Is Trace Mcp safe to use?

Trace Mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.

How do I install Trace Mcp?

Trace Mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.

What AI clients work with Trace Mcp?

Trace Mcp is compatible with Claude Desktop, Cursor, Claude Code, and most MCP clients that support stdio transport. It uses stdio transport.

Is Trace Mcp actively maintained?

Trace Mcp is actively maintained — last commit was 1 day ago. It has 20 GitHub stars.

Trace Mcp

Framework-aware code intelligence MCP server — 81 languages, 58 framework integrations, 138 tools, up to 99% token reduction

ActiveNot tested

Other

★ 20GitHub

32DNo CVEsactiveMIT

Quick Install

{
  "mcpServers": {
    "trace-mcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Setup guide

No install config available. Check the server's README for setup instructions.

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/trace-mcp)](https://mcppedia.org/s/trace-mcp)

Should you use this server?

Framework-aware code intelligence MCP server — 81 languages, 58 framework integrations, 138 tools, up to 99% token reduction

✓

Is it safe?

No package registry to scan.

No authentication — any process on your machine can connect.

MIT. View license →

✓

Is it maintained?

Last commit 1 days ago. 20 stars.

Will it work with my client?

Transport: stdio. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.

Loading README…

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Help improve this page

This server is missing a description. Tools and install config are also missing.If you've used it, help the community.

Add information

Score Breakdown

MCPpedia Score

Click each category to see evidence

32D

Last scored 14h ago

How we score →

Security

5/30

No known vulnerabilities.

○

Known CVEs — No package registry to scan

○

Tool safety — No tools to analyze

○

Tool poisoning — No tools to analyze

○

Injection vectors — No tools to analyze

○

Tool stability — First scan — baseline recorded

○

Dependency health — No package to analyze

✓

License — License: MIT

○

Authentication — No authentication required

○

Repository — active repo

CVEs checked daily via OSV.dev. Score algorithm is open source.

Reviews

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Trace Mcp safe to use?: Trace Mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install Trace Mcp?: Trace Mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What AI clients work with Trace Mcp?: Trace Mcp is compatible with Claude Desktop, Cursor, Claude Code, and most MCP clients that support stdio transport. It uses stdio transport.
Is Trace Mcp actively maintained?: Trace Mcp is actively maintained — last commit was 1 day ago. It has 20 GitHub stars.

Similar servers

View all →

Memory MCP Server

OfficialNo CVEs98A

Persistent memory using a knowledge graph

5 toolsstdio84.0k81.6k/wk3d ago

Context Mode

No CVEs95A

Privacy-first. MCP is the protocol for tool access. We're the virtualization layer for context.

6 toolsremote7.4k10.0k/wk3d ago

Idea Reality MCP Server

No CVEs95A

Pre-build reality check. Scans GitHub, HN, npm, PyPI, Product Hunt — returns 0-100 signal.

1 toolsremote60643.6k/wk3d ago

Hash-verified file editing MCP server with token efficiency hook. 11 tools for AI coding agents.

No CVEs95A

Hash-verified file editing MCP server with token efficiency hook. 11 tools for AI coding agents.

5 toolsremote405698.1k/wk1d ago

MCP Security Weekly

Get CVE alerts and security updates for Trace Mcp and similar servers.

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

trace-mcp

Framework-aware code intelligence MCP server — 15 frameworks, 7 ORMs, 13 UI libraries, 23 other integrations (58 total) across 81 languages. Up to 99% token reduction.

Your AI agent reads UserController.php and sees a class. trace-mcp reads it and sees a route → controller → FormRequest → Eloquent model → Inertia render → Vue page → child components — in one graph.

What trace-mcp does for you

You ask	trace-mcp answers	How
"What breaks if I change this model?"	Blast radius across languages + risk score + linked architectural decisions	`get_change_impact` — reverse dependency graph + decision memory
"Why was auth implemented this way?"	The actual decision record with reasoning and tradeoffs	`query_decisions` — searches the decision knowledge graph linked to code
"I'm starting a new task"	Optimal code subgraph + relevant past decisions + dead-end warnings	`plan_turn` — opening-move router with decision enrichment
"What did we discuss about GraphQL last month?"	Verbatim conversation fragments with file references	`search_sessions` — FTS5 search across all past session content
"Show me the request flow from URL to rendered page"	Route → Middleware → Controller → Service → View with prop mapping	`get_request_flow` — framework-aware edge traversal
"Find all untested code in this module"	Symbols classified as "unreached" or "imported but never called in tests"	`get_untested_symbols` — test-to-source mapping
"What's the impact of this API change on other services?"	Cross-subproject client calls with confidence scores	`get_subproject_impact` — topology graph traversal
"Orient me — I just opened this project"	Project identity + active decisions + memory stats in ~300 tokens	`get_wake_up` — layered context assembly

Three things no other tool does:

Framework-aware edges — trace-mcp understands that Inertia::render('Users/Show') connects PHP to Vue, that @Injectable() creates a DI dependency, that $user->posts() means a posts table from migrations. 58 integrations across 15 frameworks, 7 ORMs, 13 UI libraries.
Code-linked decision memory — when you record "chose PostgreSQL for JSONB support", it's linked to src/db/connection.ts::Pool#class. When someone runs get_change_impact on that symbol, they see the decision. MemPalace stores decisions as text; trace-mcp ties them to the dependency graph.
Cross-session intelligence — past sessions are mined for decisions and indexed for search. When you start a new session, get_wake_up gives you orientation in ~300 tokens; plan_turn shows relevant past decisions for your task; get_session_resume carries over structural context from previous sessions.

The problem

AI coding agents are language-aware but framework-blind.

They don't know that Inertia::render('Users/Show', $data) connects a Laravel controller to resources/js/Pages/Users/Show.vue. They don't know that $user->posts() means the posts table defined three migrations ago. They can't trace a request from URL to rendered pixel.

So they brute-read files, guess at relationships, and miss cross-language edges entirely. The bigger the project, the worse it gets.

The solution

trace-mcp builds a *

... View full README on GitHub