devbelt-mcp (regaing/devbelt-mcp) is an MCP server listed on the M8ven Trust Index. It scores 66 out of 100, grade C. It declares 77 tools. No publisher has claimed this listing.

C
Caution
66/100

devbelt-mcp

An MCP server that bundles 53 online utility tools (164 capabilities) for AI assistants, covering JSON processing, encryption/decryption, code formatting, text conversion, unit conversion, network queries, QR/barcode generation, and reference lookups via natural language calls.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

regaing

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
// tools this server exposes77 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

code_format
code_obfuscate

JS 代码混淆(单向操作,无法还原)与还原美化。obfuscate 使用 javascript-obfuscator;beautify 仅做格式化还原(不恢复混淆语义)。禁止用于隐藏恶意逻辑

regex_tool

正则表达式测试/提取/替换。action=test 返回是否匹配;extract 返回所有匹配与捕获组;replace 用 replacement 替换

regex_generate

为正则表达式生成各语言代码(js/java/go/php/ruby/python/cs)

xpath_tool

简易 XPath 提取:支持 //tag、tag、tag[@attr="value"]、/text() 形式(基于正则的轻量实现,不支持复杂轴表达式)

crypto_hash
crypto_symmetric
crypto_morse

摩尔斯电码加密/解密。支持英文、数字、常用标点;中文先转拼音再编码

crypto_download_url

下载地址加解密:迅雷(thunder://)、快车(flashget://)、旋风(qqdl://)。输入普通 http(s) 地址或对应前缀的密文

color_convert

颜色格式互转:HEX(#RRGGBB)↔ RGB(rgb(r,g,b) 或 r,g,b)

crypto_jwt

JWT 编解码与校验:解出 header/payload(不校验)、校验 HS256 签名与过期时间

crypto_rsa

RSA 非对称加解密与签名:生成密钥对/公钥加密/私钥解密/私钥签名/公钥验签

crypto_password_hash

bcrypt 密码哈希与校验(bcryptjs 纯 JS):注册/登录场景的密码存储与验证

data_html_convert

HTML 与其他代码/标记格式互转。target 可选 js/php/cs/jsp/asp/perl/ubb/markdown;ubb 支持双向(direction=to_html 时输入 UBB)

data_html_table

生成 HTML 表格:输入 CSV(首行为表头)或 JSON 数组,输出 <table> 代码

data_excel_json

Excel/CSV ↔ JSON 转换。json_to_excel:JSON 数组写入 xlsx 文件(需 output_path);excel_to_json:读取 xlsx/csv 文件输出 JSON

data_text_diff

文本/代码差异比较。mode 可选 lines(按行)/chars(按字符)/words(按词)

data_csv

CSV 处理(复用 xlsx):解析 CSV→JSON / JSON→CSV,支持文件或文本输入

encode_url

URL 编码/解码(encodeURIComponent 风格,中文与特殊字符转 %XX)

encode_base64

Base64 编码/解码。mode=text 处理字符串;mode=image 时:encode 将本地图片转为 dataURL,decode 将 base64 写回图片文件(需 output_path)

encode_unicode

Unicode(\uXXXX)与字符互转。encode=中文/字符转 \uXXXX 形式;decode=\uXXXX 还原为字符

encode_utf8

UTF-8 编码与中文互转。encode=中文转 %XX 十六进制字节串;decode=字节串还原中文

encode_ascii

ASCII 编码/解码。encode=字符转十进制与十六进制码;decode=码值转字符(支持 10 进制或 0x 前缀 16 进制)

encode_escape

Escape 编码/解码(JS escape 风格:%XX / %uXXXX)

encode_radix

任意进制互转(2~36 进制,支持大数)。例:value=255, from_base=10, to_base=16 → ff

encode_detect

文本编码检测(jschardet):检测字符串/文件的字符编码(UTF-8/GBK/GB2312/UTF-16 等)

encode_html

HTML 实体编解码:<>&"' 与 &lt;&gt;&amp;&quot;&#39; 互转(支持数字实体)

