devbelt-mcp (regaing/devbelt-mcp) is an MCP server listed on the M8ven Trust Index. It scores 66 out of 100, grade C. It declares 77 tools. No publisher has claimed this listing.
An MCP server that bundles 53 online utility tools (164 capabilities) for AI assistants, covering JSON processing, encryption/decryption, code formatting, text conversion, unit conversion, network queries, QR/barcode generation, and reference lookups via natural language calls.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
regaing
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
code_formatcode_obfuscateJS 代码混淆(单向操作,无法还原)与还原美化。obfuscate 使用 javascript-obfuscator;beautify 仅做格式化还原(不恢复混淆语义)。禁止用于隐藏恶意逻辑
regex_tool正则表达式测试/提取/替换。action=test 返回是否匹配;extract 返回所有匹配与捕获组;replace 用 replacement 替换
regex_generate为正则表达式生成各语言代码(js/java/go/php/ruby/python/cs)
xpath_tool简易 XPath 提取:支持 //tag、tag、tag[@attr="value"]、/text() 形式(基于正则的轻量实现,不支持复杂轴表达式)
crypto_hashcrypto_symmetriccrypto_morse摩尔斯电码加密/解密。支持英文、数字、常用标点;中文先转拼音再编码
crypto_download_url下载地址加解密:迅雷(thunder://)、快车(flashget://)、旋风(qqdl://)。输入普通 http(s) 地址或对应前缀的密文
color_convert颜色格式互转:HEX(#RRGGBB)↔ RGB(rgb(r,g,b) 或 r,g,b)
crypto_jwtJWT 编解码与校验:解出 header/payload(不校验)、校验 HS256 签名与过期时间
crypto_rsaRSA 非对称加解密与签名:生成密钥对/公钥加密/私钥解密/私钥签名/公钥验签
crypto_password_hashbcrypt 密码哈希与校验(bcryptjs 纯 JS):注册/登录场景的密码存储与验证
data_html_convertHTML 与其他代码/标记格式互转。target 可选 js/php/cs/jsp/asp/perl/ubb/markdown;ubb 支持双向(direction=to_html 时输入 UBB)
data_html_table生成 HTML 表格:输入 CSV(首行为表头)或 JSON 数组,输出 <table> 代码
data_excel_jsonExcel/CSV ↔ JSON 转换。json_to_excel:JSON 数组写入 xlsx 文件(需 output_path);excel_to_json:读取 xlsx/csv 文件输出 JSON
data_text_diff文本/代码差异比较。mode 可选 lines(按行)/chars(按字符)/words(按词)
data_csvCSV 处理(复用 xlsx):解析 CSV→JSON / JSON→CSV,支持文件或文本输入
encode_urlURL 编码/解码(encodeURIComponent 风格,中文与特殊字符转 %XX)
encode_base64Base64 编码/解码。mode=text 处理字符串;mode=image 时:encode 将本地图片转为 dataURL,decode 将 base64 写回图片文件(需 output_path)
encode_unicodeUnicode(\uXXXX)与字符互转。encode=中文/字符转 \uXXXX 形式;decode=\uXXXX 还原为字符
encode_utf8UTF-8 编码与中文互转。encode=中文转 %XX 十六进制字节串;decode=字节串还原中文
encode_asciiASCII 编码/解码。encode=字符转十进制与十六进制码;decode=码值转字符(支持 10 进制或 0x 前缀 16 进制)
encode_escapeEscape 编码/解码(JS escape 风格:%XX / %uXXXX)
encode_radix任意进制互转(2~36 进制,支持大数)。例:value=255, from_base=10, to_base=16 → ff
encode_detect文本编码检测(jschardet):检测字符串/文件的字符编码(UTF-8/GBK/GB2312/UTF-16 等)
encode_htmlHTML 实体编解码:<>&"' 与 <>&"' 互转(支持数字实体)
json_processJSON 格式化/压缩/转义/去除转义/校验。action 可选 format(美化)、compress(压缩)、escape(转义)、unescape(去除转义)、validate(仅校验)
json_convertJSON 与其他格式互转。target 可选 xml(JSON↔XML)、yaml(JSON↔YAML)、get_params(JSON 对象↔GET 参数字符串)
json_entity从 JSON 或 SQL CREATE TABLE 生成实体类代码。input_type 可选 json/sql,language 可选 cs(C#)/java/go
json_pathJSONPath 提取(jsonpath-plus 完整语法):从 JSON 按路径提取(如 $.data.list[0].name / $..name / $.list[?(@.age>18)])
json_schema_validateJSON Schema 校验(ajv,draft-07):校验 JSON 数据是否符合 schema,返回详细错误
misc_barcode条形码生成。type 可选 ean8/ean13/code39/code128/upca,format 可选 png(base64)或 svg。output_path 可保存文件
misc_qrcode二维码生成。format 可选 png(base64 dataURL)/svg;error_level 纠错等级 L/M/Q/H;output_path 可保存文件
misc_faviconfavicon.ico 生成:将 PNG 图片封装为 ICO(Vista+ PNG-ICO 格式)。image 支持本地路径或 base64(dataURL)。尺寸由 PNG 决定(≤256px)
misc_shortcut生成 Windows 桌面快捷方式(.url 文件内容)。output_path 可保存为 .url 文件
misc_reference常用参考表查询。topic 可选:http_status/http_method/content_type/ports/dns/ascii/dynasty/ethnic/keycode/glyphicons/currency/capital/areacode/symbols/android_manifest/ua/festival。keyword 可选过滤
misc_calendar万年历查询(lunar-typescript 纯本地计算,零三方接口):按日期查公历/农历/干支/生肖/节气/节日/宜忌,或按月查完整月历
