# io.github.yifancong/rsdoctor (npm · @rsdoctor/mcp-server)

An MCP server that provides build analysis and optimization recommendations for Rspack projects.

- Trust score: 64/100 (medium)
- Change this week: −12
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@rsdoctor/mcp-server`: 64/100 (this document), [markdown](https://verifymcp.io/servers/yifancong-rsdoctor/rsdoctor-mcp-server.md), [page](https://verifymcp.io/servers/yifancong-rsdoctor/rsdoctor-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@rsdoctor/mcp-server`
- Version: `0.1.2-beta.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 88/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 10 of 10 dependencies flagged as unhealthy (10 deprecated).
- **Provenance & Transparency**: 96/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to web-infra-dev/rsdoctor).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 229 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 31/100
  - 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (fair).
  - Context-footprint check failed: tool/resource definitions use about 1841 tokens (~108/item across 17 items; 15 tools + 2 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 62/100
  - 93% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add yifancong-rsdoctor -- npx -y @rsdoctor/mcp-server
```

### Codex

```bash
codex mcp add yifancong-rsdoctor -- npx -y @rsdoctor/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "yifancong-rsdoctor": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@rsdoctor/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add yifancong-rsdoctor --command npx --arg -y --arg @rsdoctor/mcp-server
```

### Hermes

```yaml
mcp_servers:
  yifancong-rsdoctor:
    command: "npx"
    args: ["-y", "@rsdoctor/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "yifancong-rsdoctor": {
      "command": "npx",
      "args": [
        "-y",
        "@rsdoctor/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 64, +3)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 61, +12)

- [security improvement] Malware scan: unverified → pass
- [functional regression] Dependency health: 0.91 → 0.00

### 2026-07-31 (score 49, −27)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 76, +17)

- [functional improvement] Schema quality: unverified → 0
- [functional improvement] Tool coverage: unverified → 93
- [functional] First check of Tool coverage: 0
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fair
- [functional] First check of Schema quality: fail

### 2026-07-26 (score 59)

First indexed and scored.

## MCP tools (15)

### `get_chunks` (~12 tokens)

get all chunks

### `get_chunk_by_id` (~23 tokens)

get chunk by id

Input parameters:

- `chunkId` (number, required)

### `get_module_by_id` (~295 tokens)

get module detail by id (Rspack or Webpack module id)：
    - id: the id of the module (corresponds to Rspack or Webpack's internal module id)
    - issuerPath: the referrer chain (array of module ids, from entry to this module)
    - dependencies: direct dependencies (array of module ids this module imports/requires)
    - allDependencies: all transitive dependencies (if user asks for detail)
    - chunks: array of chunk ids this module belongs to
    - imported: array of module ids that import this module
    - isEntry: whether this module is an entry point
    - size: { sourceSize, transformedSize, parsedSize }
    - layer, modules, rootModule, webpackId: advanced info
    - bailoutReason: if present, the reason why this module is not tree-shaken or optimized away (e.g. "side effects", "dynamic import", "unknown exports", etc.)
    - Please use Rspack or Webpack's terminology for all fields.
    - If user asks for "why not tree-shaken", always return bailoutReason and explain in plain language.
    - If user asks for "who imported this module", return issuerPath as a dependency chain.
    - If user asks for "all dependencies", return allDependencies.

Input parameters:

- `moduleId` (number, required)

### `get_module_by_path` (~127 tokens)

get module detail by module name or path (absolute or relative, as in Rspack or Webpack stats)
    - If multiple modules match, return all matched module paths and stop, let user select.
    - Otherwise, return the same fields as getModuleById.
    - Always include bailoutReason if present.
    - If user asks for "why is this module in the bundle", show the full issuerPath chain.
    - If user asks for "why not tree-shaken", show bailoutReason and explain.

Input parameters:

- `modulePath` (string, required)

### `get_module_issuer_path` (~86 tokens)

get module issuer path (who imported this module, recursively)
    - Return as a dependency chain (array of module ids from entry to this module)
    - If possible, render as a tree or graph for clarity.
    - For each module in the chain, show its path and (if present) bailoutReason.

Input parameters:

- `moduleId` (string, required)

### `get_package_info` (~13 tokens)

get package info

### `get_package_dependency` (~13 tokens)

get package dependency

### `get_rule_info` (~540 tokens)

get rules info, the rules info is a Record<{id: number, name: string, description: string, severity: string, category: string, module: string, path: string, line: number, column: number, message: string, fix: string}>, where:
  \- id: an incremental sequence mark
  \- name: the name of the rule
  \- description: the description of the rule
  \- severity: the severity of the rule
  \- category: the category of the rule
  \- E1001 Duplicate Packages:
      #### Description

      there is a same name package which bundled more than one version in your application.

      it is not good to the bundle size of your application.

      #### General Solution

      add an entry in `resolve.alias` which will configure Webpack to route any package references to a single specified path.

