codex, GitHub Copilot) are installed and signed in. Call this to diagnose why predict_failures is failing.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
map_dependencies Map a file's dependency neighborhood ~155
Find a file's local imports, reverse imports and tests connected by imports. Each relationship includes a source path and line as evidence. Static file relationships, not runtime callers or test coverage. Scans JavaScript/TypeScript including tests, with bounded work and explicit unresolved imports and scan limits. Deterministic; no provider call.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | Import hops in each direction, default 1 |
| directory | string | yes | Project directory; source outside this directory is excluded |
| file | string | yes | Source file, absolute or relative to directory |
| limit | integer | – | Total neighboring files to return, default 50 |
| maxFiles | integer | – | Maximum source files to discover, default 1000 |
No output schema declared.
No examples provided.
predict_failures Predict the most likely runtime failure in a file ~561
Combine static analysis with a second-opinion verdict from the signed-in Claude Code, Codex, or GitHub Copilot CLI, returning the most likely runtime failure with a line number and reason. `status` distinguishes actionable, uncertain, no-finding, and unavailable results. `checked` lists the bug categories the model reports having considered, so a clean file weighed against the whole catalogue is distinguishable from one where it stopped early; it is a self-report, and an empty list means no coverage was reported. Pass `multi: true` to get every finding the model can demonstrate, ranked, in a `findings` array instead of one verdict — experimental, and more findings per call is also more surface for false positives per call. Treat it as a defect only when `actionable` is true; that applies the measured score >= 0.7 precision gate. This spawns another model and takes 5-15 seconds, so only call it when you specifically want an independent second opinion. If you are yourself reviewing the code, use analyze_file and read the source instead. Reviewing several files? Pass them all as `files` in one call rather than calling once per file: the verdicts run concurrently, so the batch costs the same and takes about as long as a single file.
| Name | Type | Req | Description |
|---|---|---|---|
| calleeContext | boolean | – | Also send bounded imported definitions and referenced type contracts so the model can check dependency behavior (default true). Turning this off reduces input tokens but removes that evidence. |
| concurrency | integer | – | Verdicts in flight at once for a batch (default 4). Lower it if the provider starts rate-limiting. |
| file | string | – | Absolute path to a .js/.jsx/.ts/.tsx file |
| files | array | – | Absolute paths to review in one call, run concurrently. Prefer this over one call per file when checking a change set: the verdicts are independent, so a batch bills the same as the same files one at… |
| logFile | string | – | Optional log file to fold into the combined score |
| model | string | – | Model override passed to the CLI |
| multi | boolean | – | Return every finding the model can demonstrate, ranked by score, rather than the single most likely one (default false). Experimental: the precision gate was measured on one-finding replies, so `acti… |
| provider | string | – | Which CLI to ask (default: whichever is installed) |
| verbose | boolean | – | Include the static metric counts and the full log breakdown (default false) |
No output schema declared.
No examples provided.
scan_project Rank a project's files by risk ~208
Walk a directory and rank its JavaScript/TypeScript files by risk density — how concentrated the failure-prone code is, not how big the file is. Test files are left out by default; pass includeTests to rank them too. Deterministic and fast — no model call. Call this at the start of a code review to decide which files are worth your attention, instead of reading the tree in arbitrary order.
| Name | Type | Req | Description |
|---|---|---|---|
| directory | string | yes | Absolute path to the directory to scan |
| includeTests | boolean | – | Rank test files too — *.spec.*, *.test.*, and anything under __tests__/test/tests/spec/__mocks__ (default false). They rank high for a structural reason rather than a real one: mocked awaits read as… |
| limit | integer | – | Maximum number of files to return (default 50) |
| verbose | boolean | – | Include the raw metric counts for every file (default false) |
No output schema declared.
No examples provided.
What is the Predictive Debugger MCP server?
Predictive Debugger is an MCP server listed in the public MCP registry as io.github.SpeedosDK/predictive-debugger. Predicts where JavaScript and TypeScript code will fail at runtime, for coding agents. This page covers its npm package (predictive-debugger).
Is the Predictive Debugger MCP server safe to use?
Predictive Debugger scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 26 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Predictive Debugger MCP server expose?
Predictive Debugger exposes 6 tools: map_dependencies, analyze_file, scan_project, analyze_logs, predict_failures, list_providers. Their descriptions and schemas cost roughly 1,166 tokens of context every time the server is loaded.
Is the Predictive Debugger MCP server still maintained?
Predictive Debugger is still listed as active in the MCP registry. We last reached this channel on 26 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Predictive Debugger MCP server under?
Predictive Debugger declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.