json_process

JSON 格式化/压缩/转义/去除转义/校验。action 可选 format(美化)、compress(压缩)、escape(转义)、unescape(去除转义)、validate(仅校验)

json_convert

JSON 与其他格式互转。target 可选 xml(JSON↔XML)、yaml(JSON↔YAML)、get_params(JSON 对象↔GET 参数字符串)

json_entity

从 JSON 或 SQL CREATE TABLE 生成实体类代码。input_type 可选 json/sql,language 可选 cs(C#)/java/go

json_path

JSONPath 提取(jsonpath-plus 完整语法):从 JSON 按路径提取(如 $.data.list[0].name / $..name / $.list[?(@.age>18)])

json_schema_validate

JSON Schema 校验(ajv,draft-07):校验 JSON 数据是否符合 schema,返回详细错误

misc_barcode

条形码生成。type 可选 ean8/ean13/code39/code128/upca,format 可选 png(base64)或 svg。output_path 可保存文件

misc_qrcode

二维码生成。format 可选 png(base64 dataURL)/svg;error_level 纠错等级 L/M/Q/H;output_path 可保存文件

misc_favicon

favicon.ico 生成:将 PNG 图片封装为 ICO(Vista+ PNG-ICO 格式)。image 支持本地路径或 base64(dataURL)。尺寸由 PNG 决定(≤256px)

misc_shortcut

生成 Windows 桌面快捷方式(.url 文件内容)。output_path 可保存为 .url 文件

misc_reference

常用参考表查询。topic 可选:http_status/http_method/content_type/ports/dns/ascii/dynasty/ethnic/keycode/glyphicons/currency/capital/areacode/symbols/android_manifest/ua/festival。keyword 可选过滤

misc_calendar

万年历查询(lunar-typescript 纯本地计算,零三方接口):按日期查公历/农历/干支/生肖/节气/节日/宜忌,或按月查完整月历

misc_qrcode_decode

二维码解码(jsqr + pngjs):从 PNG 图片识别二维码内容(本地路径或 base64 dataURL)

misc_calc

数学表达式计算(mathjs):支持四则/函数/常量/矩阵(如 2*(3+4)^2、sin(pi/2)、sqrt(16))

net_whois

WHOIS 域名信息查询(原生实现:连接 whois.iana.org 递归查询权威服务器,不依赖第三方接口)

net_icp

ICP 备案查询(工信部官方接口):输入域名查询备案号、主办单位等信息

net_url_status

URL 状态检测:返回 HTTP 状态码、关键响应头、最终地址

net_gzip_check

Gzip 压缩检测:检查服务器是否开启 gzip 及压缩前后大小对比

net_dead_link

网站死链检测:抓取页面提取链接并逐个检查 HTTP 状态(默认最多检查 20 个)

net_fetch

网页抓取/内容采集:抓取 URL 返回解码后的文本(自动处理 GBK/GB2312 编码)。fake_ip=true 时可伪装国内 IP(谨慎使用)

net_meta_analyze

网页 Meta 标签分析:抓取页面提取 title/keywords/description 并给出长度建议

net_keyword_density

网页关键词密度检测:抓取页面统计指定关键词出现次数与密度

net_websocket_test

WebSocket 完整会话测试:连接(显示握手协议/扩展)→ 按序发送消息 → 协议级 ping(RTT)→ 收集全部响应 → wait_for 匹配期望响应 → 空闲自动关闭。支持文本/JSON 消息

net_ip_info

IP 信息查询(纯本地,无三方接口):不传 ip 返回本机网卡信息;传 ip 查询归属地/类型(内置精简段表)

net_dns_query

DNS 解析查询(node:dns 原生实现,零三方接口)。支持 A/AAAA/CNAME/MX/TXT/NS/SOA/PTR/ANY,可指定自定义 DNS 服务器

net_http_request

HTTP 请求调试(curl 等价):支持 GET/POST/PUT/DELETE/PATCH/HEAD、自定义 header/body、JSON 自动序列化、multipart/form-data 文件上传、重定向控制、超时

