React Render Profile Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited React Render Profile Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 14 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 14 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An Autonomous Performance SRE & Auto-Remediation Engine for React, exposed as a Model Context Protocol (MCP) server. Built specifically to bridge the performance perception gap for AI coding agents (Claude, Cursor, Copilot).
When an AI agent refactors a Context Provider, changes state architecture, or hooks up a global store, it is completely blind to the runtime performance impact.
An agent can successfully pass unit tests and compile code while introducing catastrophic performance regressions:
`react-render-profile-mcp` gives AI agents a "third eye" to dynamically measure, visualize, and auto-remediate these performance bottlenecks.
Instead of raw JSON dumps, this server organizes performance data into structured, actionable insights across four core engineering pillars:
ts-morph)ア When a bottleneck is found, the agent doesn't need to manually rewrite code. The server can mutate component source code on disk:
useCallback and useMemo with computed dependency arrays.React.memo only if the profiled self-time and spurious render count justify the comparison overhead (ROI > 1.5).Date.now(), Math.random(), or render-phase useRef mutations).Generates parent-child rendering graphs directly into the agent's chat window using the custom resource URI scheme react-profile://commits/{commitId}/cascade?profile_path={profile_path}.
Analyzes React Server Components (RSC) Flight streams to optimize delivery:
Aligns React commits with Chrome Performance timeline events using blink.user_timing markers.
Below is a compact summary of the tools exposed by this server. All tools accept a required profile_path pointing to a React DevTools export .json.
| Tool Name | Parameters | Purpose / Output |
|---|---|---|
| `get_render_summary` | profile_path | Overview of commits, total render time, spurious renders count, and lifecycle anomalies. |
| `find_spurious_renders` | profile_path, min_render_count? | Lists components that rendered with identical props/state. Classifies trigger into UNSTABLE_PARENT_REF or CONTEXT_UPDATE. |
| `analyze_compiler_efficacy` | profile_path, invalid_threshold? | Computes Invalidation Index to identify where React Compiler or React.memo is bypassed. |
| `diagnose_hydration_and_suspense` | profile_path, waterfall_threshold_ms? | Detects server-client hydration mismatches and nested Suspense fetch waterfalls. |
| `evaluate_external_store_performance` | profile_path, max_blocking_task_ms? | Finds unstable useSyncExternalStore selectors and high-priority blocking sync tasks. |
| `trace_state_cascade_footprint` | profile_path, commit_index | Traces virtual owner tree to measure propagation depth and consumer count of updates. |
| `suggest_memoization` | profile_path, min_wasted_ms? | Provides high-ROI React.memo suggestions based on average self-time (> 2ms threshold). |
| `remediate_component` | file_path, component_name, unstable_props, roi_score | Modifies AST on disk to hoist variables, wrap hooks, and apply memoization. |
| `audit_compiler_rules` | file_path, component_name | Statically audits component source code for React Compiler rule violations. |
| `profile_rsc_stream` | stream_payload | Parses RSC Flight logs to audit chunk sizes, waterfalls, and React2Shell exploits. |
| `correlate_chrome_trace` | profile_path, trace_path | Aligns React commits with Chrome trace events to calculate CLS/INP web vitals impacts. |
To get the most out of this server, add the following prompt to your agent's system instructions (e.g., in .cursorrules, Cursor System Prompt, or Claude Custom Instructions):
You are equipped with `react-render-profile-mcp`. Use it systematically whenever:
1. You make structural changes to React components, global state providers, or store selectors.
2. The user reports lag, slow input response, or UI stuttering.
3. You refactor context providers, Zustand selectors, or Redux dispatches.
Debugging Workflow:
- Ask the user to record and export a React DevTools profile (.json).
- Run `get_render_summary` to understand the scale of the problem and look for `lifecycle_anomaly: true` (unstable keys).
- Run `find_spurious_renders` and `analyze_compiler_efficacy` to pinpoint unstable prop references.
- Call the `react-profile://commits/{commitId}/cascade` resource to visualize cascades.
- Use `remediate_component` to automatically apply AST optimizations (hoisting static variables, wrapping hooks) instead of doing it manually..json file.Add this to your claude_desktop_config.json:
{
"mcpServers": {
"react-render-profile": {
"command": "npx",
"args": ["-y", "react-render-profile-mcp"]
}
}
}Add an MCP server of type command:
npx -y react-render-profile-mcpts-morph statement manipulation blocks, avoiding common parser state corruption during multi-pass rewrites.Developed alongside:
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.