Bundled CLI leaks DEBUG_MCP_SKIP_AUTO_START into debuggees, preventing mcp-debugger self-launch

[debugmcpdev]

Problem

When using the bundled mcp-debugger CLI to debug the repository's dist/index.js, the target exits successfully without starting its HTTP server. This makes self-debugging appear to run to completion even though the expected server was never started.

Reproduction and observations

1. Build mcp-debugger and run the bundled packages/mcp-debugger/dist/cli.mjs through the development proxy.
2. Create a JavaScript debug session and launch the repository's dist/index.js with args: ['http', '-p', '<free port>'] and stopOnEntry: false.
3. The launch reports state: 'stopped', exit code 0, and that the program ran to completion. The target HTTP endpoint never becomes available.

Observed on Windows / Node v24.14.1, mcp-debugger main f8d55f4493ebfc4253475cf4fc4a2faf4b90a55d, while dogfooding a locally built js-debug adapter. An isolated control with MCP_EXIT_ON_STDIN_CLOSE: '0' and DEBUG_MCP_SKIP_AUTO_START: '1' reproduces the same immediate successful exit. With both flags set to '0', the target starts, serves HTTP, and can be paused, inspected, stepped, and resumed.

Cause

packages/mcp-debugger/src/cli-entry.ts sets process.env.DEBUG_MCP_SKIP_AUTO_START = '1' before importing the source entry point and explicitly invoking main().

JavaScript launch inherits the server environment. In the debuggee, src/index.ts checks that inherited flag and skips its own main() entirely.

Expected

The bundled CLI's internal bootstrap flag should not suppress startup in subsequently launched debuggees. Avoid leaving bootstrap-only state in the inherited environment, or explicitly scope that state to the server's own initialization.

Tested workaround

Pass this in start_debugging.dapLaunchArgs.env when debugging an independent mcp-debugger server:

{
  "DEBUG_MCP_SKIP_AUTO_START": "0",
  "MCP_EXIT_ON_STDIN_CLOSE": "0"
}

The second flag opts the target out of the development proxy's parent-stdin supervision policy; the first is the startup-suppression defect isolated above. Add regression coverage for launching a second mcp-debugger process from the bundled CLI.

[debugmcpdev]

Measured the inheritance from a live session (Windows, Node 24, main f8d55f44, dev-proxy sse backend running dist/index.js), which isolates the two flags in the workaround:

What a js-debug launched debuggee inherits. A 5-line probe launched with start_debugging printed its environment and watched its own stdin for 3 s:

DEBUG_MCP_SKIP_AUTO_START=undefined      (this backend is dist/index.js, not the bundle)
MCP_EXIT_ON_STDIN_CLOSE="1"              (set by the dev-proxy for its backend, inherited)
CONSOLE_OUTPUT_SILENCED="1"              (set by src/index.ts, inherited)
stdin.isTTY=undefined
stdin events after 3s: NONE

js-debug keeps the launched child's stdin pipe open, so an inherited MCP_EXIT_ON_STDIN_CLOSE=1 is inert for launch mode: the watchdog arms but never fires. The second flag in the workaround is not needed for a launched target (it would matter for a debuggee whose stdin is closed by something else).

The mechanism, reproduced by injection. Launching dist/index.js http -p 3987 with dapLaunchArgs.env: { DEBUG_MCP_SKIP_AUTO_START: '1' } returned:

state: stopped — The program ran to completion (exit code 0)

no listening line, no server. Same launch without the override: mcp-debugger: MCP endpoint available at http://127.0.0.1:3987/mcp, a statement breakpoint on src/server/tool-dispatch.ts (const result = await TOOL_HANDLERS[toolName](...)) bound through the dist source maps, and an SDK Client over Streamable HTTP calling create_debug_session paused the child inside its own dispatch; locals showed toolName, args {language:'mock', name:'inner-mock'}, stepping over the handler created the inner session, and the client got its response when the child was continued (44 s later, the time spent paused).

So the flag alone is the whole defect for launch mode, and CONSOLE_OUTPUT_SILENCED rides along in the same class (harmless for anything that is not itself mcp-debugger, but a self-launched http child runs with its console silenced).