mcp-server-wtf

A flight recorder for incident troubleshooting inside Claude Code. WTF captures every tool call and manual observation into a durable SQLite database that survives context compaction, then enriches raw entries through a background classifier into a distilled timeline.

• Bun runtime
• Claude Code CLI (claude)
• jq (JSON processor)
• AWS credentials for Bedrock (optional — enables background classifier)

git clone https://github.com/Wave-Engineering/mcp-server-wtf.git
cd mcp-server-wtf
./scripts/install.sh

Verify everything is configured:

./scripts/install.sh --check

# Start troubleshooting
/wtf

# Investigate the issue... Claude records tool calls automatically

# Get the distilled timeline
wtf_happened

# Add your own observations
/wtf now "DNS resolver returning stale records"

WTF is a three-layer system:

  /wtf, /wtf now          Skills (user-facing entry points)
        |
        v
  wtf_now, wtf_happened   MCP Server (journal storage, retrieval,
  wtf_freshell             background classification)
        ^
        |
  PostToolUse hook         Auto-capture (every tool call -> JSONL queue)

Layer 1 -- Skills: /wtf starts a troubleshooting session and activates flight recorder mode. /wtf now adds manual journal entries.

Layer 2 -- MCP Server: A Bun + TypeScript server exposing four tools over stdio transport. Manages a SQLite database, ingests the hook queue, and runs a background classifier (Claude Haiku via AWS Bedrock) that categorizes entries as actions, breadcrumbs, theories, or noise.

Layer 3 -- PostToolUse Hook: A shell script that fires on every Claude Code tool call, extracts relevant fields, truncates large values, and appends a JSON line to .wtf/hook-queue.jsonl for ingestion.

/wtf

Archives an