
Security News
Agent Baseline Publishes Security Reference Architecture for Software Factories
Agent Baseline’s new reference architecture shows how to secure software factories with four boundaries enforced outside the AI agent.
flutter-lamp
Advanced tools
Flutter Lamp — an MCP server giving AI live eyes on a running Flutter app over the Dart VM Service: exceptions, logs, network, frames, memory + root-cause diagnosis.
An MCP server that connects Claude Code, Claude Desktop, Cursor, Codex & Gemini directly to a running Flutter app through the Dart VM Service Protocol — streaming exceptions, logs, network calls, frame timings and memory as structured data, plus an evidence-first root-cause diagnosis engine and a live browser dashboard.
Today you debug Flutter with your AI by copy-pasting stack traces, flutter run
output and DevTools screenshots. The AI is blind between messages.
Flutter Lamp makes the AI runtime-aware. It reads the app's live state over official Flutter/Dart APIs (never scraping DevTools), so instead of "paste the error" the AI can ask the app "what just happened, and why?"
❌ You: *pastes 40 lines of red stack trace*
✅ AI: connect_vm → get_exceptions → diagnose_runtime
→ "RenderFlex overflow in Column at home.dart:42, triggered right after
GET /api/user returned 500. Confidence 85%. Fix: …"
dart:developer)dart:io profiling — covers Dio & package:http, no interceptor neededdiagnose_runtime — correlates evidence into summary · root cause · evidence · confidence · fixes; says "Unknown" below 70% instead of hallucinatinghttp://127.0.0.1:7373 — streams everything over WebSocket, independent of the AI connectionflutter-runtime-diagnosis Claude Code skill| Tool | Purpose |
|---|---|
connect_vm | Connect to a running app's Dart VM Service (ws:// or http://). |
runtime_status | Health check — connection + captured-event counts + dashboard URL. |
get_logs | Console + dart:developer logs (filter by severity / source / text). |
get_exceptions | Framework & unhandled exceptions with stack traces. |
get_frames | Frame build/raster timings; onlyJanky filter. |
get_network | HTTP requests (Dio & package:http); headers + timing on failures. |
get_widget_tree | Widget-tree snapshot from the Flutter Inspector. |
get_selected_widget | Widget currently selected in the Inspector. |
get_memory | Dart heap + external memory (MB). |
get_timeline | Recent VM timeline events (build/paint/layout/GC). |
diagnose_runtime | Correlated root-cause diagnosis with confidence + fixes. |
get_dashboard_url | URL of the live browser dashboard. |
Requires Node ≥ 20.
git clone https://github.com/itsonu/flutter-lamp.git
cd flutter-lamp
npm install
npm run build
Run it standalone (stdio):
node dist/index.js
Add the server to your MCP client config, then restart the client.
Claude Code — .mcp.json in your project (or claude mcp add):
{
"mcpServers": {
"flutter-lamp": {
"command": "node",
"args": ["/absolute/path/to/flutter-lamp/dist/index.js"]
}
}
}
Cursor (~/.cursor/mcp.json) and Claude Desktop
(claude_desktop_config.json) use the same mcpServers shape.
Optional environment variables:
| Var | Default | Meaning |
|---|---|---|
DASHBOARD_PORT | 7373 | Dashboard HTTP/WS port. |
DASHBOARD_HOST | 127.0.0.1 | Bind address (localhost only by default). |
DASHBOARD_DISABLE | — | Set to 1 to disable the dashboard. |
Run your Flutter app in debug/profile mode:
flutter run
Copy the line it prints:
A Dart VM Service on <device> is available at: http://127.0.0.1:PORT/TOKEN=/
Tip:
flutter run --vm-service-port=8181gives a stable URI across restarts.
Ask your AI to connect and diagnose — e.g. "connect to my Flutter app at
<uri> and tell me why it's throwing." With the bundled skill, Claude Code
runs the whole flow (connect → gather → diagnose_runtime) automatically and
never asks you to paste logs when the VM Service is reachable.
Open http://127.0.0.1:7373 in a browser for the live dashboard — it runs alongside the AI, not instead of it.
A zero-dependency dark UI (native HTTP + WebSocket, no build step) that streams runtime data as it happens:
Overview (connection · FPS · memory · event counts) · Logs (search / filter / auto-scroll) · Network (expandable headers & timing) · Exceptions (expandable stack traces) · Timeline · Performance (live canvas charts) · Inspector.
Controls: pause/resume · clear view · export JSON · per-tab search · auto-reconnect.
Running Flutter app
│ Dart VM Service Protocol (JSON-RPC over WebSocket)
▼
VmService client ──▶ Collectors (log · exception · frame · network · …)
│
▼
RuntimeStore (one centralized, capped event stream;
every event: timestamp · source · severity · category)
│ │
┌──────────┘ └──────────┐
▼ ▼
MCP tools (stdio) Dashboard (HTTP + WebSocket)
→ Claude Code / Cursor / … → your browser
Everything flows through one event store. Adding a new runtime source =
implement the Collector interface and register it — no other layer changes.
Design principles: official Flutter/Dart APIs only, structured JSON over text,
never scrape DevTools, and never claim a cause the evidence doesn't support.
dart:io HTTP
profiling are not available in release builds.dart:io HTTP,
so requests are fetched when get_network or diagnose_runtime runs — not
streamed continuously.Debug.PauseException needs pause-on-exception enabled in the app to fire.
Framework errors (Flutter.Error) are always captured regardless.get_network.127.0.0.1 by default. Change DASHBOARD_HOST only on a
network you trust — runtime data is served unauthenticated.Shipped: VM connect, logs, exceptions (with stacks), network, frames, widget tree, memory, timeline, diagnosis, live dashboard.
Next: deeper correlation (memory/timeline into diagnose_runtime), CPU
sampling & leak heuristics, Riverpod/Bloc state, navigation, knowledge graph,
auto-fixes. See docs/Phases.md.
npm run build # compile TypeScript → dist/
npm run watch # incremental compile
npm test # node:test suite (engine + collectors + dashboard)
npm test runs the compiled output, so build first. It relies on glob support in
node --test, which needs Node ≥ 21 — the server itself runs on Node ≥ 20.
Docs in docs/ are the source of truth (PRD, Architecture, Rules,
Phases, Design, Memory).
Issues and PRs welcome. Keep it modular, prefer official APIs over hacks, and
add a node:test check for any non-trivial logic.
MIT © Chandrabhushan Prakash
FAQs
Flutter Lamp — an MCP server giving AI live eyes on a running Flutter app over the Dart VM Service: exceptions, logs, network, frames, memory + root-cause diagnosis.
The npm package flutter-lamp receives a total of 41 weekly downloads. As such, flutter-lamp popularity was classified as not popular.
We found that flutter-lamp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Agent Baseline’s new reference architecture shows how to secure software factories with four boundaries enforced outside the AI agent.

Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.

Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.