net_ssl_check

SSL 证书检查(node:tls):查询域名证书有效期/剩余天数/签发者/主题/证书链

net_port_check

TCP 端口连通性检测(node:net):检测目标主机端口是否开放(tcping 等价)

text_case

英文大小写转换:upper 全大写 / lower 全小写 / title 首字母大写 / camel 驼峰 / snake 下划线

text_jianfan

简体/繁体互转。action=to_traditional 简体转繁体;to_simplified 繁体转简体

text_pinyin

汉字转拼音。output=pinyin 返回拼音;tone 带声调;initial 仅声母/首字母

text_fullwidth

全角/半角互转。to_full=半角转全角;to_half=全角转半角(含中文标点:。、《》等)

text_flip

文本翻转/倒序。full=全文反转;line=每行内反转;reverse_lines=行序反转

text_vertical

文字竖排(传统中文排版):将文本按指定列数从上到下竖排输出

text_stats

字数统计:总字符、汉字、字母、数字、空格、标点、行数、单词数

text_dedup

文本行去重。sort=true 时结果排序,keep_first=false 保留最后一次出现

text_replace

文本查找替换。use_regex=true 时 find 作为正则表达式处理

text_filter

HTML 标签过滤:移除 script/style 与标签,可选保留指定标签,可选替换为自定义文本

text_format

文章自动排版:首行缩进、段落合并、清理多余空行与行首尾空格

text_random

随机数/密码生成。type=number:min/max/count/unique;type=password:length/charset

text_martian

火星文转换:to_martian 汉字转火星文;to_chinese 火星文还原汉字(仅支持映射表内字符)

uuid_generate

UUID/GUID 批量生成。format=uuid(8-4-4-4-12)或 guid;case 控制大小写

text_idcard

身份证号解析(GB 11643-1999 纯本地算法,零三方接口):校验 18/15 位、解析省市区/生日/性别/年龄、15 位转 18 位

text_password_strength

密码强度评估:基于长度/字符集/熵计算评分(0-100),返回强度等级与改进建议

time_timestamp

时间戳转换(全面版):时间戳↔日期互转。支持秒/毫秒/微秒/纳秒(自动识别位数或指定 unit)、ISO8601/RFC2822/中文/相对时间(now±1d)输入、UTC/本地/自定义时区输出,附带星期/ISO周/闰年等信息。省略 value 返回当前时间

time_convert

多时区时间显示:同一时刻在 UTC/本地/常用城市时区的时间对照(支持自定义 ±HH:mm 或时区名,逗号分隔)

time_diff

时间差/倒计时:计算两个时间点的差值(各精度 + 人类可读 + 组件分解),支持时间戳/日期/相对时间

time_cron

cron 表达式解析:人类可读描述 + 未来 N 次执行时间(cron-parser 纯本地)

time_duration

时长人类可读化(双向):秒数 → '1天2小时3分4秒' + 各精度换算;或可读字符串 → 秒数

time_format

时间自定义格式化(strftime 风格):支持 YYYY/MM/DD/HH/mm/ss/ddd/Q 等占位符与 %Y-%m-%d 兼容格式,可指定时区

unit_convert
// known CVEs in dependencies1 critical2 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@2.1.9GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

highxlsx@0.18.5GHSA-4r6h-8v6p-xvw6

Prototype Pollution in sheetJS

highxlsx@0.18.5GHSA-5pgg-2g8v-p4x9

SheetJS Regular Expression Denial of Service (ReDoS)

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

77/77 tools missing one or more hints — code_format (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); code_obfuscate (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); regex_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +74 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Production dependencies are patched

0 critical, 2 high severity in production deps — xlsx@0.18.5 (high), xlsx@0.18.5 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Dependency freshness

1/25 production deps stale: pngjs@2023-02-20 (3.5y)

Domain consistency

npm scope @lingxi-agent doesn't match GitHub owner regaing

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/regaing/devbelt-mcp?variant=verified)](https://m8ven.ai/mcp/regaing/devbelt-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 4df0b700ebaef92d5cd336828f4cdec76feae816
code hash: b9e2359b3906e41a874f71df1fee2e29937920b32adb3b0d3f82c65101dc75ab
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client