PlugWiki
memlab logo

MemLab MCP Server (Meta): Setup for Claude, Cursor and Other Apps

OfficialLocal
Getnpm@memlab/mcp-servermeta/memlab

Lets Claude, Cursor and other assistants analyze JavaScript heap snapshots to find memory leaks and show what holds memory.

This is the MCP server that ships with Meta's MemLab project. It runs on your computer and reads heap snapshot files from Chrome or Node.js. The assistant can then explain what the heap is made of, who keeps an object alive, and whether memory grows over a series of snapshots. Nothing is sent to a service, and no account is needed.

It is big: about 150 tools, most of which only read a snapshot. Some run JavaScript the assistant writes, and one can delete snapshot files. Read the safety notes before you connect it to anything you care about. For a first try, start with the tool named memlab_app_heap.

Good for

  • Web and Node developers chasing a memory leak with a heap snapshot
  • Performance engineers who compare snapshots taken while an action repeats
  • Teams who want a fix checked: did the growth rate really drop

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install memlab MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the memlab MCP server to Claude Code. Run this command:
    
    claude mcp add memlab -e NODE_OPTIONS=--max-old-space-size=8192 -- npx -y -p @memlab/mcp-server memlab-mcp
    
    Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

Read-only mode: There is no read-only mode. Add MEMLAB_DISABLE_CODE_TOOLS=1 to turn off the tools that run JavaScript. The capture, prune and report-writing tools stay on unless you pick tool groups with MEMLAB_TOOLSETS.

Use the npx form from the README: -p names the package and memlab-mcp is the program to run, because the package has two programs. NODE_OPTIONS is optional: the server starts without it, but the README advises --max-old-space-size=8192 or higher because large heap snapshots can run out of memory on Node's default limit. Use a larger number for big snapshots. Node.js 18 or later is needed. To turn off every tool that runs caller-supplied JavaScript, add MEMLAB_DISABLE_CODE_TOOLS=1 to the same env settings. Claude Code and Codex users can also install the memlab plugin, which adds the server together with skills.

Built from the package data we hold. Not yet tested by us.

Tools

  • Measures how much heap is JavaScript source text.

    Counts the JavaScript source text kept in the heap and flags a bundle that is held in memory more than once, which is often the largest single item in a browser heap.

    Files · memlab_script_census

  • Lists every property name used in the heap.

    Builds an index of all distinct property names, how many objects carry each one and which classes they belong to, so you can discover what an app stores before searching for a specific field.

    Files · memlab_property_names

  • Counts the async work still waiting to run.

    Reports pending React scheduler tasks (split into live and cancelled), timer callbacks and unsettled Promises with the shapes that own them, to spot timers or tasks piling up.

    Files · memlab_async_census

  • Ranks unsettled Promises by how many callbacks wait on them.

    Lists Promises that never settled, ordered by the length of their callback chain, with retained size and owner path, because one stuck Promise can hold a long chain of callbacks alive.

    Files · memlab_pending_promises

  • Shows how much of the heap is the application itself.

    Subtracts bundle and code memory, dev-build leftovers and measurement-tool content from the total, so you see what the app really uses. A good first call on an unfamiliar app.

    Try: “What is this heap made of, app data or bundle code?”

    Files · memlab_app_heap

  • Splits the whole heap into non-overlapping rows.

    Answers "what is using the memory?" with one table where every byte lands in exactly one row, grouping React, collections, event records and modules, and it works on minified code.

    Files · memlab_memory_partition

  • Shows where memory sits as a tree.

    Draws the shortest-retainer-path tree from the GC roots with the bytes under each branch, expanding only large branches, so the sums add up and shared caches show their true size.

    Files · memlab_path_tree

  • Measures what one loaded record costs per model type.

    For Backbone-style collections, reports how many records are loaded and what one record costs, including its property store and the arrays it holds, even in minified code.

    Files · memlab_model_census

  • Groups pending timers by the function they will run.

