What is arthas-mcp AGENTS.md?

Project instructions for maintaining arthas-mcp, a Node service that exposes Alibaba Arthas Java diagnostics through MCP in standard-input or HTTP mode.

Use them when changing the service, its configuration, JVM discovery, MCP commands, logging, or regression tests for clean shutdown.

They document repository rules and safeguards, including cross-platform JVM discovery and preventing abandoned processes from consuming resources.

How x0c/arthas-mcp configures Codex and OpenCode

Reuse

Borrowing it

Nothing to install: this file belongs to x0c/arthas-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/x0c/arthas-mcp/main/AGENTS.md

Clone the repo

git clone --depth 1 https://github.com/x0c/arthas-mcp

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/x0c/arthas-mcp/agents-md/github.svg)](https://agentmods.dev/instructions/x0c/arthas-mcp/agents-md)

Your own site

<a href="https://agentmods.dev/instructions/x0c/arthas-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/x0c/arthas-mcp/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/x0c/arthas-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/x0c/arthas-mcp/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 991 This file is loaded in full into every session.

When invoked 991 The same file — it is already loaded in full.

Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00991	$0.00991
Opus 5.5	$0.00396	$0.00396
Sonnet 5.5	$0.00198	$0.00198
Haiku 4.5	$0.00099	$0.00099

Measured 2mo ago against content hash eca4673558f5, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

arthas-mcp AGENTS.md scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLmediumData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

涉及发现/attach 逻辑的改动，再起一个带包名的长驻 JVM（如 `com.example.demo.SleeperApp`）实跑一轮：日志应出现「发现新 Java 服务」与「就绪 (port=…)」，`curl -X POST http://127.0.0.1:<port>/api -d '{"action":"exec","command":"version"}'` 应返回 `SUCCEEDED`。

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

涉及发现/attach 逻辑的改动，再起一个带包名的长驻 JVM（如 `com.example.demo.SleeperApp`）实跑一轮：日志应出现「发现新 Java 服务」与「就绪 (port=…)」，`curl -X POST http://127.0.0.1:<port>/api -d '{"action":"exec","command":"version"}'` 应返回 `SUCCEEDED`。

AGENTS.md · 41 lines

What it actually says

arthas-mcp

把阿里 Arthas Java 诊断能力通过 MCP 暴露给 AI 助手的 Node 服务（stdio / HTTP 双模式）。公开镜像 github.com/x0c/arthas-mcp；与官方 arthas-mcp-server 的关系（独立实现，非封装）见 README.md。

硬约束

stdio 模式必须监听 stdin 关闭并退出（cli/arthas-mcp.mjs 的 exitWhenClientGone，2026-08-25 修复）。删掉它会复发孤儿泄漏事故：客户端退出后扫描定时器吊住 Node 事件循环，进程永不退出，堆积吃内存，且每个实例持续空转探测。回归命令：npm test（stdin 关闭 5 秒内必须自行退出，挂死即回归）。
扫描定时器默认 15 秒一轮 jps，每次探测都是一个完整 JVM 启动（约 0.3-0.5s CPU）。调整间隔或新增轮询类逻辑前先算清楚成本；活跃 agent 会话多时实例数 = 会话数，成本按实例数翻倍。
进程参数读取按平台分支（lib/discovery.mjs _getProcessArgs）：Linux 读 /proc/<pid>/cmdline、macOS 用 ps、Windows 走 PowerShell CIM。改这段时三端语义要对齐：返回值都是完整命令行字符串；java 启动器判定用跨平台正则（容忍引号与反斜杠路径），不要退回 ^\S*java\s 这种 Unix 假设。

结构

路径	职责
`cli/arthas-mcp.mjs`	入口：参数解析、stdio/HTTP 双模式、优雅关闭
`lib/discovery.mjs`	JVM 自动发现（jps + 黑名单）+ Arthas 生命周期与端口管理 + 服务名提取（跨平台正则）
`lib/mcp.mjs`	MCP Server 工厂：`list_agents` / `exec` / `watch_and_trigger` / `async_exec` / `pull_results` / `interrupt_job`；返回值格式化（错误透传异常摘要、超长截断、jad 去 mappings 噪音）
`lib/config.mjs`	配置解析（CLI > 环境变量 > config.json > 默认值）、arthas-boot 自动探测、`stripPrefixes`
`lib/log.mjs`	日志
`scripts/smoke.mjs`	孤儿泄漏回归测试（CI 与本地共用）

注意：入口目录刻意叫 cli/ 不叫 bin/（沿用本工作区约定），不要改回 bin/。

本地配置与运行数据

~/.config/arthas-mcp/ 与仓库分离、已 gitignore：config.json（含 stripPrefixes 服务名前缀剥离）、aliases.json（服务名别名）、state.json（Agent 运行状态）。仓库默认值不含任何用户特定前缀。

改动验证

npm run check          # 全部 mjs 语法检查
node cli/arthas-mcp.mjs --version
npm test               # 孤儿回归：stdin 关闭 5 秒内自行退出

涉及发现/attach 逻辑的改动，再起一个带包名的长驻 JVM（如 com.example.demo.SleeperApp）实跑一轮：日志应出现「发现新 Java 服务」与「就绪 (port=…)」，curl -X POST http://127.0.0.1:<port>/api -d '{"action":"exec","command":"version"}' 应返回 SUCCEEDED。

发布

公开远端 github.com/x0c/arthas-mcp（main 分支）。改动合并后同推两处远端；GitHub 侧更新 Description / Topics 用 gh repo edit。npm 包 arthas-mcp 名字已留空可发布（未登录时用 npx -y github:x0c/arthas-mcp 作为安装口径，README 中已注明缩短形式的过渡说明）。

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago Changed · +31 tokens per session eca4673558f5
2mo ago First seen · 41 lines · 960 tokens per session scan B 5c3bbfaec873

Subscribe to this mod's changes

arthas-mcp AGENTS.md is an instructions file published in the GitHub repository x0c/arthas-mcp (4 stars, last pushed 2mo ago), licensed MIT. It adds 991 tokens to every session, about $0.0040 per session on Opus 5.5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Debugging Java Languages arthas jvm mcp mcp-server

arthas-mcp AGENTS.md next to 6 instructions from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
arthas-mcp AGENTS.mdx0c/arthas-mcp	Instructions file	4	2mo ago	MIT	B	991	Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	9,719	GitHub Copilot
next.js AGENTS.mdvercel/next.js	Instructions file	143k	yesterday	MIT	A	7,461	Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchain	Instructions file	149k	yesterday	MIT	A	4,680	Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	5,516	GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscode	Instructions file	195k	yesterday	MIT	A	3,093	GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness	Instructions file	274k	2d ago	MIT	A	4,313	Codex, OpenCode

arthas-mcp: Instructions file for Codex