Atlas / MCP servers / web-infra-dev / Rsdoctor

RsdoctorCAUTION

Name: Rsdoctor
Author: web-infra-dev

mcp/web-infra-dev/rsdoctor

MCP server by web-infra-dev · analyze · build analyzer · bundle · Audited 2026-09-25

⚑ Report / re-scan Source ↗

AI-friendly build analyzer for Rspack

Verdict

CAUTION

Grade

Trust score

82 /100

Exposed tools

20 19r · 1w · 0d

Transport

—

License

MIT

Stars

1,143

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

English | 简体中文

Rsdoctor is a build analyzer tailored for projects built with Rspack.

Rsdoctor is committed to being a one-stop, intelligent build analyzer that makes the build process transparent, predictable, and optimizable through visualization and smart analysis, helping development teams precisely identify bottlenecks, optimize performance, and improve engineering quality.

For webpack projects, continue using Rsdoctor 1.x or migrate to Rspack. See the migration guide for details.

🔥 Features

Compilation Visualization: Rsdoctor visualizes the compilation behavior and time consumption, making it easy to view build issues.

Multiple Analysis Capabilities: Rsdoctor supports build artifact, build-time analysis, and anti-degradation capabilities:
Build artifact support for resource lists and module dependencies, etc.
Build-time analysis supports Loader, Plugin, and Resolver building process analysis
Build rules support duplicate package de

Read from source at commit a2c13a5f54c7OBSERVED · 2026-09-25

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add test-helper -- npx -y @scripts/[email protected]

claude-desktop

{
  "mcpServers": {
    "test-helper": {
      "command": "npx",
      "args": [
        "-y",
        "@scripts/[email protected]"
      ]
    }
  }
}

Exposed tools (20)

19 read · 1 write · 0 destructive.

Tool	Risk	Description
`--baseline`	read	Path to baseline rsdoctor-data.json
`--category`	write	Filter bailout modules by cause: cjs, barrel, side-effects, or dynamic-import.
`--code`	read	Error code
`--compiler`	read	Compiler name from compilers list; required for multi-compiler reports.
`--current`	read	Path to current rsdoctor-data.json
`--emitted-only`	read	Only include modules attached to emitted assets.
`--filter`	read	Comma-separated row fields to keep, e.g. id,path,size,chunks,bailoutReason.
`--id`	read	Chunk id
`--level`	read	Error level
`--limit`	read	Maximum rows to return (default: 100, max: 1000).
`--min-costs`	read	Minimum costs threshold (ms)
`--min-total-costs`	read	Minimum total costs threshold (ms)
`--modules`	read	Comma-separated module ids, paths, or names to query. Defaults to all bailout modules.
`--name`	read	Package name
`--page-number`	read	Page number (default: 1)
`--page-size`	read	Page size (default: 100, max: 1000)
`--path`	read	Module name or path
`--sort`	read	Sort by sourceSize, parsedSize, or gzipSize.
`--step`	read	Execution step: 1 (basic analysis) or 2 (tree-shaking summary). If not specified, executes both.
`array_tool`	read	test tool

Trust audit

CAUTIONgrade B · trust 82/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (6 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (22)

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/client/src/components/base/DiffViewer/beautify.ts:351

function print(tokens: Token[]) {

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/core/src/sdk/server/apis/data.ts:21

const uri = new URL(url, 'http://127.0.0.1');

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

packages/document/theme/index.tsx:19

apiKey: 'db98c3a0aa060d3aa4b30f49fee02b16', // cspell:disable-line

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

packages/core/src/sdk/sdk/core.ts:81

const hash = createHash('md5')

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

e2e/cases/doctor-rsbuild/fixtures/port.js:1

const { RsdoctorRspackPlugin } = require('../../../dist/index');

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

e2e/cases/doctor-rsbuild/multi-environments.test.ts:153

{ name: 'web', path: '../../rsdoctor-report.html' },

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

e2e/cases/doctor-rspack/bundle-diff.test.ts:6

} from '../../test-kit/index';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

e2e/cases/doctor-rspack/bundle-diff.test.ts:54

'../../fixtures/rsdoctor/manifest.json',

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

e2e/cases/doctor-rspack/bundle-diff.test.ts:57

const newPath = path.resolve(__dirname, '../../../');

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/core/tests/sdk/server/apis/project.test.ts:106

optionsWithOrigin(target, `http://127.0.0.1:${target.server.port}`),

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/core/tests/sdk/server/apis/project.test.ts:109

allowOrigin: `http://127.0.0.1:${target.server.port}`,

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/core/tests/sdk/server/apis/project.test.ts:113

optionsWithOrigin(target, `http://127.0.0.1:${target.server.port + 1}`),

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/core/tests/sdk/server/apis/project.test.ts:116

allowOrigin: `http://127.0.0.1:${target.server.port + 1}`,

LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

e2e/fixtures/rsdoctor/chunkGraph/0:1

eJytWG1z2jgQ/isa3Qegp7GDAffiNL0TNM0xSSbTpplcp+aDYiugYmSPLUgIw3+/sWz8Fiu8JJ1Mx6xWq30erXZXWkESRVRE0Pq1ggERE2jBGeNsRjztdwQRjNgzhVbX6CDoTOZ8GmvCIzhC0PG5oFxAC+of5D8dNJstcPoZrICug0d6HxBn2vd9EYmQBDbP1Gxhw3lE

LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

e2e/fixtures/rsdoctor/configs/0:1

eJztPYly27iSv5JCzdabqZFIy87prbdxIjvHlrPJ5phsla1VQWRLgkICHACU5LH871uNg5fkI47s7Lzi1CQRcTQajUaju9Fkn5wTTlMg+2QBo4xG30iHzEEqJjjZJ4+CZ3vBDumQSPAxm5D9cxLRaAr4Q59l2G3MElBnSkNKOoQmiVj0RZJApBmfvINUyDOyP6aJgg5J

LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

e2e/fixtures/rsdoctor/summary/0:1

eJx90E0KwjAQBeC7ZKXQQtK/NFkUxGOIi7ROMWibkBkRrb27CNVWELdveB+PGVjjkJDp3cB60wHTrHaOkILxcVVD6wJsXeftGVjEkEygDTEtZFKIlPMiL7MsehtCFEqM0Swt63FlWoLwB5MyT4sPlohSJQts2Y6rg+t/GkplSTkbnKcLorO9bW+rK9TeNKdMO0+2s3fY

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

e2e/package.json

@actions/core, @lynx-js/react, @lynx-js/rspeedy, loader-utils

Why it matters. 4 dependency range(s) float