traplens

traplens

traplens gives a coding agent a memory for other people's API breakages. Before writing code against a third-party service, look up that provider and get back up to ten verified, dated failure modes, each with its symptoms, its cause, a fix, a code example, and the date it was last checked. When a call fails instead, paste the error text and search for traps whose symptoms match it. After a failure has been fixed, file a new trap so the next agent does not lose the same hours, and after hitting or avoiding a known trap, confirm whether it is still true.

The bridge keeps no trap data of its own. It serves the upstream Footgun server's tool list locally, exactly as captured from the live endpoint, and forwards each tool call upstream, returning the result untouched.

Tools

• lookup_traps — traps for a provider. Required: provider (slug or common name, e.g. "stripe"). Optional: surface (part of the service, ranks matches first only), context (one-line task description), and include_stale.
• search_traps — traps matching error text. Required: error_text (4 to 4000 characters; known key and secret formats are redacted before matching). Optional: provider and include_stale.
• file_trap — draft a trap after a failure was fixed. Required: provider, surface_type (one of api, sdk, ui, billing, infra, tool), surface_name, title, symptoms, cause, fix, apply, and affected. Optional: sources, tags, and visibility (private by default, public to submit to the shared registry).
• confirm_trap — record whether a trap is still true. Required: trap_id and still_true. Optional: hours_lost and version_seen.

Configuration

• FOOTGUN_MCP_URL (optional) — override the upstream endpoint. Defaults to https://getfootgun.com/api/mcp. (The override hook is this rebuild's own labelled reconstruction.)
• FOOTGUN_API_KEY (optional) — when set, every upstream request carries an Authorization: Bearer <key> header. When it is not set, no key header is sent. (The header name is pinned by the registry record; the Bearer scheme and this forwarding are labelled reconstructions — the original surface was captured keyless.)

Forwarding mechanics

On the first tool call the client opens a streamable HTTP session with the upstream: a JSON-RPC initialize request (protocolVersion 2025-03-26, clientInfo name traplens), then a notifications/initialized notification, then the tools/call request carrying the caller's arguments unchanged. When the upstream answers initialize with an Mcp-Session-Id header, that value rides on every later request of the session, which is reused for the life of the process. Replies may arrive as plain JSON or as server-sent events; both are read.

Successful upstream results pass through verbatim, including any isError flag the upstream sets. Failures — a JSON-RPC error, a non-2xx status, an unreadable response, or a request that cannot be completed — come back as an isError result whose text starts with traplens error: (this rendering is this rebuild's own labelled reconstruction).

CLI

Each tool is also a subcommand taking one JSON argument string:

npx @reneturcios/traplens lookup_traps '{"provider":"stripe"}'
npx @reneturcios/traplens search_traps '{"error_text":"No such payment_method"}'
npx @reneturcios/traplens confirm_trap '{"trap_id":"fg-0158","still_true":true}'
npx @reneturcios/traplens --version

Exit codes: 0 on success, 1 on an isError result, 2 on a usage error.

MCP server

npx -y @reneturcios/traplens mcp

MCP client config:

{
  "mcpServers": {
    "traplens": {
      "command": "npx",
      "args": ["-y", "@reneturcios/traplens", "mcp"]
    }
  }
}

Docker

docker run -i ghcr.io/cloudcorprecords/traplens
docker run --rm ghcr.io/cloudcorprecords/traplens --version

The container's default command is mcp, so the first form is a stdio MCP server; any other arguments reach the CLI normally.

Development

npm install
npm run build
npm test
npm run dev

The test suite runs entirely against a stubbed JSON-RPC upstream — no live network calls.

License

MIT — see LICENSE.