rollbar-mcp-serverCAUTION
Model Context Protocol server for Rollbar
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol (MCP) server for Rollbar.
Features
This MCP server implements the stdio server type, which means your AI tool (e.g. Claude, Cursor) will run it directly; you don't run a separate process or connect over http.
Configuration
User access token
To read item history and post comments as yourself, configure a Rollbar user-scoped account access token with ROLLBAR_USER_ACCESS_TOKEN, or use a config file:
{ "userToken": "" }Use read scope for reads, or read and write to post comments. The MCP resolves your project through GET /projects (read scope), then posts with write scope. Your Rollbar user also needs view permission to read history and comment permission to post in that project. Project tokens and ordinary account tokens cannot post comments.
User mode sends every request with the configured user's token, including when per-project tokens are also present. Comment authorship comes from that token; you cannot supply a different author. The backend marks posted comments with via_api: true and handles normal subscriptions and notifications.
Configure exactly one of userToken / ROLLBAR_USER_ACCESS_TOKEN or accountToken / ROLLBAR_ACCOUNT_ACCESS_TOKEN. Configuring both fails at startup, including when one comes from a file and the other from the environment. A file value overrides the environment value for the same token type. apiBase in a file or ROLLBAR_API_BASE in environment-only configuration selects a custom API endpoint.
Use list-projects to find the project name or numeric ID for the tools' project argument. It is optional when your user token can see exactly one enabled project. A token supplied only through the legacy ROLLBAR_ACCESS_TOKEN setting is not inferred to be a user token; set ROLLBAR_USER_ACCESS_TOKEN explicitly for posting.
Account access token
Configure a single Rollbar Account Ac
7c7b952723a8OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server --env ROLLBAR_ACCESS_TOKEN=${ROLLBAR_ACCESS_TOKEN} --env ROLLBAR_ACCOUNT_ACCESS_TOKEN=${ROLLBAR_ACCOUNT_ACCESS_TOKEN} --env ROLLBAR_USER_ACCESS_TOKEN=${ROLLBAR_USER_ACCESS_TOKEN} -- npx -y @rollbar/[email protected]{
"mcpServers": {
"mcp-server": {
"command": "npx",
"args": [
"-y",
"@rollbar/[email protected]"
],
"env": {
"ROLLBAR_ACCESS_TOKEN": "${ROLLBAR_ACCESS_TOKEN}",
"ROLLBAR_ACCOUNT_ACCESS_TOKEN": "${ROLLBAR_ACCOUNT_ACCESS_TOKEN}",
"ROLLBAR_USER_ACCESS_TOKEN": "${ROLLBAR_USER_ACCESS_TOKEN}"
}
}
}
}Exposed tools (15)
13 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
error-tool | read | Test error handling |
get-deployments | read | Get deployments data from Rollbar |
get-item-details | read | Get item details for a Rollbar item |
get-replay | read | Get replay data for a specific session replay in Rollbar |
get-top-items | read | Get list of top items in the Rollbar project |
get-version | read | Get version details for a Rollbar project |
list-item-events | read | |
list-items | read | List all items in the Rollbar project with optional search and filtering |
list-occurrences | read | List occurrences (instances) for a Rollbar item by counter |
list-projects | read | List configured Rollbar projects available to this MCP server |
post-item-comment | write | |
tool1 | read | desc1 |
tool2 | read | desc2 |
tool3 | read | desc3 |
update-item | write | Update an item in Rollbar (status, level, title, assignment, etc.) |
Trust audit
CAUTIONgrade B · trust 88/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (14)
projects: [{ name: "backend", token: "tok_backend_explicit" }],projects: [{ name: "backend", token: "tok_backend_explicit" }],args: [fileURLToPath(new URL("../../build/index.js", import.meta.url))],} from "../../src/types/index.js";
import { ITEM_EVENT_TYPES } from "../../src/types/index.js";const { registerAllTools } = await import("../../src/tools/index.js");await import("../../src/tools/get-replay.js");@modelcontextprotocol/sdk, dotenv, rollbar, undici, zod, @eslint/js, @types/node, @vitest/coverage-v8
This is the same file GitHub Copilot's agent mode reads in VS Code. Put it in `.vscode/mcp.json` to share the server with everyone on the repo, or in your user-profile `mcp.json` (**Command Palette →
"ROLLBAR_ACCESS_TOKEN": "<project read/write access token>"
"ROLLBAR_ACCESS_TOKEN": "<project read/write access token>"
"ROLLBAR_ACCESS_TOKEN": "<project read/write access token>"
The full e2e suite (`npm run test:e2e`) runs two scripts: the npx-install test (no token needed) and the get-item-details test. If `ROLLBAR_E2E_READ_TOKEN` is not set, the get-item-details test is ski
"ROLLBAR_ACCESS_TOKEN": "<project read/write access token>"
Gates applied: no_behavioural_pass.
7c7b952723a8full audit observations/trust-audit/mcp-server/rollbar__rollbar-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 7c7b952723a8 | CAUTION | B | 88 | first audit |
Questions
What is the @rollbar/mcp-server MCP server?
Model Context Protocol server for Rollbar
What tools does @rollbar/mcp-server expose?
15 in total: 13 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @rollbar/mcp-server safe to connect to an agent?
With care. The audit graded it B (88/100) and found 14 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does @rollbar/mcp-server need?
It reads ROLLBAR_ACCESS_TOKEN, ROLLBAR_ACCOUNT_ACCESS_TOKEN and ROLLBAR_USER_ACCESS_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @rollbar/mcp-server run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @rollbar/mcp-server at 0.6.1.
How current is this page?
The grade is for one exact copy of the source (7c7b952723a8), read on 2026-10-12. The repository is watched and re-audited when it changes.