# javaperf (npm · javaperf)

Java profiling MCP via jcmd/jfr/jps. Diagnose performance, analyze threads, inspect JFR recordings.

- Trust score: 77/100 (medium)
- Change this week: +32
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `javaperf`: 77/100 (this document), [markdown](https://verifymcp.io/servers/thesharque-javaperf/javaperf.md), [page](https://verifymcp.io/servers/thesharque-javaperf/javaperf)

## Channel facts

- Registry: `npm`
- Package: `javaperf`
- Version: `1.4.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to theSharque/mcp-jperf).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 71 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2587 tokens (~99/item across 26 items; 26 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 93/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 78% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add thesharque-javaperf -- npx -y javaperf
```

### Codex

```bash
codex mcp add thesharque-javaperf -- npx -y javaperf
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "thesharque-javaperf": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "javaperf"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add thesharque-javaperf --command npx --arg -y --arg javaperf
```

### Hermes

```yaml
mcp_servers:
  thesharque-javaperf:
    command: "npx"
    args: ["-y", "javaperf"]
```

### Other

```json
{
  "mcpServers": {
    "thesharque-javaperf": {
      "command": "npx",
      "args": [
        "-y",
        "javaperf"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 77, +3)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 74, +54)

- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The attested source repository moved: theSharque/mcp-jperf
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-07-31 (score 20, +14)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-28 (score 24, −21)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (26)

### `list_java_processes` (~96 tokens)

Lists all running Java processes on the machine. Returns an array of objects with pid, mainClass, and args. Use this tool first to discover the target process PID before calling start_profiling or analyze_threads. Data is obtained via jps -l -m.

Input parameters:

- `topN` (integer): Maximum number of processes to return in the list. Default: 10. Use higher values if many Java processes are running.

### `start_profiling` (~256 tokens)

Starts JFR on the target PID. Rotates recordings (old_profile.jfr ← new_profile.jfr). Default preset is profile. Optional preset or settingsFile (.jfc, cwd-relative or absolute)—mutually exclusive. Builtin presets may omit socket/I/O/native/locks; use a custom .jfc for jdk.SocketRead/Write, FileRead/Write, JavaMonitorBlocked, jdk.ThreadPark, NativeMethodSample. Then list_jfr_recordings and stop_profiling.

Input parameters:

- `duration` (integer, required): Recording duration in seconds. Typical: 10–60 quick, 300+ under load.
- `memorysize` (string): JFR buffer size, e.g. 20M. Default JVM buffer applies if omitted.
- `pid` (integer, required): Process ID of the Java application. Use list_java_processes.
- `preset` (string): Builtin settings name (e.g. profile, default). Effective default when omitted is profile. Mutually exclusive with settingsFile.
- `settingsFile` (string): Path to .jfc file (cwd-relative or absolute). Mutually exclusive with preset.
- `stackdepth` (integer): Stack depth for JFR events. Default 128.

### `stop_profiling` (~115 tokens)

Stops an active JFR recording and saves it to recordings/new_profile.jfr. Use recordings/new_profile.jfr for current data, recordings/old_profile.jfr for previous (before/after comparison).

Input parameters:

- `pid` (integer, required): Process ID of the Java process that has the active recording. Must match the pid used in start_profiling.
- `recordingId` (string, required): ID of the recording to stop. This is the recordingId returned by start_profiling (e.g. '1' or '2').

### `check_deadlock` (~78 tokens)

Checks for Java-level deadlocks in the specified process. Parses jcmd Thread.print output and returns structured JSON: which threads are involved, what locks they hold/wait for, and the deadlock cycle. Use for automated analysis and reports.

Input parameters:

- `pid` (integer, required): Process ID of the Java application. Get this from list_java_processes.

### `list_jfr_recordings` (~78 tokens)

Lists active and recent JFR recordings for a Java process (jcmd JFR.check). Returns recording id, duration, state (running/stopped), and filename. Use before stop_profiling to get the correct recordingId.

Input parameters:

- `pid` (integer, required): Process ID of the Java application. Get this from list_java_processes.

### `analyze_threads` (~124 tokens)

Thread dump (jstack -l). Default: plain text. Set structured=true for JSON lock-wait chains (live snapshot). Historical contention: profile_jfr_locks. Deadlock cycle: check_deadlock.

Input parameters:

- `pid` (integer, required): Process ID of the Java application. Get this from list_java_processes.
- `structured` (boolean): Return structured JSON with lockWaitChains instead of plain-text dump. Default: false.
- `topN` (integer): Maximum number of threads to include in the output. Default: 10. Increase for applications with many threads.

