Reference
Know what stays in a local debug profile
New Debug Bar keeps short-lived request evidence on your machine. Exact values are useful for debugging, so choose stricter capture policies when the development environment is shared or uses sensitive data.
The package runs only in allowed environments
The default allowed environment is local. When the package is disabled or the current Laravel environment is not allowed, profiling, package routes, the browser interface, and the MCP server stay inactive.
Profiles contain debugging evidence
A profile can contain request details, route and user context, query SQL and bindings, model identifiers and changes, cache and Redis keys, log context, exception frames and source context, validation messages, view data, mail previews, notification payloads, HTTP metadata, and other values produced during the request.
The exact sections depend on what happened. New Debug Bar does not invent missing evidence, and it does not need every section to be populated for a profile to be useful.
Profiles use private short-lived files
The default directory is storage/framework/newdebugbar. Profile files are written atomically with private file permissions, and the generated directory ignores its contents so normal local use does not dirty the repository.
- The latest 20 profiles are retained by default.
- Profiles older than 60 minutes expire by default.
- Pruning happens as new profiles are stored and expired profiles are read.
- A custom path should remain private and outside version control.
Collection is bounded before storage
The package limits records, nested arrays, depth, string length, mail bodies, attachment bodies, call-site frames, exception evidence, and findings. Large sections may report that data was dropped or truncated instead of growing without a bound.
Set value policies before capture
| Policy | Values | Use it when |
|---|---|---|
query_bindings: full | Exact bounded bindings | Normal private local debugging |
query_bindings: safe | String bindings masked | Query shape matters more than string values |
query_bindings: none | Bindings omitted | No binding values should be retained |
key_policy: hash | Stable key hashes | Matching operations is enough without exact keys |
Policies apply at capture time. The browser and MCP server read the same retained profile, so neither can recover a value that was masked or omitted.
The browser and MCP read local profiles
The injected browser interface requests one selected profile and one inspector section at a time. The local MCP server exposes read-only tools with item and byte limits, and its generic data tool follows bounded paths into retained profile values.
An MCP client must be able to start the Laravel app’s local Artisan command. New Debug Bar does not upload profiles to a hosted New Debug Bar service.
Next step
Choose your capture settings
Publish the configuration only when you need different retention, limits, environments, bindings, or key behavior.
Open configuration