NestJS DevTools MCP

Give your AI coding agents real-time visibility into your NestJS application.

NestJS DevTools MCP connects a running NestJS app to AI tools such as Claude, Cursor, Copilot, Cline, and Roo Code through the Model Context Protocol (MCP). Instead of copy-pasting logs, routes, request errors, or config values into chat, your AI assistant can inspect them directly from your local app.

What You Get

• Runtime logs from your NestJS app

• Registered HTTP routes

• Recent HTTP request history

• Sanitized runtime config

• Runtime error history

• Local server discovery

• Localhost-only access by default

• Production-safe default behavior

Related MCP server: agentic-mcp-server

Packages

This monorepo publishes 2 packages:

Quick Start

1. Install the NestJS Plugin

npm install @nestjs-devtools-mcp/plugin

Or with pnpm:

pnpm add @nestjs-devtools-mcp/plugin

2. Register the Module

import { Module } from '@nestjs/common'
import { DevtoolsMcpModule } from '@nestjs-devtools-mcp/plugin'

@Module({
  imports: [DevtoolsMcpModule.register()],
})
export class AppModule {}

3. Use bufferLogs During Bootstrap

import { NestFactory } from '@nestjs/core'
import { AppModule } from './app.module'

async function bootstrap() {
  const app = await NestFactory.create(AppModule, {
    bufferLogs: true,
  })

  await app.listen(3000)
}

bootstrap()

The DevTools logger is applied automatically when the module is registered.

4. Configure Your MCP Client

Add this MCP server to your AI client configuration:

{
  "mcpServers": {
    "nestjs-devtools": {
      "command": "npx",
      "args": ["-y", "nestjs-devtools-mcp@latest"]
    }
  }
}

Restart your AI client, then ask:

Discover my local NestJS servers and show recent errors.

Available MCP Tools

Example Prompts

After setup, try asking your AI assistant:

Find my running NestJS app and show me the latest runtime logs.

List all registered routes in my NestJS server.

Show recent failed HTTP requests and explain likely causes.

Check runtime config values related to DATABASE.

Show unhandled errors from the last few minutes.

Runtime Endpoint

The plugin exposes a localhost-only internal endpoint inside your NestJS app:

GET  /_dev/mcp/health
POST /_dev/mcp/tools/get_logs
POST /_dev/mcp/tools/get_routes
POST /_dev/mcp/tools/get_request_history
POST /_dev/mcp/tools/get_config
POST /_dev/mcp/tools/get_errors

The bridge connects to this endpoint through localhost.

Configuration

Plugin Options

DevtoolsMcpModule.register({
  name: 'my-api',
  logBufferSize: 500,
  requestHistorySize: 100,
  errorBufferSize: 100,
})

Bridge Environment Variables

Example:

NESTJS_MCP_SCAN_START=3000 NESTJS_MCP_SCAN_END=4000 npx nestjs-devtools-mcp

Security Model

This project is designed for local development and debugging.

Security defaults:

• Plugin is disabled when NODE_ENV=production

• MCP endpoint is protected by a localhost-only guard

• Request and response bodies are not captured by default

• Internal /_dev/mcp/* calls are excluded from request history

• Sensitive config values are always masked

• ConfigService values are only read from explicitly declared keys

Sensitive keys and values such as passwords, tokens, auth headers, database URLs, private keys, cookies, sessions, JWTs, and credentials are returned as:

***MASKED***

How It Works

AI Client
  │
  │ MCP over STDIO
  ▼
nestjs-devtools-mcp
  │
  │ HTTP over localhost
  ▼
@nestjs-devtools-mcp/plugin
  │
  ▼
Running NestJS App

The architecture intentionally keeps responsibilities separate:

• The plugin runs inside the NestJS app and collects runtime state.

• The bridge runs as an MCP server over STDIO.

• The bridge does not start an HTTP server.

• The plugin does not depend on the MCP SDK.

Development

Install dependencies:

pnpm install

Build all packages:

pnpm build

Run tests:

pnpm test

Run lint:

pnpm lint

Run the full local CI check:

pnpm ci

Documentation

• Development Guide

• Plugin Package

• Bridge Package

License

MIT © HaoNgo232

For production environments, always reassess security assumptions before enabling runtime introspection tools.