
Security News
GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.
@debugbundle/mcp
Advanced tools
MCP server for runtime error reporting, incident response, health checks, debug bundles, and product analytics
MCP server for runtime error reporting, crash reporting, incident response, endpoint health checks, debug bundles, and product analytics. DebugBundle lets agents inspect customer-facing incidents, deterministic bundles, product-usage evidence, reproductions, probes, alerts, webhooks, projects, and setup state through the same management surface as the API and CLI. It is production debugging infrastructure, not a generic infrastructure-monitoring or observability platform.
Run the stdio server directly with npm:
npx @debugbundle/mcp
Or install globally:
npm install -g @debugbundle/mcp
debugbundle-mcp
Supported Node.js versions: 22.x through 26.x.
{
"mcpServers": {
"debugbundle": {
"command": "npx",
"args": ["@debugbundle/mcp"]
}
}
}
Use npx -y @debugbundle/mcp in clients that require noninteractive package execution.
| Environment | Recommended path | Notes |
|---|---|---|
| Generic local MCP client | npx @debugbundle/mcp | stdio transport |
| Claude Desktop local MCP | local MCP server config | uses local machine auth/config |
| Claude Code plugin | /plugin marketplace add debugbundle/debugbundle | installs bundled MCP config and DebugBundle skill |
| Cursor | MCP config with npx @debugbundle/mcp | stdio transport |
| VS Code / GitHub MCP Registry | com.debugbundle/mcp | official registry metadata |
| OpenClaw / ClawHub | DebugBundle skill plus MCP config | use the published skill for workflow guidance |
| CI/headless agents | DEBUGBUNDLE_MEMBER_TOKEN | never use a project token |
| Self-hosted DebugBundle | DEBUGBUNDLE_API_URL plus member auth | points the server at your API base URL |
This package is the supported public local stdio path. A separate OpenAI Plugin 1.0.0 source candidate targets an OAuth-protected read-only remote endpoint at https://mcp.debugbundle.com/mcp; it is not deployed, submitted, published, or publicly installable yet and does not alter this package's catalog or authentication.
In Claude Desktop, open Settings > Developer, edit the local MCP config, and add:
{
"mcpServers": {
"debugbundle": {
"command": "npx",
"args": ["-y", "@debugbundle/mcp"]
}
}
}
Run debugbundle login first to reuse local CLI auth state, or add DEBUGBUNDLE_MEMBER_TOKEN to the server environment for managed/headless use. Set DEBUGBUNDLE_API_URL only for self-hosted or non-default API hosts.
Claude Code users can add DebugBundle's first-party marketplace from this repository:
/plugin marketplace add debugbundle/debugbundle
/plugin install debugbundle@debugbundle
The plugin package lives at apps/mcp/claude-code/debugbundle, bundles a Claude Code skill, and starts the MCP server with the current published @debugbundle/mcp version. It is also structured for Claude community marketplace review; do not describe it as listed in claude-community until Anthropic accepts and publishes it.
| Mode | Use | Notes |
|---|---|---|
| CLI auth state | Local developer machines | Reuses ~/.debugbundle/auth.json when available. |
DEBUGBUNDLE_MEMBER_TOKEN | Headless or marketplace-managed clients | Member tokens are for CLI/API/MCP read and management operations. |
Per-tool bearerToken | Explicit advanced automation | Overrides default auth for that call only. |
| Project token | SDK ingestion only | Do not use project tokens for MCP retrieval or management. |
get_usage_summary, get_route_metrics, get_device_breakdown, get_action_metrics, get_funnel_analysis, and related reads.list_saved_analytics_funnels, create_saved_analytics_funnel, update_saved_analytics_funnel, and archive_saved_analytics_funnel.verify_local, verify_cloud, doctor, smoke, and analyze.For analytics questions, use direct aggregate tools first and generate an AnalyticsBundle only when a bounded analysis needs a durable artifact. The product does not create one bundle per visit.
| Symptom | Check |
|---|---|
| Node.js launch failure | Use Node.js 22.x through 26.x. Configure the client to use a supported node or npx runtime. |
| Missing local auth | Run debugbundle login, or set DEBUGBUNDLE_MEMBER_TOKEN for headless and managed clients. |
| Invalid token | Use a dbundle_mem_ member token. Project tokens are SDK ingestion-only credentials. |
| Wrong API host | Leave DEBUGBUNDLE_API_URL unset for DebugBundle Cloud; set it only for self-hosted or non-default API hosts. |
| Local repo not initialized | Run debugbundle setup before local-only diagnostics, local bundle analysis, or generated project-skill workflows. |
com.debugbundle/mcp.@debugbundle/mcp.Apache-2.0.
FAQs
MCP server for runtime error reporting, incident response, health checks, debug bundles, and product analytics
The npm package @debugbundle/mcp receives a total of 264 weekly downloads. As such, @debugbundle/mcp popularity was classified as not popular.
We found that @debugbundle/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.

Research
/Security News
A Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service.