I
io.github.aryanduntley/pwa-debug-layer
pnpm
Debug PWAs in your real browser via MCP: service-worker, cache, installability & framework state.
No known CVEs
MIT license
Maintained
Last commit 62d ago
Works with most clients
Transport: stdio, sse, http
10 tools · ~631 tok
Grade B · 0.3% of 200K ctx
MCPpedia last refreshed this data
io.github.aryanduntley/pwa-debug-layer is an MCP server that debug PWAs in your real browser via MCP: service-worker, cache, installability & framework state. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 82/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients — only the file and path differ.
CD
Supported in Claude Desktopstdio, sse, http · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"pwa-debug": {
"args": [
"/absolute/path/to/pwa-debug-layer/packages/host/dist/main.js"
],
"type": "stdio",
"command": "node"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/io-github-aryanduntley-pwa-debug-layer)
Read me
What io.github.aryanduntley/pwa-debug-layer does
An AI-native debugging layer for PWAs and modern web apps. It lets an AI agent (e.g. Claude Code via MCP) see and act on your live, logged-in browser the way a developer with full DevTools open would — DOM, console, network, framework state, store state, service workers, caches, and direct interaction — as structured data the model consumes natively.
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y 'pnpm' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Scored, not listed
Why this score
Five weighted categories — click any category to see the underlying evidence.
Score breakdown
82/100across 5 weighted dimensions
0255075100
29
12
16
15
10
−18
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev31 fixed
CVE-2026-59195high · fixedCVSS 8.2
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
## Summary `pnpm` accepts package names from the env lockfile `configDependencies` section and uses those names directly when creating config dependency symlinks under `node_modules/.pnpm-config`. A malicious repository can commit a crafted `pnpm-lock.yaml` whose env-lockfile document contains a traversal-shaped config dependency name such as `../../PWNED_CFGDEP`. During `pnpm install`, pnpm installs the config dependency and creates a symlink at a path derived from that name. In local testin
GHSA-qrv3-253h-g69chigh · fixedCVSS 8.2
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
## Summary `pnpm` accepts package names from the env lockfile `configDependencies` section and uses those names directly when creating config dependency symlinks under `node_modules/.pnpm-config`. A malicious repository can commit a crafted `pnpm-lock.yaml` whose env-lockfile document contains a traversal-shaped config dependency name such as `../../PWNED_CFGDEP`. During `pnpm install`, pnpm installs the config dependency and creates a symlink at a path derived from that name. In local testin
GHSA-72r4-9c5j-mj57high · fixedCVSS 7.1
pnpm: `patch-remove` could delete project-selected files outside the patches directory
## Summary The `patch-remove` deletion-scope issue tracked as GHSA-72r4-9c5j-mj57 / CAND-PNPM-030 has been addressed in pnpm. A crafted patch entry could resolve outside the configured patches directory and cause `pnpm patch-remove` to delete an arbitrary reachable file. This patch validates the configured directory and every resolved target before unlinking anything, then deletes the final directory entry without following it. ## Security boundary - Traversal and absolute paths that resolve
CVE-2026-59194high · fixedCVSS 7.1
pnpm: `patch-remove` could delete project-selected files outside the patches directory
## Summary The `patch-remove` deletion-scope issue tracked as GHSA-72r4-9c5j-mj57 / CAND-PNPM-030 has been addressed in pnpm. A crafted patch entry could resolve outside the configured patches directory and cause `pnpm patch-remove` to delete an arbitrary reachable file. This patch validates the configured directory and every resolved target before unlinking anything, then deletes the final directory entry without following it. ## Security boundary - Traversal and absolute paths that resolve
GHSA-fr4h-3cph-29xvhigh · fixedCVSS 7.1
pnpm: Hoisted install imports lockfile alias outside node_modules
## Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both pnpm and pacquet. A crafted lockfile alias could be joined directly under a hoisted `node_modules` directory. Traversal aliases could escape that directory, while reserved aliases such as `.bin` or `.pnpm` could overwrite pnpm-owned layout. This patch validates package-name semantics and path containment before graph insertion or filesystem work. ## Security boundary - The
Inventory
Tools (10)
Click any tool to inspect its schema.
~631 tokens total
Community
Reviews
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is io.github.aryanduntley/pwa-debug-layer safe to use?
- io.github.aryanduntley/pwa-debug-layer has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
- How do I install io.github.aryanduntley/pwa-debug-layer?
- io.github.aryanduntley/pwa-debug-layer supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What can io.github.aryanduntley/pwa-debug-layer do?
- io.github.aryanduntley/pwa-debug-layer provides 10 tools: initScript, macOS, Windows, mode, sw_lifecycle_tail and 5 more. See the full tools list on the server page for descriptions and parameters.
- What AI clients work with io.github.aryanduntley/pwa-debug-layer?
- io.github.aryanduntley/pwa-debug-layer is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
- Is io.github.aryanduntley/pwa-debug-layer actively maintained?
- io.github.aryanduntley/pwa-debug-layer is recently maintained — last commit was 62 days ago.
Related
Similar servers
Others in other
Headroom95Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.
67.6k 3
T
Transport Stdio95Transport for TMCP using STDIO
197 14
Flare95The graph based agentic IDE
167 3
A
app.fojin/fojin-mcp94Buddhist canon tools: search, passages, cross-canon parallels, dictionaries — all URN-cited.
332 8
MCP Security Weekly
Get CVE alerts and security updates for io.github.aryanduntley/pwa-debug-layer and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.