      For example, if `lodash` is duplicated in your bundle, the following configuration would render all Lodash imports to always refer to the `lodash` instance found at `./node_modules/lodash`:

      ```js
      {
        alias: {
          lodash: path.resolve(__dirname, 'node_modules/lodash')
        }
      }
      ```
      ,
  \- E1002 Cross Chunks Packages:  #### Description
    There is a package with the same version that is duplicated across different chunks in your application. This redundancy increases the overall bundle size, which is not optimal for performance.

    #### General Solution

    To address this issue, you can use Rspack's **SplitChunksPlugin** to extract common dependencies into a separate chunk. This ensures that the same package is not duplicated across multiple chunks, thereby reducing the bundle size.

    For example, if **lodash** is being duplicated across different chunks, you can configure the **optimization.splitChunks** option in your Webpack configuration to extract **lodash** into a separate chunk:

    ```
    module.exports = {
      optimization: {
        splitChunks: {
          cacheGroups: {
            commons: {
              test: /[\/]node_modu…

### `get_similar_packages` (~285 tokens)

get similar packages. Similar packages are categorized as follows, with each line representing a category of similar packages. The presence of packages below does not necessarily mean there are similar packages - replacement should only be considered when packages from the same category exist:
    1. cannot exist simultaneously: lodash、lodash-es、string_decode：Consider migrating to lodash-es for better Tree Shaking support. /n
    2. cannot exist simultaneously: dayjs, moment, date-fns, js-joda. Consider using dayjs to replace moment for smaller bundle size. /n
    3. cannot exist simultaneously: antd, material-ui, semantic-ui-react, material-ui, arco-design /n
    4. cannot exist simultaneously: axios, node-fetch
    5. cannot exist simultaneously: redux, mobx, Zustand, Recoil, Jotai
    6. cannot exist simultaneously: chalk, colors, picocolors, kleur
    7. cannot exist simultaneously: fs-extra, graceful-fs

    It's fine to have any of the above packages in your project, but packages from the same category (i.e. same line) should not coexist.
    If there are no similar packages, just return that there are no similar packages, without listing which packages exist.
    Please provide a simple response without listing all packages.

### `get_packages_by_package_name` (~294 tokens)

get similar packages. Similar packages are categorized as follows, with each line representing a category of similar packages. The presence of packages below does not necessarily mean there are similar packages - replacement should only be considered when packages from the same category exist:
    1. cannot exist simultaneously: lodash、lodash-es、string_decode：Consider migrating to lodash-es for better Tree Shaking support. /n
    2. cannot exist simultaneously: dayjs, moment, date-fns, js-joda. Consider using dayjs to replace moment for smaller bundle size. /n
    3. cannot exist simultaneously: antd, material-ui, semantic-ui-react, material-ui, arco-design /n
    4. cannot exist simultaneously: axios, node-fetch
    5. cannot exist simultaneously: redux, mobx, Zustand, Recoil, Jotai
    6. cannot exist simultaneously: chalk, colors, picocolors, kleur
    7. cannot exist simultaneously: fs-extra, graceful-fs

    It's fine to have any of the above packages in your project, but packages from the same category (i.e. same line) should not coexist.
    If there are no similar packages, just return that there are no similar packages, without listing which packages exist.
    Please provide a simple response without listing all packages.

Input parameters:

- `packageName` (string, required)

### `get_duplicate_packages` (~6 tokens)

### `get_bundle_optimize` (~82 tokens)

getBundleOptimize calls multiple functions to provide conclusions to users:
      - getRuleInfo for duplicate packages
      - GetSimilarPackages to check if there are similar packages that need optimization
      - getMediaAssetPrompt to check if media assets need optimization
      - GetAllChunks to check if there are oversized resources and provide splitChunk suggestions

### `get_loader_time_all_files` (~22 tokens)

Get compilation time spent by each loader on individual files

### `get_loader_times` (~15 tokens)

Get compiled directories loader times

### `get_port` (~16 tokens)

Get the port of the MCP server

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/yifancong-rsdoctor/rsdoctor-mcp-server#diagnostics

## Score history

- 2026-08-03: 64
- 2026-08-02: 61
- 2026-08-01: 49
- 2026-07-31: 49
- 2026-07-30: 76
- 2026-07-29: 76
- 2026-07-27: 76
- 2026-07-26: 59

## Links

- npm package: https://www.npmjs.com/package/@rsdoctor/mcp-server
- Socket report: https://socket.dev/npm/package/@rsdoctor/mcp-server
- Repository: https://github.com/web-infra-dev/rsdoctor
- Changelog RSS feed: https://verifymcp.io/servers/yifancong-rsdoctor/rsdoctor-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/yifancong-rsdoctor/rsdoctor-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/yifancong-rsdoctor/rsdoctor-mcp-server