# Predictive Debugger (npm · predictive-debugger)

Predicts where JavaScript and TypeScript code will fail at runtime, for coding agents.

- Trust score: 69/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-26

## Components

- npm · `predictive-debugger`: 69/100 (this document), [markdown](https://verifymcp.io/servers/speedosdk-predictive-debugger/predictive-debugger.md), [page](https://verifymcp.io/servers/speedosdk-predictive-debugger/predictive-debugger)

## Channel facts

- Registry: `npm`
- Package: `predictive-debugger`
- Version: `0.8.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-26.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1637 tokens (~272/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Predictive Debugger MCP server?

Predictive Debugger runs locally as an npm package, launched with npx -y predictive-debugger. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add speedosdk-predictive-debugger -- npx -y predictive-debugger
```

### Cursor

```json
{
  "mcpServers": {
    "speedosdk-predictive-debugger": {
      "command": "npx",
      "args": [
        "-y",
        "predictive-debugger"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "speedosdk-predictive-debugger": {
      "command": "npx",
      "args": [
        "-y",
        "predictive-debugger"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add speedosdk-predictive-debugger -- npx -y predictive-debugger
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "speedosdk-predictive-debugger": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "predictive-debugger"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add speedosdk-predictive-debugger --command npx --arg -y --arg predictive-debugger
```

### Hermes

```yaml
mcp_servers:
  speedosdk-predictive-debugger:
    command: "npx"
    args: ["-y", "predictive-debugger"]
```

### Netclaw

```json
{
  "McpServers": {
    "speedosdk-predictive-debugger": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "predictive-debugger"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add speedosdk-predictive-debugger -t stdio -c npx -a -y predictive-debugger
```

### Other

```json
{
  "mcpServers": {
    "speedosdk-predictive-debugger": {
      "command": "npx",
      "args": [
        "-y",
        "predictive-debugger"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-25 (score 69, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-24 (score 69)

First indexed and scored.

## MCP tools (6)

### `map_dependencies` (~155 tokens)

Map a file's dependency neighborhood

Find a file's local imports, reverse imports and tests connected by imports. Each relationship includes a source path and line as evidence. Static file relationships, not runtime callers or test coverage. Scans JavaScript/TypeScript including tests, with bounded work and explicit unresolved imports and scan limits. Deterministic; no provider call.

Input parameters:

- `depth` (integer): Import hops in each direction, default 1
- `directory` (string, required): Project directory; source outside this directory is excluded
- `file` (string, required): Source file, absolute or relative to directory
- `limit` (integer): Total neighboring files to return, default 50
- `maxFiles` (integer): Maximum source files to discover, default 1000

### `analyze_file` (~98 tokens)

Analyze one source file

Return static complexity metrics and a heuristic risk score (0-1) for a single JavaScript or TypeScript file. Deterministic and fast — no model call. Call this when reviewing a file to find out where the structural risk sits (nested loops, long functions, async boundaries, unguarded mutation) before reading the whole file yourself.

Input parameters:

- `file` (string, required): Absolute path to a .js/.jsx/.ts/.tsx file

### `scan_project` (~208 tokens)

Rank a project's files by risk

Walk a directory and rank its JavaScript/TypeScript files by risk density — how concentrated the failure-prone code is, not how big the file is. Test files are left out by default; pass includeTests to rank them too. Deterministic and fast — no model call. Call this at the start of a code review to decide which files are worth your attention, instead of reading the tree in arbitrary order.

Input parameters:

- `directory` (string, required): Absolute path to the directory to scan
- `includeTests` (boolean): Rank test files too — *.spec.*, *.test.*, and anything under __tests__/test/tests/spec/__mocks__ (default false). They rank high for a structural reason rather than a real one: mocked awaits read as…
- `limit` (integer): Maximum number of files to return (default 50)
- `verbose` (boolean): Include the raw metric counts for every file (default false)

### `analyze_logs` (~101 tokens)

Find anomalous log lines

Score a log file's lines by severity and how unusual their wording is, and return the anomalies, worst first. Deterministic — no model call, no API key. Call this when you have a log file and want the handful of lines worth reading rather than the whole file.