### `heap_histogram` (~94 tokens)

Static class histogram (jcmd GC.class_histogram). For live growth over time use heap_live_histogram_diff instead.

Input parameters:

- `all` (boolean): Include unreachable objects. Triggers full GC and may cause application pause.
- `pid` (integer, required): Process ID of the Java application. Get this from list_java_processes.
- `topN` (integer): Maximum number of top classes to return. Default: 20.

### `heap_live_histogram_diff` (~145 tokens)

Two GC.class_histogram snapshots spaced by intervalSeconds; returns classes whose instance count grew most. Use first in memory-leak workflow; then profile_memory and heap_dump (MAT path-to-GC-roots). Each snapshot walks the heap and may pause the app.

Input parameters:

- `all` (boolean): Include unreachable objects (-all). Triggers full GC and may pause the app.
- `intervalSeconds` (integer): Seconds between baseline and snapshot histograms. Default: 5.
- `minInstanceDelta` (integer): Ignore classes with instance growth below this threshold.
- `pid` (integer, required): Process ID from list_java_processes.
- `topN` (integer)

### `heap_dump` (~77 tokens)

Creates .hprof for Eclipse MAT / VisualVM. After heap_live_histogram_diff picks a growing class, use MAT Path to GC Roots (exclude weak/soft). Saved to recordings/heap_dump.hprof. Warning: large file.

Input parameters:

- `pid` (integer, required): Process ID of the Java application. Get this from list_java_processes.

### `heap_info` (~47 tokens)

Brief heap usage summary: capacities, used, committed regions. Quick snapshot without full dump.

Input parameters:

- `pid` (integer, required): Process ID of the Java application. Get this from list_java_processes.

### `vm_info` (~44 tokens)

JVM information: uptime, version, and flags. Useful for environment verification.

Input parameters:

- `pid` (integer, required): Process ID of the Java application. Get this from list_java_processes.

### `trace_method` (~236 tokens)

Builds a call tree for a specific method from a .jfr file. Filters ExecutionSample events to find stack traces containing the given class and method, then aggregates call paths. Use when you want to see who calls a particular method and from where. Limitation: JFR sampling (~10 ms) may miss very fast methods.

Input parameters:

- `className` (string, required): Fully qualified class name (e.g. com.example.MyService) or a substring to match. Used to filter stack frames.
- `events` (array): Optional list of JFR event types to parse. Default: jdk.ExecutionSample. Advanced users can specify other event types.
- `filepath` (string): Path to .jfr file. Shortcuts: 'new_profile' (current, default) or 'old_profile' (previous). Or full path e.g. recordings/new_profile.jfr.
- `methodName` (string, required): Method name to search for (e.g. processRequest). Matches the method in the stack trace.
- `topN` (integer): Maximum number of call paths (branches) to return in the call tree. Default: 10.

### `parse_jfr_summary` (~172 tokens)

Parses a .jfr file and returns a structured summary: top methods by CPU samples, GC statistics, thread allocation stats, and anomaly hints (e.g. high GC count). Use for a quick high-level overview of the recording before diving into specific profiles.

Input parameters:

- `events` (array): Optional list of JFR event types to include. Default: jdk.ExecutionSample, jdk.GarbageCollection, jdk.JavaThreadStatistics, jdk.ThreadAllocationStatistics.
- `filepath` (string): Path to .jfr file. Shortcuts: 'new_profile' (current, default) or 'old_profile' (previous). Or full path e.g. recordings/new_profile.jfr.
- `topN` (integer): Maximum number of top methods to include in the summary. Default: 10.

### `profile_memory` (~142 tokens)

JFR memory profile: top allocators by bytes/count, allocation stacks, OldObjectSample by class (allocation site, not GC roots). Pair with heap_live_histogram_diff, gc_efficiency, heap_dump+MAT. Requires profile preset recording.

Input parameters:

- `filepath` (string): Path to .jfr file. Shortcuts: 'new_profile' (current, default) or 'old_profile' (previous). Or full path e.g. recordings/new_profile.jfr.
- `sortBy` (string): Primary ranking for topAllocators. Default: bytes.
- `topN` (integer): Maximum number of top allocators to return. Default: 10.

### `gc_efficiency` (~68 tokens)

GC efficiency from .jfr: pause time vs freed bytes per collector/cause. Use after stop_profiling; complements profile_memory and heap_info. Not a general JFR summary (see parse_jfr_summary).

