
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@perfonext/profiler-mcp
Advanced tools
MCP server for loading and analyzing V8 and Chrome CPU profiles for GitHub Copilot and other MCP clients
Analyze V8 and Chrome CPU profiles to find hotspots in Next.js servers and scripts.
perfonext-profiler-mcp is a Model Context Protocol (MCP) server that gives GitHub Copilot, Claude Desktop,
Claude Code, and other MCP clients structured CPU profiling data for Next.js performance work. It loads V8 and
Chrome CPU profiles and turns them into hotspot rankings, per-package costs, and source-annotated hot lines —
evidence agents can reason over instead of ingesting multi-megabyte profile dumps.
perfonext-profiler-mcp is a standard MCP stdio server, so it works with any MCP-compatible client
(GitHub Copilot in VS Code, Claude Desktop, Claude Code, Cursor, and others). Run it directly with npx:
npx -y @perfonext/profiler-mcp
Or install globally:
npm install -g @perfonext/profiler-mcp
The executable command remains perfonext-profiler-mcp after installation.
Add the server to .vscode/mcp.json (the workspace MCP configuration file):
{
"servers": {
"perfonext-profiler": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@perfonext/profiler-mcp"]
}
}
}
Reload the VS Code window and run MCP: List Servers to start it, or accept the trust prompt when it appears.
Add the server to claude_desktop_config.json:
{
"mcpServers": {
"perfonext-profiler": {
"command": "npx",
"args": ["-y", "@perfonext/profiler-mcp"]
}
}
}
Restart Claude Desktop to pick up the new server.
Add the server with the CLI:
claude mcp add perfonext-profiler -- npx -y @perfonext/profiler-mcp
Or add the same mcpServers entry to .mcp.json.
Any client that supports stdio MCP servers can launch npx -y @perfonext/profiler-mcp. Consult your
client's documentation for its MCP server configuration format.
For a locally-built checkout, point command/args at node and the repo's dist/index.js instead.
spawn npx ENOENT / spawn node ENOENT on macOS with nvmIf the server fails to start with this error, your GUI MCP client likely cannot see nvm. GUI apps on
macOS do not load shell config (.zshrc/.bashrc), so nvm-installed npx/node are not on PATH.
Use an absolute npx path and include the same Node directory in PATH:
{
"servers": {
"perfonext-profiler": {
"type": "stdio",
"command": "/Users/YOU/.nvm/versions/node/v<version>/bin/npx",
"args": ["-y", "@perfonext/profiler-mcp"],
"env": {
"PATH": "/Users/YOU/.nvm/versions/node/v<version>/bin:/usr/bin:/bin"
}
}
}
}
Merge these fields into your client's server entry, under servers for VS Code or mcpServers for
Claude Desktop/Code. Then ask your assistant: "How do I capture a CPU profile of my Next.js server?"
.cpuprofile files and Chrome trace exports that contain CPU profile data| Tool | Description |
|---|---|
how_to_collect | Return a ready-to-run command and step-by-step recipe for capturing a .cpuprofile, then loading it. Use this when you don't have a profile yet |
load_profile | Parse and load a .cpuprofile file or Chrome trace export from disk |
get_hotspots | Find top functions by self-time. Each entry includes a package field identifying the npm package or (user code) |
explain_function | Explain a function's timing, callers, and callees. Pass includeSource: true to attach annotated source lines |
read_source_context | Read the actual source file for a hot function and annotate each line with tick counts from positionTicks |
get_package_costs | Aggregate CPU self-time by npm package — shows which dependencies are most expensive |
compare_profiles | Compare two profiles and highlight regressions |
suggest_optimizations | Generate structured, multi-pattern optimization suggestions for hot functions. Detects high fan-in, recursion, dominant callers, and V8-specific patterns. Deduplicates functions split across multiple call sites |
get_profile_summary | Summarize one profile or list all loaded profiles |
Every tool result carries a nextStep breadcrumb pointing at the natural follow-up call, so an MCP client can walk the collect → analyze → fix loop without guessing.
./profile.cpuprofile and show me the top hotspots."processData is expensive in the loaded profile."processData and mark which lines are hottest."transformResult and include the annotated source code."how_to_collect details// Input
{ "scenario": "next-server" } // or "script"; defaults to "next-server"
// Output
{
"scenario": "next-server",
"summary": "Profile a production Next.js server while it handles a single request. ...",
"command": "node --cpu-prof --cpu-prof-dir=./.perf-profiles ./node_modules/next/dist/bin/next start",
"steps": [ "...", "load_profile({ filePath: \"./.perf-profiles/<file>.cpuprofile\" })" ],
"outputDir": "./.perf-profiles",
"nextStep": "After stopping the server, call load_profile with the .cpuprofile ..."
