Borrowing it
Nothing to install: this file belongs to philipyaz/cos. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/philipyaz/cos/main/.claude/skills/debug-cowork-mcp-issues/SKILL.mdgit clone --depth 1 https://github.com/philipyaz/cosWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/philipyaz/cos/debug-cowork-mcp-issues)<a href="https://agentmods.dev/skills/philipyaz/cos/debug-cowork-mcp-issues"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/debug-cowork-mcp-issues/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/philipyaz/cos/debug-cowork-mcp-issues"><img src="https://agentmods.dev/badge/skills/philipyaz/cos/debug-cowork-mcp-issues.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00222 | $0.03702 |
| Opus 5 | $0.00111 | $0.01851 |
| Sonnet 5 | $0.00044 | $0.00740 |
| Haiku 4.5 | $0.00022 | $0.00370 |
Grade A, and why
debug-cowork-mcp-issues scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| `board`/`calendar` tool **calls** fail, but `tools/list` is fine | the board app isn't on **:3000** | `cd board && npm run dev`; confirm it bound **:3000** (its startup banner shows the actual port if it bumped) — `cur Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
const { spawn } = require("node:child_process"); How it starts
The opening of the file, as written. The whole thing — 185 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Debug a Cos MCP server in Cowork (and Claude Code)
The #1 source of confusion is mixing up two independent layers. Establish which one the user is hitting before doing anything — the diagnosis and the fix differ.
| Layer | How the server runs | Config | Reads config… |
|---|---|---|---|
| Claude Cowork Desktop | Cowork spawns each server directly as a stdio command |
~/Library/Application Support/Claude/claude_desktop_config.json |
only at launch (⌘Q to reload) |
| Claude Code | a launchd supergateway bridge per server (:8001–:8006) |
$REPO_ROOT/.mcp.json |
per session (launchd supervises the bridge) |
The board app (:3000) is a third, independent thing — it works with no bridges at all. Don't chase an MCP bug that's really "the board app isn't running on :3000" (see step 4).
Every shell block below starts with the loader so nothing is hardcoded:
source "$(git rev-parse --show-toplevel)/config/load-config.sh"
The full reference for this runbook is docs/reference/troubleshooting.md.
Step 0 — Scope it
Ask / confirm: which client (Cowork or Claude Code), which server (board / calendar / guard / vault / openwhispr / whatsapp), and what the user sees (missing from tools, "not responding", a tool call erroring, a specific error string). Then take the matching path below.
Step 1 — (Cowork) Relaunch first
Cowork reads claude_desktop_config.json only at launch and does not respawn a server that
exited. After any config change, or any "it died" symptom, the first move is: fully quit Cowork
(⌘Q — not just close the window) and reopen it. This alone resolves the majority of cases. Tell
the user to do it and re-check before going deeper.
Confirm the server is even registered + the config is valid JSON (redact secrets):
source "$(git rev-parse --show-toplevel)/config/load-config.sh"
"$NODE_BIN" -e '
const c = require(process.env.COWORK_CONFIG);
const s = c.mcpServers || {};
for (const [k, v] of Object.entries(s)) {
const env = Object.fromEntries(Object.entries(v.env||{}).map(([ek,ev]) =>
[ek, ek.includes("KEY") ? (ev?ev.slice(0,8)+"…":"EMPTY") : ev]));
console.log(k, "->", v.command, JSON.stringify(v.args), JSON.stringify(env));
}'
If a server is absent from mcpServers, or its command/args point at a stale/missing path
(e.g. an old checkout), that's the bug — fix the entry (Step 5) and ⌘Q.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 185 lines · 222 tokens per session scan A 1658034745d5
debug-cowork-mcp-issues is a skill published in the GitHub repository philipyaz/cos (4 stars, last pushed today), licensed MIT. It adds 222 tokens to every session and 3,702 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
wiki-lint
Health-check a wiki vault. Finds orphan pages (no inbound links), dead wikilinks (point to non-existent pages), missing frontmatter fields, stale claims, empty sections, and pages absent from catalog.md. Produces a structured report with severity tiers and proposes concrete fixes — but does not auto-apply them unless…
meta-audit-bridge-readiness
Audit every Obsidian vault for click-to-open (GET /open/ ) readiness. Verifies the FOUR prerequisites — mcp-router-bridge ≥ 0.2.0, Local REST API ≥ 4.0.0, enableInsecureServer: true, AND a live probe that confirms the route is actually registered in-memory (catches the "files on disk are right but Obsidian needs…
systematic-debugging
4-phase root cause debugging: understand bugs before fixing.
browser-edge-cases
SOP for debugging browser automation failures on complex websites. Use when browser tools fail on specific sites like LinkedIn, Twitter/X, SPAs, or sites with Shadow DOM.
ha-logs
A read-only troubleshooting skill for querying Hope Agent’s local SQLite databases, which store logs, conversations, and background-job status.
bug-report
Creates a structured bug report from a description, or analyzes code to identify potential bugs. Ensures every bug report has full reproduction steps, severity assessment, and context.