MCP DevTools Server (rshade/mcp-devtools-server) is an MCP server listed on the M8ven Trust Index. It scores 62 out of 100, grade C. It declares 79 tools. No publisher has claimed this listing.

C
Caution
62/100

MCP DevTools Server

An MCP server that standardizes and binds development tool patterns, enabling AI assistants like Claude Code to generate code more efficiently with fewer errors and better autocorrection.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

rshade

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// tools this server exposes79 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

make_lint

Run make lint command to check code style and quality

make_test

Run make test command to execute project tests

make_depend

Run make depend command to install or update dependencies

make_build

Run make build command to build the project

make_clean

Run make clean command to clean build artifacts

markdownlint

Run markdownlint on markdown files

yamllint

Run yamllint on YAML files

commitlint

Run commitlint to validate commit messages

eslint

Run ESLint on JavaScript/TypeScript files

lint_all

Run all available linters based on project type

run_tests

Run tests using the detected test framework

go_test

Run Go tests with coverage and race detection

go_build

Build Go packages with cross-compilation and custom build flags support

go_fmt

Format Go code using gofmt

go_lint

Lint Go code using golangci-lint with comprehensive configuration options

go_vet

Examine Go source code and report suspicious constructs

go_mod_tidy

Tidy Go module dependencies

go_mod_download

Download Go module dependencies

staticcheck

Run staticcheck for enhanced Go static analysis

go_benchmark

Run Go benchmarks to measure code performance

go_generate

Run go generate to execute code generation directives

go_work

Manage Go workspaces (go.work files)

go_vulncheck

Scan for known vulnerabilities using govulncheck

go_project_info

Get comprehensive Go project information and analysis

nodejs_project_info

Get comprehensive Node.js project information (package.json, dependencies, frameworks)

nodejs_test

Run Node.js tests with Jest, Vitest, or Mocha

nodejs_lint

Run ESLint on Node.js/TypeScript code

nodejs_format

Format code with Prettier

nodejs_check_types

Run TypeScript type checking

nodejs_install_deps

Install Node.js dependencies with npm, yarn, pnpm, or bun

nodejs_version

Get version information for Node.js tools (node, npm, yarn, pnpm, bun) with caching

nodejs_security

Run security audit with npm/yarn audit to detect vulnerabilities

nodejs_build

Run build script with package manager (npm/yarn/pnpm/bun)

nodejs_scripts

Run or list npm scripts from package.json with caching

nodejs_benchmark

Run performance benchmarks with Vitest, benchmark.js, or custom scripts

nodejs_update_deps

Update Node.js dependencies with support for different package managers

nodejs_compatibility

Check Node.js version compatibility and validate against package.json engines field

nodejs_profile

Profile Node.js application performance using built-in Node.js profiler

nodejs_package_info

Fetch package information from npm registry including latest versions, compatibility, and peer dependencies to help avoid audit issues

project_status

Get overall project health and available make targets

test_status

Get project test status and recommendations

actionlint

Validate GitHub Actions workflow files for syntax errors, invalid parameters, and best practices

jq_query
ensure_newline
dotenv_environment
code_review

Perform automated code review analysis on Git changes

generate_pr_message

Generate a PR message based on Git changes

analyze_command

Execute a command and analyze the result with AI-powered smart suggestions. Provides intelligent recommendations for fixing failures, optimizing workflows, and identifying issues.

analyze_result

Analyze an already-executed command result and generate smart suggestions. Useful for post-mortem analysis and understanding failures.

get_knowledge_base_stats

Get statistics about the smart suggestions knowledge base, including total patterns and categorization.

recommend_mcp_servers

Get intelligent recommendations for best-practice MCP servers based on project context. Suggests MCP servers like Sequential Thinking, Context7, Playwright, and others.

onboarding_wizard

Run intelligent zero-configuration onboarding wizard to detect project type, generate configuration, verify tools, and validate setup

detect_project

Analyze project and generate comprehensive profile including type, language, framework, build system, and tooling

generate_config

Generate MCP DevTools configuration preview based on project detection without writing to file

validate_setup

Validate existing MCP DevTools configuration and setup, checking commands, tools, and configuration validity

rollback_setup

Rollback to a previous configuration from backup

get_current_datetime

Get current date and time with rich temporal context for LLM awareness. Provides human-readable format, timezone info, calendar context (quarter, week, day-of-year), and relative calculations.

python_project_info

Analyze Python project configuration, dependencies, and structure (pyproject.toml, setup.py, requirements.txt detection with caching)

python_test

Run Python tests using pytest with coverage reporting and test selection

python_lint

Lint Python code using ruff check with auto-fix support

python_format

Format Python code using ruff format with check mode support

python_check_types

Check Python types using pyright with watch and verbose mode support

python_install_deps

Install Python dependencies using uv, poetry, pipenv, or pip with package manager auto-detection

python_version

Get version information for Python tools (python, pip, uv, poetry, pyright, ruff, pytest) with caching

python_security

Scan for known vulnerabilities using bandit (code issues) and pip-audit (dependencies)

python_build

Build Python packages (wheels and sdists) using modern python -m build

python_venv

Manage Python virtual environments (create, delete, info, list packages)

python_benchmark

Run performance benchmarks using pytest-benchmark with statistical analysis

python_update_deps

Check for outdated packages and update dependencies safely with compatibility checking

python_compatibility

Check Python version compatibility using vermin and suggest syntax upgrades with pyupgrade

python_profile

Profile Python code performance using cProfile, py-spy, or memray

lint_files

Run custom linting rules on project files

check_conventions

Check project conventions and architecture rules

branch_create

Create a new stacked branch

branch_checkout

Checkout an existing branch

stack_submit

Submit entire stack as pull requests

stack_restack

Rebase stack on latest changes

log_short

View current stack visualization

repo_sync

Sync with remote and cleanup merged branches

// known CVEs in dependencies3 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.23.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.23.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.23.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowuuid@13.0.0GHSA-w5hq-g745-h8pq

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configLOG_LEVELe =debug \
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

79/79 tools missing one or more hints — make_lint (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); make_test (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); make_depend (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +76 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 1/79 tools referenced in tests (1%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

3 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.23.0 (high), @modelcontextprotocol/sdk@1.23.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/rshade/mcp-devtools-server?variant=verified)](https://m8ven.ai/mcp/rshade/mcp-devtools-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: a78c91b22f9348dcdfdfb452ba8a76e65ab7b1db
code hash: e4d3036a5a4a9692facf56e2e0da3fd74f291fad6f5ba431f910ca4297580379
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client