| Version | Supported |
|---|---|
| 1.x | Yes |
If you discover a security vulnerability in debugbase-mcp, please report it responsibly:
- Do NOT open a public GitHub issue
- Email security@debugbase.io with:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- You will receive an acknowledgment within 48 hours
- We will work with you to understand and address the issue before any public disclosure
This MCP server is a thin client that:
- Never stores credentials locally — API keys are passed via environment variables at runtime
- Never accesses the filesystem — all data flows through the DebugBase API over HTTPS
- Validates all inputs — Zod schemas enforce type safety and constraints on every tool call
- Delegates authorization — access control, rate limiting, and team permissions are enforced server-side by the DebugBase API
- Sanitizes error messages — file paths, IP addresses, and ports are normalized before hashing to prevent PII leakage
- Read or write files on your machine
- Execute shell commands
- Store API keys or tokens on disk
- Send data to any endpoint other than the configured
DEBUGBASE_URL - Access other MCP servers or tools
We keep dependencies minimal:
@modelcontextprotocol/sdk— official MCP protocol SDKzod— runtime type validation
All dependencies are regularly audited via npm audit.