dev-error-explainersBLOCK
Paste a developer error, get the real cause and the fix. Offline, zero-dependency explainers for CORS, ESM/CJS, npm ERESOLVE, ChunkLoadError, Postgres/Supabase DATABASE_URL and Next.js build errors.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/dev-error-explainers) [](https://github.com/mahdibrr/dev-error-explainers/actions/workflows/test.yml) [](https://github.com/mahdibrr/dev-error-explainers/blob/main/LICENSE)
Paste an error. Get a deterministic explanation.
No LLM · no API · no network · no telemetry
npm run build 2>&1 | npx dev-error-explainers
npm install dev-error-explainers
import { detect, explainEsmCjs } from 'dev-error-explainers';
const error = 'Error [ERR_REQUIRE_ESM]: require() of ES Module /app/node_modules/node-fetch/src/index.js from /app/index.js not supported.';
console.log(detect(error));
const { findings } = explainEsmCjs({ error, nodeVersion: '20.10.0' });
console.log(findings[0].title, findings[0].fixes.map((f) => f.title));Output:
[ 'esm-cjs-explainer' ] ERR_REQUIRE_ESM — require() of an ES module [ 'Upgrade Node.js (you are on 20.10.0)', 'Use dynamic import() from CommonJS', 'Convert the calling file to ESM' ]
Seven small, pure JavaScript modules with zero dependencies. Each one recognises the exact error text a developer pastes (from the browser console, npm, next build, curl -I, a Node.js stack trace...), explains why it happens, and returns concrete fixes with a link to the primary source where one exists (MDN, the Node.js docs, the npm docs, the PostgreSQL docs, the Supabase docs...). The same engine runs as a library, a CLI, a GitHub Action and an MCP server.
Secrets: the CLI, the Action and the M
f3541e49fbb6OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add dev-error-explainers -- npx -y [email protected] mcp
Trust audit
BLOCKgrade D · trust 64/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (9 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (13)
{ title: 'Not a fix: rejectUnauthorized: false', detail: 'It keeps the connection encrypted but accepts any certificate, so a man-in-the-middle can impersonate the database. Use the CA instead.', code'node-postgres maps sslmode=no-verify to ssl: { rejectUnauthorized: false }: the connection is encrypted, but any certificate is accepted, so a man-in-the-middle can impersonate the server. Verify agapostgresql://postgres:[email protected]:6543/postgres
DATABASE_URL=postgresql://postgres:pw@localhost:5432 # dev db
mysql://root:pw@localhost:3306/db
postgresql://postgres:p@ss#word@localhost:5432/linker
postgres://postgres:[email protected]:6543/postgres
const pat = 'github_pat_11ABCDEFG0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ab';
jest
| `cors.wildcard-with-credentials` | Access-Control-Allow-Origin "*" with a credentialed request | high |
| `cors.allow-credentials-not-true` | Access-Control-Allow-Credentials is not "true" | high |
Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
Gates applied: no_behavioural_pass.
f3541e49fbb6full audit observations/trust-audit/mcp-server/mahdibrr__dev-error-explainers.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | f3541e49fbb6 | BLOCK | D | 64 | first audit |
Questions
What is the dev-error-explainers MCP server?
Paste a developer error, get the real cause and the fix. Offline, zero-dependency explainers for CORS, ESM/CJS, npm ERESOLVE, ChunkLoadError, Postgres/Supabase DATABASE_URL and Next.js build errors.
Is dev-error-explainers safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (64/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does dev-error-explainers need?
No credential environment variables were found in its source, so it appears to need none.
How does dev-error-explainers run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as dev-error-explainers at 0.2.1.
How current is this page?
The grade is for one exact copy of the source (f3541e49fbb6), read on 2026-10-08. The repository is watched and re-audited when it changes.