universal-dev-mcp (rj9884/universal-dev-mcp) is an MCP server listed on the M8ven Trust Index. It scores 68 out of 100, grade C. It declares 13 tools. No publisher has claimed this listing.
Connects AI tools to local dev servers, enabling them to view pages, call APIs, read/edit files, and run commands with safety guardrails.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
rj9884
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
get_api_responseMake an HTTP request to an API endpoint on a local dev server and return the full response. Supports all standard HTTP methods and an optional JSON request body. Useful for testing REST APIs, checking response shapes, and verifying status codes.
view_pageFetch the HTML content and structure of a page on a running local dev server. Returns the page title, meta tags, script sources, and visible text. Optionally returns the full raw HTML.
check_portCheck whether a dev server is currently running and responding on a given localhost port. Run this before view_page to confirm the server is up.
run_commandRun an allowlisted shell command in the project root directory (or a subdirectory via `cwd`, useful for monorepos like frontend/ + backend/). Useful for installing dependencies, running tests, linting, type-checking, and builds. Only commands explicitly listed in ALLOWED_COMMANDS may be executed.
read_fileRead the contents of a file in the project. Optionally limit output to a range of lines. Use list_files first if you are unsure of the file path.
edit_fileWrite new content to a file, replacing it entirely. A timestamped backup is automatically created in .mcp-backups/ before any change. Use patch_file instead when making a small targeted change.
patch_fileReplace a specific string or block of code within a file without rewriting the whole file. The old_string must appear exactly once in the file. A backup is created automatically before the change is applied.
list_filesList the files and directories in the project as a tree. Use this to understand project structure before reading or editing files.
delete_fileDelete a file from the project. A backup is automatically created in .mcp-backups/ before deletion. Cannot delete directories.
move_fileMove or rename a file within the project. A backup of the original is created before the move. Cannot move directories.
get_active_projectShows which project is currently active — name, root path, package info, file count, and git branch. Use this to visually confirm which project the MCP server is connected to.
get_project_infoGet a full overview of the project: package.json metadata, npm scripts, dependencies, detected config files, and a two-level file tree. Always call this first when starting to work on a new project.
search_filesSearch for a text string or regex pattern across all files in the project. Returns matching file paths, line numbers, and the matching lines. Optionally filter by file name glob (e.g. '*.ts'). Skips node_modules, hidden directories, and binary files.
ALLOWED_COMMANDSCommand allowlist — AI can only run commands listed in .ALLOWED_PORTSPort allowlist — AI can only connect to ports listed in .ALLOWED_WRITE_DIRSWrite directory scope — File writes are restricted to (defaults to PROJECT_ROOT).HTTP_PORTMCP_API_KEYAPI key — Set to require authentication on all HTTP endpoints.PROJECT_ROOTWrite directory scope — File writes are restricted to ALLOWED_WRITE_DIRS (defaults to ).Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
13/13 tools missing one or more hints — get_api_response (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); view_page (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); check_port (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +10 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Destructive tools are labelled
1 tool perform destructive updates without destructiveHint — delete_file deletes at line 361 (fs.unlinkSync(resolved))
Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.
Descriptions match behaviour
1 tool describes read intent but its handler mutates — get_active_project (line 86: childProcess.execSync("git rev-parse --abbrev-ref HEAD", {)
Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.
Tests exist
No test files found
Add tests that exercise each declared tool.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/rj9884/universal-dev-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check