Atlas / MCP servers / mahdibrr / dev-error-explainers

dev-error-explainersBLOCK

mcp/mahdibrr/dev-error-explainers

Paste a developer error, get the real cause and the fix. Offline, zero-dependency explainers for CORS, ESM/CJS, npm ERESOLVE, ChunkLoadError, Postgres/Supabase DATABASE_URL and Next.js build errors.

Verdict
BLOCK
Grade
D
Trust score
64 /100
Exposed tools
—
Transport
stdio
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/dev-error-explainers) [](https://github.com/mahdibrr/dev-error-explainers/actions/workflows/test.yml) [](https://github.com/mahdibrr/dev-error-explainers/blob/main/LICENSE)

Paste an error. Get a deterministic explanation.

No LLM · no API · no network · no telemetry

npm run build 2>&1 | npx dev-error-explainers
npm install dev-error-explainers
import { detect, explainEsmCjs } from 'dev-error-explainers';
const error = 'Error [ERR_REQUIRE_ESM]: require() of ES Module /app/node_modules/node-fetch/src/index.js from /app/index.js not supported.';
console.log(detect(error));
const { findings } = explainEsmCjs({ error, nodeVersion: '20.10.0' });
console.log(findings[0].title, findings[0].fixes.map((f) => f.title));

Output:

[ 'esm-cjs-explainer' ]
ERR_REQUIRE_ESM — require() of an ES module [
'Upgrade Node.js (you are on 20.10.0)',
'Use dynamic import() from CommonJS',
'Convert the calling file to ESM'
]

Seven small, pure JavaScript modules with zero dependencies. Each one recognises the exact error text a developer pastes (from the browser console, npm, next build, curl -I, a Node.js stack trace...), explains why it happens, and returns concrete fixes with a link to the primary source where one exists (MDN, the Node.js docs, the npm docs, the PostgreSQL docs, the Supabase docs...). The same engine runs as a library, a CLI, a GitHub Action and an MCP server.

Secrets: the CLI, the Action and the M

Read from source at commit f3541e49fbb6OBSERVED · 2026-10-08
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add dev-error-explainers -- npx -y [email protected] mcp
03

Trust audit

BLOCKgrade D · trust 64/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (9 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
found

Findings (13)

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
src/database-connection-explainer.js:606
{ title: 'Not a fix: rejectUnauthorized: false', detail: 'It keeps the connection encrypted but accepts any certificate, so a man-in-the-middle can impersonate the database. Use the CA instead.', code
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
src/database-url-doctor.js:678
'node-postgres maps sslmode=no-verify to ssl: { rejectUnauthorized: false }: the connection is encrypted, but any certificate is accepted, so a man-in-the-middle can impersonate the server. Verify aga
Why it matters. certificate verification is disabled
Fix. leave verification on
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
fixtures/database-url/dedicated-pooler-prisma/input.txt:1
postgresql://postgres:[email protected]:6543/postgres
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
fixtures/database-url/dotenv-line-with-comment/input.txt:1
DATABASE_URL=postgresql://postgres:pw@localhost:5432 # dev db
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
fixtures/database-url/not-mysql-url/input.txt:1
mysql://root:pw@localhost:3306/db
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
fixtures/database-url/password-with-at-and-hash-so-63684133/input.txt:1
postgresql://postgres:p@ss#word@localhost:5432/linker
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
fixtures/database-url/pooler-username-missing-ref/input.txt:1
postgres://postgres:[email protected]:6543/postgres
MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321
test/npm-eresolve-explainer.test.js:632
const pat = 'github_pat_11ABCDEFG0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ab';
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
jest
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
docs/CONTRACT.md:139
| `cors.wildcard-with-credentials` | Access-Control-Allow-Origin "*" with a credentialed request | high |
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
docs/CONTRACT.md:143
| `cors.allow-credentials-not-true` | Access-Control-Allow-Credentials is not "true" | high |
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
fixtures/cors/safari-wildcard-with-credentials/input.txt:1
Cannot use wildcard in Access-Control-Allow-Origin when credentials flag is true.
Why it matters. asks the agent to read credentials
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha f3541e49fbb6full audit observations/trust-audit/mcp-server/mahdibrr__dev-error-explainers.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-08f3541e49fbb6BLOCKD64first audit
05

Questions

What is the dev-error-explainers MCP server?

Paste a developer error, get the real cause and the fix. Offline, zero-dependency explainers for CORS, ESM/CJS, npm ERESOLVE, ChunkLoadError, Postgres/Supabase DATABASE_URL and Next.js build errors.

Is dev-error-explainers safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (64/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does dev-error-explainers need?

No credential environment variables were found in its source, so it appears to need none.

How does dev-error-explainers run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as dev-error-explainers at 0.2.1.

How current is this page?

The grade is for one exact copy of the source (f3541e49fbb6), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement