
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
mcp-agent-trace-inspector
Advanced tools
npm mcp-agent-trace-inspector package
Local-first, MCP-native observability for agent workflows. Every tool call, prompt transformation, latency, and token count is recorded in a local SQLite database — no cloud account, no API key, no traces leaving your machine. Built specifically for MCP rather than bolted onto a generic LLM proxy.
Tool reference | Configuration | Contributing | Troubleshooting | Design principles
| mcp-agent-trace-inspector | LangSmith / AgentOps | |
|---|---|---|
| Data location | Local SQLite — never leaves your machine | Cloud-hosted; traces sent to external servers |
| Setup | npx one-liner, zero config | Account signup, API key, SDK instrumentation |
| MCP-aware | Native — records tool calls as first-class steps | Generic LLM proxy; MCP structure is opaque |
| Run diffs | Built-in compare_traces diff | Separate paid feature or manual export |
| Cost estimation | Offline tiktoken + configurable pricing table | Requires live API traffic through their proxy |
| Overhead | <5ms per step | Network round-trip per event |
If your traces contain sensitive tool outputs, proprietary prompts, or data that must stay on-device, this is the right tool. If you need cross-team trace sharing or a managed SaaS, use LangSmith.
mcp-agent-trace-inspector stores tool call inputs and outputs locally in a SQLite database. Traces may contain sensitive information passed to or returned from your tools. Review trace contents before sharing dashboard exports. Traces are not automatically transmitted; optional alert webhooks are available.
Add the following config to your MCP client:
{
"mcpServers": {
"trace-inspector": {
"command": "npx",
"args": ["-y", "mcp-agent-trace-inspector@latest"]
}
}
}
To set a custom storage path:
{
"mcpServers": {
"trace-inspector": {
"command": "npx",
"args": [
"-y",
"mcp-agent-trace-inspector@latest",
"--db=~/traces/my-project.db"
]
}
}
}
Amp · Claude Code · Cline · Cursor · VS Code · Windsurf · Zed
Enter the following in your MCP client to verify everything is working:
Start a trace called "test-run", then list the files in the current directory, then end the trace and show me the summary.
Your client should return a summary showing step count, total tokens, and latency.
trace_start — begin a new trace; returns a trace_id for subsequent callstrace_step — record one tool call step (inputs, outputs, optional token count and latency)trace_end — mark a trace as completedlist_traces — list stored traces with names, statuses, and timestampsget_trace_summary — token totals, step count, latency, and cost estimate for a tracecompare_traces — diff two traces side by side (step counts, tokens, latency)extract_reasoning_chain — extract only reasoning/thinking steps from a traceexport_dashboard — generate a self-contained single-file HTML dashboard with latency waterfallexport_otel — export one or all traces in OpenTelemetry OTLP JSON span formatexport_compliance_log — export the compliance audit log as JSON or CSV, with optional date range filteringconfigure_alerts — configure alert rules on latency, error rate, or cost; fire to Slack or generic webhooksset_retention_policy — set how many days to keep traces (in-memory; must be called before apply_retention)apply_retention — archive traces older than the configured threshold; delete traces past 2x the threshold--db / --db-pathPath to the SQLite database file used to store traces.
Type: string
Default: ~/.mcp/traces.db
--retention-daysAutomatically delete traces older than N days. Set to 0 to disable.
Type: number
Default: 0
--pricing-tablePath to a JSON file containing custom model pricing ($/1K tokens). Overrides the built-in table.
Type: string
--no-token-countDisable tiktoken-based token counting. Traces will omit token usage metrics.
Type: boolean
Default: false
Pass flags via the args property in your JSON config:
{
"mcpServers": {
"trace-inspector": {
"command": "npx",
"args": ["-y", "mcp-agent-trace-inspector@latest", "--retention-days=30"]
}
}
}
Before publishing a new version, verify the server with MCP Inspector to confirm all tools are exposed correctly and the protocol handshake succeeds.
Interactive UI (opens browser):
npm run build && npm run inspect
CLI mode (scripted / CI-friendly):
# List all tools
npx @modelcontextprotocol/inspector --cli node dist/index.js --method tools/list
# List resources and prompts
npx @modelcontextprotocol/inspector --cli node dist/index.js --method resources/list
npx @modelcontextprotocol/inspector --cli node dist/index.js --method prompts/list
# Call a tool (example — replace with a relevant read-only tool for this plugin)
npx @modelcontextprotocol/inspector --cli node dist/index.js \
--method tools/call --tool-name list_traces
# Call a tool with arguments
npx @modelcontextprotocol/inspector --cli node dist/index.js \
--method tools/call --tool-name list_traces --tool-arg key=value
Run before publishing to catch regressions in tool registration and runtime startup.
See CONTRIBUTING.md for full contribution guidelines.
npm install && npm test
This plugin is available on:
Search for mcp-agent-trace-inspector.
FAQs
Step-by-step observability for MCP agent workflows
We found that mcp-agent-trace-inspector demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.