misc_qrcode_decode二维码解码(jsqr + pngjs):从 PNG 图片识别二维码内容(本地路径或 base64 dataURL)
misc_calc数学表达式计算(mathjs):支持四则/函数/常量/矩阵(如 2*(3+4)^2、sin(pi/2)、sqrt(16))
net_whoisWHOIS 域名信息查询(原生实现:连接 whois.iana.org 递归查询权威服务器,不依赖第三方接口)
net_icpICP 备案查询(工信部官方接口):输入域名查询备案号、主办单位等信息
net_url_statusURL 状态检测:返回 HTTP 状态码、关键响应头、最终地址
net_gzip_checkGzip 压缩检测:检查服务器是否开启 gzip 及压缩前后大小对比
net_dead_link网站死链检测:抓取页面提取链接并逐个检查 HTTP 状态(默认最多检查 20 个)
net_fetch网页抓取/内容采集:抓取 URL 返回解码后的文本(自动处理 GBK/GB2312 编码)。fake_ip=true 时可伪装国内 IP(谨慎使用)
net_meta_analyze网页 Meta 标签分析:抓取页面提取 title/keywords/description 并给出长度建议
net_keyword_density网页关键词密度检测:抓取页面统计指定关键词出现次数与密度
net_websocket_testWebSocket 完整会话测试:连接(显示握手协议/扩展)→ 按序发送消息 → 协议级 ping(RTT)→ 收集全部响应 → wait_for 匹配期望响应 → 空闲自动关闭。支持文本/JSON 消息
net_ip_infoIP 信息查询(纯本地,无三方接口):不传 ip 返回本机网卡信息;传 ip 查询归属地/类型(内置精简段表)
net_dns_queryDNS 解析查询(node:dns 原生实现,零三方接口)。支持 A/AAAA/CNAME/MX/TXT/NS/SOA/PTR/ANY,可指定自定义 DNS 服务器
net_http_requestHTTP 请求调试(curl 等价):支持 GET/POST/PUT/DELETE/PATCH/HEAD、自定义 header/body、JSON 自动序列化、multipart/form-data 文件上传、重定向控制、超时
net_ssl_checkSSL 证书检查(node:tls):查询域名证书有效期/剩余天数/签发者/主题/证书链
net_port_checkTCP 端口连通性检测(node:net):检测目标主机端口是否开放(tcping 等价)
text_case英文大小写转换:upper 全大写 / lower 全小写 / title 首字母大写 / camel 驼峰 / snake 下划线
text_jianfan简体/繁体互转。action=to_traditional 简体转繁体;to_simplified 繁体转简体
text_pinyin汉字转拼音。output=pinyin 返回拼音;tone 带声调;initial 仅声母/首字母
text_fullwidth全角/半角互转。to_full=半角转全角;to_half=全角转半角(含中文标点:。、《》等)
text_flip文本翻转/倒序。full=全文反转;line=每行内反转;reverse_lines=行序反转
text_vertical文字竖排(传统中文排版):将文本按指定列数从上到下竖排输出
text_stats字数统计:总字符、汉字、字母、数字、空格、标点、行数、单词数
text_dedup文本行去重。sort=true 时结果排序,keep_first=false 保留最后一次出现
text_replace文本查找替换。use_regex=true 时 find 作为正则表达式处理
text_filterHTML 标签过滤:移除 script/style 与标签,可选保留指定标签,可选替换为自定义文本
text_format文章自动排版:首行缩进、段落合并、清理多余空行与行首尾空格
text_random随机数/密码生成。type=number:min/max/count/unique;type=password:length/charset
text_martian火星文转换:to_martian 汉字转火星文;to_chinese 火星文还原汉字(仅支持映射表内字符)
uuid_generateUUID/GUID 批量生成。format=uuid(8-4-4-4-12)或 guid;case 控制大小写
text_idcard身份证号解析(GB 11643-1999 纯本地算法,零三方接口):校验 18/15 位、解析省市区/生日/性别/年龄、15 位转 18 位
text_password_strength密码强度评估:基于长度/字符集/熵计算评分(0-100),返回强度等级与改进建议
time_timestamp时间戳转换(全面版):时间戳↔日期互转。支持秒/毫秒/微秒/纳秒(自动识别位数或指定 unit)、ISO8601/RFC2822/中文/相对时间(now±1d)输入、UTC/本地/自定义时区输出,附带星期/ISO周/闰年等信息。省略 value 返回当前时间
time_convert多时区时间显示:同一时刻在 UTC/本地/常用城市时区的时间对照(支持自定义 ±HH:mm 或时区名,逗号分隔)
time_diff时间差/倒计时:计算两个时间点的差值(各精度 + 人类可读 + 组件分解),支持时间戳/日期/相对时间
time_croncron 表达式解析:人类可读描述 + 未来 N 次执行时间(cron-parser 纯本地)
time_duration时长人类可读化(双向):秒数 → '1天2小时3分4秒' + 各精度换算;或可读字符串 → 秒数
time_format时间自定义格式化(strftime 风格):支持 YYYY/MM/DD/HH/mm/ss/ddd/Q 等占位符与 %Y-%m-%d 兼容格式,可指定时区
unit_convertDisclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Prototype Pollution in sheetJS
SheetJS Regular Expression Denial of Service (ReDoS)
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
77/77 tools missing one or more hints — code_format (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); code_obfuscate (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); regex_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +74 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Production dependencies are patched
0 critical, 2 high severity in production deps — xlsx@0.18.5 (high), xlsx@0.18.5 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Dependency freshness
1/25 production deps stale: pngjs@2023-02-20 (3.5y)
Domain consistency
npm scope @lingxi-agent doesn't match GitHub owner regaing
Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/regaing/devbelt-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check