M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
D

DebugMCP

Official
Gift your VS Code agent a real debugger: breakpoints, stepping, inspection.
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #95 of 438
Stars
★ 579 Very popular
Transport
Streamable HTTP
Runtime
Prebuilt binary VS Code 1.104.0+
Credentials
No credential needed
License
MIT
Last commit
Tools
16
62FMRS · C

DebugMCP is a Microsoft-maintained VS Code extension and MCP server that hands real debugger capabilities (breakpoints, stepping, variable inspection, expression evaluation) to AI coding agents. It runs entirely locally, works out of the box, supports major MCP clients and many languages, and exposes 16 debugging tools while limiting its attack surface with loopback-only binding, Host/Origin validation, least-privilege variable reads, and secret redaction. It suits developers doing interactive, agent-driven debugging in VS Code; it is not intended for non-VS Code environments, networked debug endpoints, or cloud-hosted debugging.

Strongest · Documentation 15/20 Weakest · Reliability 9/20

Reliability
9/20
Security and permissions
13/20
Maintenance
12/20
Documentation
15/20
Setup experience
13/20
Why each score
Reliability 9/20
Only the README is available: no server manifest ([not cached]), no package.json/source, no CI workflows and no committed tests. The README documents 16 tools with parameters, port/timeout settings, and troubleshooting for port conflicts, missed breakpoints and multi-window focus stealing, and states start_debugging with testName uses the VS Code Testing API, so the happy path is plausible. However tool behavior, the MCP init/tool-list handshake and error handling cannot be verified from evidence; there are no reproducible tests or diagnosable failure paths. Applying the static cap of 12, a conservative 9 is given.
Security and permissions 13/20
The README's security-model section documents four controls: loopback-only binding by default (127.0.0.1/::1), Host/Origin header validation returning 403 to block DNS rebinding, least-privilege get_variables_values requiring an explicit list (max 50, no wildcards), and always-on secret redaction (<redacted: possible secret>, recursive expansion capped at 100 fields per response), plus an explicit warning that changing bindHost exposes the unauthenticated debugger. No malware, exfiltration, hardcoded real tokens, or destructive defaults appear, and sensitive data flow is disclosed. Deductions: the endpoint has no authentication/authorization at all, so any local process (or a page that gets past header checks) could invoke high-privilege primitives such as evaluate_expression and start_debugging; dangerous operations carry no explicit confirmation; and every control is self-reported README text with no source or test corroboration. No red line is crossed, so it does not fall to 0-4.
Maintenance 12/20
Ownership is explicit (maintainer emails and author credits), license is MIT, version 2.3.5 with a 2.2 changelog referencing a fixed issue (#105), plus a CLA, Code of Conduct and an aka.ms/SECURITY.md reporting channel — governance essentials are present; the 498 stars and 39 open issues are treated only as discovery signals and add nothing. Deductions: only the README exists here, with no commit history, release cadence, dependency list or update evidence, so sustained maintenance and dependency risk cannot be verified; 39 open issues is a nontrivial backlog whose responsiveness is unverifiable. Score 12.
Documentation 15/20
Documentation is layered: three install paths (direct link, Marketplace, in-editor search); copy-paste MCP registration examples for Copilot, Copilot CLI, Cursor, Codex, Cline, Windsurf, Roo Code and Antigravity; a tool table with parameters and required flags; three extension settings with defaults; supported languages with their required debugger extensions; FAQ and troubleshooting (including debug.focusWindowOnBreak advice); an architecture diagram and request flow; and clear local-only/no-upload statements. Deductions: no server manifest to cross-check against, no concrete response/error examples, redaction described only by shape with no sample, no reviewable end-to-end debug-session transcript, and several per-client sections are repeated templates rather than verified results. Score 15.
Setup experience 13/20
The install path is short and clear: install from the VS Code Marketplace, the extension auto-activates and registers the MCP server at http://localhost:3001/mcp, with copy-ready config snippets per mainstream client (Codex also gets a codex mcp add command), a manual-registration fallback, Remote SSH/Codespaces/WSL support via extensionKind: workspace, and no launch.json required. Deductions: it depends on local VS Code plus each language's debugger extension (Python, Java, C/C++, Go, Rust, PHP, Ruby with the debug gem, etc.); cross-client setup still requires manual paste; port conflicts require editing both the extension setting and client config; and automatic registration success cannot be verified from the files. With no CI/tests as execution evidence, it stays under the static cap of 15, at 13.

