TracePulse (sourjya/tracepulse) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 44 tools. No publisher has claimed this listing.
Runtime feedback MCP server for AI coding agents. It watches dev server logs, parses errors, and exposes them as MCP tools so AI agents can instantly verify code changes.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
sourjya
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
get_errorsGet recent error and warning events sorted by signal_score descending.
get_server_logsGet recent log events at any severity level sorted by timestamp descending.
get_runtime_statusQuick health check - connection state, error count, last error time.
clear_errorsClear events from the buffer. Pass fingerprint to clear a specific error, or omit to clear all.
acknowledge_errorMark an error as investigated. Acknowledged errors are excluded from get_errors results. Saves tokens by preventing re-investigation.
watch_for_errorsWatch N seconds for new errors after a code change. Returns events + hot_reload_detected.
get_build_errorsGet current build/compilation errors (TypeScript, ESLint, Vite/webpack). Returns only errors with source 'build-error'.
get_error_clustersGroup errors by type + module path. See patterns across the codebase.
get_migration_statusCheck or apply database migrations. Auto-detects alembic/prisma/django/knex. Pass apply=true to run pending migrations.
get_audit_trailReview your own MCP tool usage this session. Shows which tools were called, when, with what params, and response sizes. Use to optimize your workflow.
get_session_insightsAnalyze agent effectiveness: uninvestigated errors, verification gaps, tool usage patterns, parser stats. Use at end of session.
check_driftCheck for env, dependency, and migration drift in one call. Detects missing .env vars, lock files, and migration frameworks.
get_session_impactEnvironmental report: tokens saved, energy saved (Wh), CO2 saved (g). Shows the impact of using TracePulse this session.
get_session_summaryCompact session manifest: errors seen/acknowledged/pending, build status, tool count. ~200 tokens. Use after context compaction.
get_perf_baselinePer-endpoint response time percentiles (P50, P95, max) from HTTP access logs. Use to detect performance regressions after code changes.
get_error_contextDeep-dive into a specific error by fingerprint. Returns the full error, surrounding logs (±5s), and occurrence count.
get_timelineGet a unified chronological stream of ALL events in a time window. Use for full situational awareness.
list_servicesList all monitored services with status, error count, and last activity.
get_correlated_errorsMatch browser HTTP failures with backend stack traces. Returns paired errors with confidence scores.
get_new_errorsGet only errors with fingerprints not seen in previous sessions. Use `since` (Unix ms) to scope to a specific time window — e.g., pass the timestamp from when a smoke test started to see only errors that appeared during that test run.
get_error_trendsCross-session frequency and history for a specific error fingerprint.
correlate_with_diffLink recent errors to uncommitted git changes. Shows which errors may be caused by your recent edits.
get_cross_layer_diagnosisCross-layer failure diagnosis. Correlates backend logs, frontend errors, git state, and process state to identify root causes that span multiple layers.
get_health_summaryOne-line health check: error count, warning count, total events, uptime. Use instead of calling get_runtime_status + get_errors + get_server_logs separately.
verify_fixPost-fix check: watch + build + errors in one call. Returns pass/fail verdict.
verify_loopComposite fix verification: checks new errors, pinned fingerprint resolved, build clean, HMR detected. Returns confidence-scored verdict (high/medium/low). Collapses 5-7 calls into 1.
get_prompt_contextPre-assembled reasoning packet for an error: message + stack + surrounding logs + file context. Token-budgeted. One call instead of 4-5.
verify_buildType-check + build + runtime error check in one call. Replaces 3 separate tool calls.
wait_for_buildBlock until next build/hot-reload completes. Event-driven, no polling.
wait_for_eventBlock until the next event of a specific type arrives. Types: error, warning, build, crash, any.
run_and_watchRun a command, parse output through 26 parsers, return structured pass/fail results. Use INSTEAD OF shell for tests, builds, and linters. If timeout occurs, increase timeout_seconds (up to 120). Never fall back to shell for commands that produce pass/fail output.
get_requestsGet recent HTTP requests from access logs. Filter by URL path and status code. Shows method, path, status, and timing.
restart_serverKill and respawn the dev server process. Only works in start mode. Use after installing dependencies, changing config, or when the server is stuck.
get_infra_statusSummary of all discovered backend services (databases, Redis, queues) with connectivity status. Reads from .env files, probes every 60s.
get_infra_detailDetailed status for a specific infrastructure service including connection history. Use after get_infra_status to investigate an unreachable service.
check_portCheck if TCP port(s) are available or in use on localhost. Accepts single port or array.
free_portKill the process occupying a port. Use when start_server fails because a port is in use from a crashed previous session. Do not use shell with lsof/kill — this tool does it safely.
get_project_healthComposite health check: server status + infrastructure connectivity + error count + build status in one call. Use as the first call in any debugging session.
verify_mcpTest that an MCP server starts and responds to the initialize handshake. Sends the same JSON-RPC message that Kiro/Claude/Cursor sends on connect. Use after changing MCP server code, imports, or dependencies.
register_probeRegister a health probe for a critical endpoint. TP will check it periodically and alert on failure. Use after building a new API route.
list_probesList all registered health probes with their latest results (pass/fail/error).
get_bug_patternsAnalyze cross-session error patterns: recurring bugs, velocity changes, error chains, flaky errors, regressions. Requires persistence (default).
start_serverStart a dev server for live error monitoring. Pre-validates the command and returns diagnostics if invalid. Use when TracePulse started without a server command. On failure, use run_and_watch with the same command to see full error output — do not fall back to shell.
stop_serverStop a running dev server. Sends SIGTERM, waits, then SIGKILL if needed.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
DASHBOARD_URLTP_TOOL_MODETRACEPULSE_VERSIONTool inputs are validated
31/44 tool handlers declare input schemas (70%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 0/44 tool handlers wrap calls in try/catch (0%)
Wrap each tool handler body in try/catch and return a structured error response.
Tool test coverage
Only 11/44 tools referenced in tests (25%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
15 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sourjya/tracepulse)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check