    Finds scheduled tasks and timers, unwraps error-guard wrappers to the real callback, and shows what each group of callbacks keeps alive.

    Files · memlab_timers

  • Sizes the common framework buffers in one call.

    Probes for recurring buffers such as in-memory log arrays, module timing records, the scheduler queue, module tables and objects with thousands of properties, and reports their size.

    Files · memlab_framework_buffers

  • Takes fresh heap snapshots of a running page and its workers.

    Connects to Chrome over the DevTools Protocol, without a script, and saves heap snapshots of a live page and its dedicated workers, which a page snapshot alone would never include.

    Try: “Take snapshots of the page open in Chrome.”

    Write · memlab_capture

  • Splits one snapshot by JavaScript realm.

    Lists each realm (the page, iframes, extension worlds, detached windows) with the bytes it owns alone, the bytes shared between realms and the bytes no realm reaches.

    Files · memlab_native_contexts

Read from the source code

Permissions

high risk · 5 things to watch

High risk

Most tools only read snapshot files, but some run JavaScript the assistant writes and one can delete files. Keep manual approval on, and switch off the code-running tools if you do not need them.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • Some tools run code the assistant writes

    About a dozen tools run JavaScript from the assistant with the full privileges of the server process, and the README says node:vm is not a security sandbox. Set MEMLAB_DISABLE_CODE_TOOLS=1 unless you need them, and keep manual approval on. github.com

  • One tool can delete snapshot files

    The prune tool can compress a round's snapshots in place or delete them. Its default only reports what it would do, but approve any delete mode call yourself. github.com

  • Some tools write files outside the heap

    Capture writes snapshots, and the battery, finding and metric tools write reports and small state files. Check the folders they write to. github.com

  • Snapshots can contain private data

    Heap snapshots hold page data such as tokens and personal text, and the assistant reads them. Use the anonymize tool before sharing a capture. github.com

  • Large snapshots can crash the server

    It loads whole snapshots in memory and refuses ones that will not fit. Raise the memory limit in NODE_OPTIONS for big files. github.com

Security advisories

No published security advisories as of Nov 1, 2026.

Technical details
Turning on read-onlyNo read-only mode. MEMLAB_DISABLE_CODE_TOOLS=1 turns off every tool that runs caller-supplied JavaScript, and MEMLAB_TOOLSETS limits the tool groups.
Talks toA Chrome you start with remote debugging, on your own computer, when the capture tool is used
Sign-in and keysNo account or key is needed.

Questions

Is the MemLab MCP server official?

Yes. It ships inside Meta's MemLab repository as the @memlab/mcp-server package.

What do I need to analyze?

A heap snapshot file from Chrome DevTools or Node.js. For finding leaks, take several snapshots while the same action repeats. The server loads them from disk and can also capture from a running Chrome.

Does it send my data anywhere?

Not to a MemLab service. It runs on your computer and reads local files. Your AI app still receives what the tools return, so anonymize a snapshot before sharing sensitive ones.

Can I stop it from running code?

Yes. Set MEMLAB_DISABLE_CODE_TOOLS=1 in the server's env settings. That turns off every tool that runs JavaScript supplied by the assistant.

Why does it crash on a big snapshot?

It keeps the whole snapshot in memory, several times its file size. Raise the limit with --max-old-space-size in NODE_OPTIONS. The server also refuses files it knows will not fit.

Why so many tools?

The README groups them by question: what the heap is made of, whether anything grows, who owns the growth, and whether a result is real. MEMLAB_TOOLSETS can expose only some groups, such as the core everyday tools.

Is it free?

Yes. It is open source under the MIT license.

Information

updated Nov 2, 2026

Publisher
Official
Package
@memlab/mcp-server
Registry
npm
Transport
stdio
Auth
None
Version
2.313.0
License
MIT
Last commit
Oct 30, 2026
Open issues
12

WebsiteGitHubnpmIssues

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 2
  1. github.com · github.com
  2. registry.npmjs.org · registry.npmjs.org

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.