Static review · not runListed 2026-09-18

Read the FMRS scoring method →

Fit and risk

What it can accessReads local filesRuns commands or code

Best for

  • Developers using AI coding agents in VS Code who want real debugging capability
  • Scenarios needing automated root-cause analysis instead of reading logs
  • Users working in VS Code Remote SSH, Codespaces, or WSL remote environments
  • Teams wanting one unified debugging tool across many programming languages

Not for

  • Users who do not use VS Code or any MCP-compatible AI assistant
  • Scenarios that need to expose the debugging service to other machines on a network (loopback-only by default; rebinding carries unauthenticated risk)
  • Users who will not install the corresponding VS Code debugger extension for their language
  • Users expecting an externally hosted or cloud-based debugging service (the extension runs locally only)

Required permissions

  • Listen on an HTTP port on loopback addresses (127.0.0.1 and ::1), default 3001, configurable via debugmcp.serverPort
  • Read the source files being debugged and any .vscode/launch.json configuration in the project
  • Call the VS Code Debug API to start/stop debug sessions, set breakpoints, and step through code
  • Read variable values in debug context and evaluate expressions (with secret redaction applied)
  • Install the debug-live skill file into standard skills directories (~/.agents/skills/, plus ~/.copilot/skills/ when present)

Risks and side effects

  • The MCP endpoint is unauthenticated by default, so any local process that can reach the loopback port can call powerful debugger primitives such as evaluate_expression
  • Changing debugmcp.bindHost to 0.0.0.0 or a LAN address exposes the unauthenticated debugger to anything that can route to that address
  • Evaluating expressions through the debugger can have side effects depending on the debugged program, and agent auto-approval reduces human confirmation
  • Variable redaction relies on names and credential shapes, so it can miss secrets; null-ish values are deliberately not redacted, which may leak sensitive data in edge cases
  • The extension modifies AI assistant MCP registration configuration (with a prompt)

Setup

Before you start

Runtime：Prebuilt binary VS Code 1.104.0+

  1. Install the DebugMCP extension in VS Code: search "DebugMCP" in the VS Code Marketplace, or use the direct link vscode:extension/ozzafar.debugmcpextension, or install it from the Extensions view.
  2. The extension activates automatically and starts the MCP server on local port 3001.
  3. A popup offers to auto-register the MCP server with your AI assistant; you can also run "DebugMCP: Show Agent Selection Popup" from the Command Palette.
  4. For manual setup, add a Streamable HTTP server pointing at http://localhost:3001/mcp in your assistant's MCP settings (per-client formats are documented in the README).
  5. Enabling auto-approval for all debugmcp tools is recommended for a seamless debugging workflow.
  6. Make sure the VS Code debugging extension for your target language is installed (e.g. Python, C#, etc.).
cline_mcp_settings.json 
{
  "mcpServers": {
    "debugmcp": {
      "type": "streamableHttp",
      "url": "http://localhost:3001/mcp",
      "description": "DebugMCP - Debugging tools for AI assistants"
    }
  }
}

Shown for Cline. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "debugmcp": {
      "type": "streamableHttp",
      "url": "http://localhost:3001/mcp",
      "description": "DebugMCP - Debugging tools for AI assistants"
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add --transport http debugmcp http://localhost:3001/mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

After installing the extension, confirm the MCP server is running on port 3001 and the client tool list shows start_debugging and the other debug tools; have the assistant add a breakpoint and start a debug session to prove the connection.

