DebugMCP — Watchlist | MCP100 Index

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track debugger and VS Code integration as the official tool surface evolves

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Giving coding agents live debugger control over local programs.

What we know

Microsoft-maintained local MCP/VS Code extension and standalone DAP host for breakpoints, stepping, variable inspection and expression evaluation.

Maintenance / activity evidence

Observed Oct 3, 2026 (UTC)Add simple publishing guide and bump extension to 2.4.3 ( 169)

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Debugger/session authority on explicitly configured targets. Writes: Start/stop/restart processes; Pause/step execution; Set breakpoints; Evaluate expressions.
Authentication not yet verified.
Sensitive access: Runtime variables, Debuggee memory/state

Local-only but powerful over the debugged process; evaluate_expression may have side effects in some runtimes.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

526 repository stars

Stars observed Sep 25, 2026.

Do not overwrite existing reviewed stars/download metrics with nulls from this enrichment batch.

All limitations / Review context

Which breakpoints, inspection tools, and VS Code versions remain supported?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Local-only but powerful over the debugged process; evaluate_expression may have side effects in some runtimes.
Debugger/session authority on explicitly configured targets.
README says operation is local with no external communication.
Reviewed write actions: Start/stop/restart processes; Pause/step execution; Set breakpoints; Evaluate expressions
Sensitive access: Runtime variables, Debuggee memory/state
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Debugger control can affect program execution state.
Standalone CLI requires explicitly configured DAP adapters.
Evaluate-expression semantics depend on the debugger/language.

Original activity observations

2026-10-03T10:59:34Z: Add simple publishing guide and bump extension to 2.4.3 ( 169)

Technical identity

github.com/microsoft/debugmcp

Exact implementation source: https://github.com/microsoft/debugmcp ↗
Reviewed resource type: Testing / Debugging
Repository identity: microsoft/debugmcp
Package identity: npm:debugmcp
Service endpoint: VS Code extension local endpoint is configurable; standalone CLI uses stdio

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 7, 2026

GitHub repository ↗
microsoft/debugmcp
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Testing / Debugging setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher current standalone CLI: `npm install --global debugmcp`, then `debugmcp configure --agent copilot-cli` (supported agent example). Alternative VS Code DebugMCP extension must be installed via Marketplace, not npm CLI alone.
package install · Publisher instructions
npm install --global debugmcp
Configure / authenticate
Publisher instructions
DebugMCP supports VS Code extension and standalone npm debugmcp CLI. CLI configure uses explicit DAP adapters; debugger operations can alter process state and are not safe smoke tests.
Check connection
Suggested check
Check extension discovery or debugmcp adapter list, not start/step debugger.
Remove / uninstall / revoke
MCP100 setup guide
Remove MCP/skill created by `debugmcp configure` in its target agent separately; VS Code extension is removed in Extensions if used. CLI removal alone does not undo agent config.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.
npm uninstall --global debugmcp

Official Documentation & Sources

What it does

Microsoft-maintained local MCP/VS Code extension and standalone DAP host for breakpoints, stepping, variable inspection and expression evaluation.

Capability: Developer Tools
Resource type: Testing / Debugging
Best fit: Giving coding agents live debugger control over local programs.

Representative uses

Start/stop/restart debug sessions
Set/remove breakpoints/logpoints
Step/pause/continue execution
Inspect named variables and evaluate expressions

Limitations

Debugger control can affect program execution state.
Standalone CLI requires explicitly configured DAP adapters.
Evaluate-expression semantics depend on the debugger/language.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not documented in the reviewed sources
Permissions: Debugger/session authority on explicitly configured targets.
Data handling: README says operation is local with no external communication.
Cost: free
Risk and cautions: Local-only but powerful over the debugged process; evaluate_expression may have side effects in some runtimes.

Access scope and cautions

Write actions: Start/stop/restart processes Pause/step execution Set breakpoints Evaluate expressions
Sensitive access: Runtime variables Debuggee memory/state
Risk level: moderate

FAQ

Based on reviewed evidence as of 2026-10-07. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Start/stop/restart debug sessions; Set/remove breakpoints/logpoints; Step/pause/continue execution; Inspect named variables and evaluate expressions.

What authentication is documented?

No remote credentials documented; local-only operation.

Can it modify data or perform write operations?

Documented write actions include: Start/stop/restart processes; Pause/step execution; Set breakpoints; Evaluate expressions. Recorded permission boundary: Debugger/session authority on explicitly configured targets.

What data-handling boundary should I consider?

README says operation is local with no external communication. Recorded sensitive-access context: Runtime variables; Debuggee memory/state.

What limitations and risks should I check before use?

Local-only but powerful over the debugged process; evaluate_expression may have side effects in some runtimes. Debugger control can affect program execution state. Standalone CLI requires explicitly configured DAP adapters. Evaluate-expression semantics depend on the debugger/language. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

Microsoft is listed as First-party MCP in MCP100’s current evidence.