tidewaveSAFE
Tidewave for JavaScript (Vite/TanStack Start)
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Tidewave JS is an MCP server that provides runtime-level tools for developing JS apps using coding agents. This project supports:
- TanStack Start with React
- Vite with React/Vue (which includes Astro, VitePress, etc)
Your agent will be able to use this MCP server to talk to your running app in development to:
- execute code in the context of the running app (like an terminal session for
agents)
- read the app's live logs
- get source locations of modules and functions
- read documentation pinned to the exact package versions your project depends
on
This MCP server is an open-source component of Tidewave.
You can use this project as a standalone MCP server or integrated with the Tidewave product by following the installation instructions below.
This project can also be used through the CLI or as a standalone Model Context Protocol server.
Installation
If you are using Vite (with React/Vue) or TanStack Start with React, install Tidewave with:
$ npx tidewave install # or $ yarn dlx tidewave install # or $ pnpm dlx tidewave install # or $ bunx tidewave install
And you are almost there! Now make sure to add the Tidewave MCP server to your editor or MCP client configuration as the type "http" (streamable), pointing to the /tidewave/mcp path and port your web application is running at.
We also have specific instructions for:
In case the command above does not work, you can toggle the manual installation instructions below.
Manual installation
c2e9119467a6OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add tidewave -- npx -y [email protected]
{
"mcpServers": {
"tidewave": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (5)
4 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
browser_eval | read | Runs JavaScript in a real browser to interact with the application. You MUST use |
create_design_canvas | write | Creates a new design canvas, an HTML file for presenting design explorations. The tool returns the absolute path of the HTML file. The file includes usage instructions, read it, then edit it to author the actual design. |
get_docs | read | Extract TypeScript/JavaScript documentation and type information. Works for modules in the current project, dependencies, and builtin node modules. Reference format determines what is returned: • |
get_logs | read | Retrieve application logs within your project |
get_source_location | read | Extract TypeScript/JavaScript source location for the given reference. This works for modules in the current project, as well as dependencies, and builtin node modules |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (12)
.envrc
.prettierignore
const digest = crypto.createHash('md5').update(cwd).digest('hex').slice(0, 16);import { name, version } from '../../package.json';import type { TidewaveConfig } from '../../core';import { tidewaveConfig, type LocalRequestInfoGetter } from '../../config';} from '../../config';
import type { TidewaveConfig } from '../../core';headers: { origin: `http://127.0.0.1:${port}` },headers: { origin: `http://127.0.0.1:${port}` },clientUrl = `http://127.0.0.1:${address.port}`;@modelcontextprotocol/sdk, body-parser, typescript, ws, @eslint/js, @types/body-parser, @types/bun, @types/node
Gates applied: no_behavioural_pass.
c2e9119467a6full audit observations/trust-audit/mcp-server/tidewave-ai__tidewave_js.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | c2e9119467a6 | SAFE | B | 89 | first audit |
Questions
What is the tidewave MCP server?
Tidewave for JavaScript (Vite/TanStack Start)
What tools does tidewave expose?
5 in total: 4 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is tidewave safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does tidewave need?
No credential environment variables were found in its source, so it appears to need none.
How does tidewave run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as tidewave at 0.8.2.
How current is this page?
The grade is for one exact copy of the source (c2e9119467a6), read on 2026-10-12. The repository is watched and re-audited when it changes.