Troubleshooting

  1. AI assistant cannot connect: check whether port 3001 is in use, switch to another port and update the client config; restart VS Code and confirm the extension is activated
  2. Breakpoints are not hit: verify the correct file and line number, and that the VS Code debugger extension for that language is installed
  3. The debugged window takes focus with multiple VS Code windows open: disable debug.focusWindowOnBreak and debug.focusEditorOnBreak in settings
  4. Extension does not prompt to register: run "DebugMCP: Show Agent Selection Popup" from the Command Palette, or add the MCP config manually per the README
  5. Migrating from the older SSE transport: the extension automatically migrates configuration to Streamable HTTP on activation

Things to try

Once connected, you can ask your AI assistant things like:

  • Set a breakpoint at line 42 of src/app.py and start debugging that file
  • Step into the current function and list the local variable names
  • Evaluate the expression user.session.token in the debug context
  • Debug the test method test_login and find out where it fails

Tools 16

start_debugging writes
Start a debug session for a source code file (optional working directory, test name, configuration name)
stop_debugging writes
Stop the current debug session
step_over writes
Execute the next line, stepping over function calls
step_into writes
Step into function calls
step_out writes
Step out of the current function
continue_execution writes
Continue until the next breakpoint
pause_execution writes
Interrupt a freely-running program and stop at its current location, no breakpoint needed
restart_debugging writes
Restart the current debug session
Show 8 more tools
add_breakpoint writes
Add a breakpoint at a specific line, optionally conditional
add_logpoint writes
Add a logpoint that logs a message instead of pausing when the line is reached ({expr} interpolation)
remove_breakpoint destructive
Remove a breakpoint from a specific line
clear_all_breakpoints destructive
Remove all breakpoints at once
list_breakpoints read-only
List all active breakpoints
list_variable_names read-only
List names and types of variables in scope without reading any values
get_variables_values read-only
Get values of specifically named variables at the current execution point (max 50, no wildcards)
evaluate_expression read-only
Evaluate an expression in debug context; expandable children list name and type only

Use cases

Letting an AI agent set breakpoints and step through execution to locate runtime defects
Inspecting runtime variable values and expressions without adding logging
Debugging unit tests by passing a testName to pause inside a specific test case
Pausing and inspecting a freely-running program such as a busy loop or embedded target
Interactive debugging across multi-language projects (Python, JS/TS, Java, C/C++, Go, Rust, PHP, Ruby, C#/.NET)

Supported clients

GitHub Copilot
GitHub Copilot CLI
Cline
Cursor
Codex
Windsurf
Roo Code
Antigravity

Listed from the project's documentation, not tested by this site.

Overview

DebugMCP is a Microsoft-maintained VS Code extension that also runs as an MCP server, giving AI coding agents direct control over the VS Code debugger. Agents can autonomously set breakpoints, launch debug sessions, step through code line by line, inspect variable values, and evaluate expressions, just like a human developer. It runs 100% locally, requires zero configuration, works out of the box with any MCP-compatible assistant, and supports any VS Code supported coding language (Python, JavaScript/TypeScript, Java, C/C++, Go, Rust, PHP, Ruby, C#/.NET). The server listens over Streamable HTTP on loopback (default port 3001), auto-detects and offers to register itself with GitHub Copilot, GitHub Copilot CLI, Cline, Cursor, Codex, Windsurf, Roo Code, Antigravity, and other clients, and can also be configured manually. Security controls include loopback-only binding, Host/Origin header validation, least-privilege variable inspection, and secret redaction, with no debug data leaving the machine. Procedural debugging guidance ships as the companion debug-live Agent Skill, installed into standard skills directories.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 64.1k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision d0b4a334a6a3 Data synced 2026-11-02 Read the FMRS scoring method