Reference
Know what stays in a local debug profile
The New Debug Bar keeps short-lived request evidence on your machine. Exact values are useful for debugging, so choose stricter capture policies when the development environment is shared or uses sensitive data.
-
Capture
Retain useful local evidence within configured bounds and value policies. -
Store
Write short-lived profiles into the app’s private runtime directory. -
Inspect
The browser and MCP read what remains in that profile.
The package runs only in allowed environments
The default allowed environment is local. When the package is disabled or the current Laravel environment is not allowed, profiling, package routes, the browser interface, and the MCP server stay inactive.
Profiles contain debugging evidence
A profile can contain request details, route and user context, query SQL and bindings, model identifiers and changes, cache and Redis keys, log context, exception frames and source context, validation messages, view data, mail previews, notification payloads, HTTP metadata, and other values produced during the request.
The exact inspectors depend on what happened. The New Debug Bar does not invent missing evidence, and it does not need every inspector to be populated for a profile to be useful.
Profiles use private short-lived files
The default directory is storage/framework/newdebugbar. Profile files are written atomically with private file permissions, and the generated directory ignores its contents so normal local use does not dirty the repository.
- The latest 20 profiles are retained by default.
- Profiles older than 60 minutes expire by default.
- Pruning happens as new profiles are stored and expired profiles are read.
- A custom path should remain private and outside version control.
Collection is bounded before storage
The package limits records, nested arrays, depth, string length, mail bodies, attachment bodies, call-site frames, exception evidence, and findings. Large inspectors may report that data was dropped or truncated instead of growing without a bound.
Set value policies before capture
| Policy | Values | Use it when |
|---|---|---|
query_bindings: full | Exact bounded bindings | Normal private local debugging |
query_bindings: safe | String bindings masked | Query shape matters more than string values |
query_bindings: none | Bindings omitted | No binding values should be retained |
key_policy: hash | Stable key hashes | Matching operations is enough without exact keys |
Policies apply at capture time. The browser and MCP server read the same retained profile, so neither can recover a value that was masked or omitted.
The browser and MCP read local profiles
The injected browser interface requests one selected profile and one inspector inspector at a time. The local MCP server exposes read-only tools with item and byte limits, and its generic data tool follows bounded paths into retained profile values.
An MCP client must be able to start the Laravel app’s local Artisan command. The New Debug Bar does not upload profiles to a hosted service.
What is retained, summarized, or live-only?
| Evidence | What to expect |
|---|---|
| SQL bindings and cache or Redis keys | Exact bounded values by default, with the documented alternative policies. |
| HTTP headers and text or JSON bodies | Bounded retained content with common credential fields and sensitive keys redacted. Multipart and binary bodies are omitted. |
| Event payloads | Types, public field names, counts, and shape rather than raw event payload values. |
| Direct Redis commands | Command, recognized keys, connection, timing, failure state, source, and available exception class. No arbitrary arguments or returned values. |
| View data | Bounded retained values. Renderable objects and lazy component methods may be represented by class labels rather than being executed. |
| Command input | Argument and option names rather than their values or a full terminal transcript. |
| Livewire | Saved server metadata and activity, plus separate live browser state and browser-only traces while the page exists. |
| EXPLAIN | An explicit current database action in the browser; do not assume its result was saved in the original profile. |
Capture limits and response limits are different
A capture limit decides which values reach storage. An MCP response limit decides how much retained evidence fits in one reply. Follow a returned path or cursor to read the next part; capture again if the needed value was omitted before storage.
See Configuration for all limits and Find missing profiles and data for a decision path.
Know which tool handles the model context
The package stores profiles locally and exposes the local MCP command. Your coding client decides what tool results it sends to its model provider. The New Debug Bar does not manage that client’s conversation or provider settings.
Next step
Choose your capture settings
Publish the configuration only when you need different retention, limits, environments, bindings, or key behavior.
Open configuration