Input parameters:

- `logFile` (string, required): Absolute path to the log file
- `threshold` (number): Anomaly score cutoff, 0-1 (default 0.5)

### `predict_failures` (~561 tokens)

Predict the most likely runtime failure in a file

Combine static analysis with a second-opinion verdict from the signed-in Claude Code, Codex, or GitHub Copilot CLI, returning the most likely runtime failure with a line number and reason. `status` distinguishes actionable, uncertain, no-finding, and unavailable results. `checked` lists the bug categories the model reports having considered, so a clean file weighed against the whole catalogue is distinguishable from one where it stopped early; it is a self-report, and an empty list means no coverage was reported. Pass `multi: true` to get every finding the model can demonstrate, ranked, in a `findings` array instead of one verdict — experimental, and more findings per call is also more surface for false positives per call. Treat it as a defect only when `actionable` is true; that applies the measured score >= 0.7 precision gate. This spawns another model and takes 5-15 seconds, so only call it when you specifically want an independent second opinion. If you are yourself reviewing the code, use analyze_file and read the source instead. Reviewing several files? Pass them all as `files` in one call rather than calling once per file: the verdicts run concurrently, so the batch costs the same and takes about as long as a single file.

Input parameters:

- `calleeContext` (boolean): Also send bounded imported definitions and referenced type contracts so the model can check dependency behavior (default true). Turning this off reduces input tokens but removes that evidence.
- `concurrency` (integer): Verdicts in flight at once for a batch (default 4). Lower it if the provider starts rate-limiting.
- `file` (string): Absolute path to a .js/.jsx/.ts/.tsx file
- `files` (array): Absolute paths to review in one call, run concurrently. Prefer this over one call per file when checking a change set: the verdicts are independent, so a batch bills the same as the same files one at…
- `logFile` (string): Optional log file to fold into the combined score
- `model` (string): Model override passed to the CLI
- `multi` (boolean): Return every finding the model can demonstrate, ranked by score, rather than the single most likely one (default false). Experimental: the precision gate was measured on one-finding replies, so `acti…
- `provider` (string): Which CLI to ask (default: whichever is installed)
- `verbose` (boolean): Include the static metric counts and the full log breakdown (default false)

### `list_providers` (~43 tokens)

Show available CLI providers

Report which supported CLIs (Claude Code, Codex, GitHub Copilot) are installed and signed in. Call this to diagnose why predict_failures is failing.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/speedosdk-predictive-debugger/predictive-debugger#diagnostics

## Score history

- 2026-09-26: 69
- 2026-09-25: 69
- 2026-09-24: 69

## Common questions

### What is the Predictive Debugger MCP server?

Predictive Debugger is an MCP server listed in the public MCP registry as io.github.SpeedosDK/predictive-debugger. Predicts where JavaScript and TypeScript code will fail at runtime, for coding agents. This page covers its npm package (predictive-debugger).

### Is the Predictive Debugger MCP server safe to use?

Predictive Debugger scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 26 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Predictive Debugger MCP server expose?

Predictive Debugger exposes 6 tools: map_dependencies, analyze_file, scan_project, analyze_logs, predict_failures, list_providers. Their descriptions and schemas cost roughly 1,166 tokens of context every time the server is loaded.

### Is the Predictive Debugger MCP server still maintained?

Predictive Debugger is still listed as active in the MCP registry. We last reached this channel on 26 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Predictive Debugger MCP server under?

Predictive Debugger declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/predictive-debugger
- Socket report: https://socket.dev/npm/package/predictive-debugger
- Repository: https://github.com/SpeedosDK/predictive-debugger
- Website: https://predictivedebugger.dev/
- Changelog RSS feed: https://verifymcp.io/servers/speedosdk-predictive-debugger/predictive-debugger.xml
- Changelog JSON feed: https://verifymcp.io/servers/speedosdk-predictive-debugger/predictive-debugger.json
- HTML version of this page: https://verifymcp.io/servers/speedosdk-predictive-debugger/predictive-debugger