Input parameters:

- `filepath` (string)
- `topN` (integer)

### `profile_time` (~141 tokens)

CPU time (bottleneck) profile from a .jfr file. Uses bottom-up aggregation: each method is counted in every sample where it appears in the stack, including time spent in callees. Returns methods consuming the most CPU time. Use when the goal is to find performance bottlenecks and slow code paths.

Input parameters:

- `filepath` (string): Path to .jfr file. Shortcuts: 'new_profile' (current, default) or 'old_profile' (previous). Or full path e.g. recordings/new_profile.jfr.
- `topN` (integer): Maximum number of top methods by CPU time to return. Default: 10.

### `profile_frequency` (~141 tokens)

Call frequency profile from a .jfr file. Counts methods that appear at the leaf (top) of the stack in ExecutionSample events — i.e. methods that were actively executing when sampled. Returns the most frequently sampled methods (exclusive, not cumulative). Use when looking for hot spots or the most often executed code paths.

Input parameters:

- `filepath` (string): Path to .jfr file. Shortcuts: 'new_profile' (current, default) or 'old_profile' (previous). Or full path e.g. recordings/new_profile.jfr.
- `topN` (integer): Maximum number of top methods by call frequency to return. Default: 10.

### `profile_jfr_network` (~124 tokens)

Summarize JDK socket I/O from a .jfr (jdk.SocketRead, jdk.SocketWrite): event counts, total bytes read/written where available, top endpoints (host:port / address), and cumulative stack hotspots. Recording must include those events (custom .jfc or preset that enables them). If emptyEvents, use start_profiling settingsFile.

Input parameters:

- `filepath` (string): Path to .jfr. Shortcuts: new_profile, old_profile, or absolute path.
- `topN` (integer): Top N endpoints and methods.

### `profile_jfr_file_io` (~93 tokens)

Summarize file read/write events (jdk.FileRead, jdk.FileWrite): counts, bytes, top paths, stack hotspots. Events must exist in recording; configure via start_profiling preset or settingsFile (.jfc).

Input parameters:

- `filepath` (string): Path to .jfr. Shortcuts: new_profile, old_profile.
- `topN` (integer): Top N paths/methods.

### `profile_jfr_locks` (~74 tokens)

Lock contention from JFR: synchronized monitors (JavaMonitorBlocked) and j.u.c parking (ThreadPark). Live wait chains: analyze_threads structured=true. Deadlocks: check_deadlock. Enable events via custom .jfc if missing.

Input parameters:

- `filepath` (string)
- `topN` (integer)

### `profile_jfr_native` (~51 tokens)

CPU-style cumulative hotspots from jdk.NativeMethodSample stacks. Recording must enable NativeMethodSample (often requires custom .jfc).

Input parameters:

- `filepath` (string)
- `topN` (integer)

### `native_memory_summary` (~45 tokens)

jcmd VM.native_memory summary=true. Requires JVM started with -XX:NativeMemoryTracking=summary or detail; otherwise explains how to enable.

Input parameters:

- `pid` (integer, required)

### `gc_class_stats` (~56 tokens)

jcmd GC.class_stats (class loader / metaspace style stats where supported—often JDK 21+). On older JDK returns error hint; use heap_info or heap_histogram instead.

Input parameters:

- `pid` (integer, required)

### `gc_finalizer_info` (~33 tokens)

jcmd GC.finalizer_info — finalizer queue diagnostics for the live process.

Input parameters:

- `pid` (integer, required)

### `compiler_codecache` (~30 tokens)

jcmd Compiler.codecache — code heap usage and related JVM output.

Input parameters:

- `pid` (integer, required)

### `compiler_queue` (~27 tokens)

jcmd Compiler.queue — methods queued for JIT compilation.

Input parameters:

- `pid` (integer, required)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/thesharque-javaperf/javaperf#diagnostics

## Score history

- 2026-08-03: 77
- 2026-08-02: 74
- 2026-08-01: 20
- 2026-07-31: 20
- 2026-07-30: 6
- 2026-07-28: 24
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/javaperf
- Socket report: https://socket.dev/npm/package/javaperf
- Repository: https://github.com/theSharque/mcp-jperf
- Changelog RSS feed: https://verifymcp.io/servers/thesharque-javaperf/javaperf/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/thesharque-javaperf/javaperf/changelog.json
- HTML version of this page: https://verifymcp.io/servers/thesharque-javaperf/javaperf