}
next-server profiles a production Next.js server while it serves a single request. If next start says standalone output is unsupported, use the script scenario with .next/standalone/server.js. script profiles that standalone server (or another Node entry). Keep the scenario to one route and one hit. Node writes one .cpuprofile per process/worker thread into the output directory. The Next server command uses Node CLI flags (not NODE_OPTIONS) so it is the same on Unix and Windows.
read_source_context details// Input
{ "profileId": "<id>", "functionName": "myFn", "contextLines": 10 }
// Output (per line)
{
"lineNumber": 42,
"content": " for (let i = 0; i < items.length; i++) {",
"ticks": 18, // V8 samples that landed on this line
"isHot": true // true when ticks >= 50% of peak ticks for this function
}
The returned window is sized to cover the function's actual hot lines, not just a fixed radius
around its declaration — a function's real bottleneck is often well past its function line.
contextLines (default 10) sets the minimum padding around both the declaration and the hot
lines; if any ticks still fall outside the returned window, the top-level result includes
hiddenTicks (a count) and a warning telling you to retry with a larger contextLines.
explain_function also accepts contextLines when called with includeSource: true.
Only files inside the current working directory can be read. file:// URLs and absolute paths are both handled; http://, node: builtins, and paths outside the project root are rejected.
suggest_optimizations details// Input
{ "profileId": "<id>", "limit": 5 }
// Output (per function)
{
"function": "processData",
"file": "file:///app/src/processor.js",
"line": 10,
"selfPercent": "18.2%",
"patterns": [
{
"pattern": "high-fan-in",
"detail": "Called from 6 distinct call sites (e.g. renderRow, buildTree, …)",
"suggestion": "This function is a shared hot path. Ensure it is well-optimised and monomorphic …"
},
{
"pattern": "hot-caller",
"detail": "84% of calls come from \"renderRow\"",
"suggestion": "Focus optimisation effort on \"renderRow\" rather than this function …"
}
],
"topSuggestion": "This function is a shared hot path …"
}
Patterns detected (multiple can fire for the same function):
| Pattern | Trigger |
|---|---|
gc-pressure | Function name matches GC/Scavenge/MarkCompact |
json-serialization | JSON.parse / JSON.stringify |
regex-cost | RegExp / exec / test calls |
v8-deopt | Compile / Recompile / Optimize / Deoptimize |
high-fan-in | ≥ 3 distinct parent call sites |
recursion | Function appears in its own descendant sub-tree |
hot-caller | One caller accounts for ≥ 80% of call-site occurrences |
cpu-bound | Fallback when no other pattern matches |
Functions that appear at multiple call sites are automatically merged before ranking so the same logical function is only reported once.
get_package_costs details// Input
{ "profileId": "<id>", "limit": 10 }
// Output (per package)
{
"rank": 1,
"package": "lodash",
"selfTime": "42.3ms",
"selfPercent": "14.1%",
"totalTimeIncludingCallbacks": "58.0ms",
"totalPercentIncludingCallbacks": "19.3%",
"topFunctions": [
{ "function": "chunk", "file": "lodash/chunk.js", "line": 41, "selfTime": "28.0ms", "selfPercent": "9.3%" }
]
}
selfTime is the time spent inside the package's own code. totalTimeIncludingCallbacks also counts everything the package called into — including your own callbacks handed back to it — so it can exceed what removing the package would actually save.
Scoped packages (@babel/core, @next/env, etc.) are handled correctly. User code and native builtins (no node_modules in the path) are excluded.
Ask Copilot to call how_to_collect for a ready-to-run recipe, or generate one manually:
Next.js production server (profile a single request):
node --cpu-prof --cpu-prof-dir=./.perf-profiles ./node_modules/next/dist/bin/next start
# hit the route once, then stop the process so it can exit and write the profile
If next start reports that standalone output is unsupported:
node --cpu-prof --cpu-prof-dir=./.perf-profiles .next/standalone/server.js
Chrome DevTools:
.cpuprofile export.npm install
npm run build
npm test
The repository already includes sample fixtures under tests/fixtures/ for local validation.
MIT
FAQs
MCP server for loading and analyzing V8 and Chrome CPU profiles for GitHub Copilot and other MCP clients
The npm package @perfonext/profiler-mcp receives a total of 46 weekly downloads. As such, @perfonext/profiler-mcp popularity was classified as not popular.
We found that @perfonext/profiler-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.