MCP DevTools Server (rshade/mcp-devtools-server) is an MCP server listed on the M8ven Trust Index. It scores 62 out of 100, grade C. It declares 79 tools. No publisher has claimed this listing.
An MCP server that standardizes and binds development tool patterns, enabling AI assistants like Claude Code to generate code more efficiently with fewer errors and better autocorrection.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
rshade
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
make_lintRun make lint command to check code style and quality
make_testRun make test command to execute project tests
make_dependRun make depend command to install or update dependencies
make_buildRun make build command to build the project
make_cleanRun make clean command to clean build artifacts
markdownlintRun markdownlint on markdown files
yamllintRun yamllint on YAML files
commitlintRun commitlint to validate commit messages
eslintRun ESLint on JavaScript/TypeScript files
lint_allRun all available linters based on project type
run_testsRun tests using the detected test framework
go_testRun Go tests with coverage and race detection
go_buildBuild Go packages with cross-compilation and custom build flags support
go_fmtFormat Go code using gofmt
go_lintLint Go code using golangci-lint with comprehensive configuration options
go_vetExamine Go source code and report suspicious constructs
go_mod_tidyTidy Go module dependencies
go_mod_downloadDownload Go module dependencies
staticcheckRun staticcheck for enhanced Go static analysis
go_benchmarkRun Go benchmarks to measure code performance
go_generateRun go generate to execute code generation directives
go_workManage Go workspaces (go.work files)
go_vulncheckScan for known vulnerabilities using govulncheck
go_project_infoGet comprehensive Go project information and analysis
nodejs_project_infoGet comprehensive Node.js project information (package.json, dependencies, frameworks)
nodejs_testRun Node.js tests with Jest, Vitest, or Mocha
nodejs_lintRun ESLint on Node.js/TypeScript code
nodejs_formatFormat code with Prettier
nodejs_check_typesRun TypeScript type checking
nodejs_install_depsInstall Node.js dependencies with npm, yarn, pnpm, or bun
nodejs_versionGet version information for Node.js tools (node, npm, yarn, pnpm, bun) with caching
nodejs_securityRun security audit with npm/yarn audit to detect vulnerabilities
nodejs_buildRun build script with package manager (npm/yarn/pnpm/bun)
nodejs_scriptsRun or list npm scripts from package.json with caching
nodejs_benchmarkRun performance benchmarks with Vitest, benchmark.js, or custom scripts
nodejs_update_depsUpdate Node.js dependencies with support for different package managers
nodejs_compatibilityCheck Node.js version compatibility and validate against package.json engines field
nodejs_profileProfile Node.js application performance using built-in Node.js profiler
nodejs_package_infoFetch package information from npm registry including latest versions, compatibility, and peer dependencies to help avoid audit issues
project_statusGet overall project health and available make targets
test_statusGet project test status and recommendations
actionlintValidate GitHub Actions workflow files for syntax errors, invalid parameters, and best practices
jq_queryensure_newlinedotenv_environmentcode_reviewPerform automated code review analysis on Git changes
generate_pr_messageGenerate a PR message based on Git changes
analyze_commandExecute a command and analyze the result with AI-powered smart suggestions. Provides intelligent recommendations for fixing failures, optimizing workflows, and identifying issues.
analyze_resultAnalyze an already-executed command result and generate smart suggestions. Useful for post-mortem analysis and understanding failures.
get_knowledge_base_statsGet statistics about the smart suggestions knowledge base, including total patterns and categorization.
recommend_mcp_serversGet intelligent recommendations for best-practice MCP servers based on project context. Suggests MCP servers like Sequential Thinking, Context7, Playwright, and others.
onboarding_wizardRun intelligent zero-configuration onboarding wizard to detect project type, generate configuration, verify tools, and validate setup
detect_projectAnalyze project and generate comprehensive profile including type, language, framework, build system, and tooling
generate_configGenerate MCP DevTools configuration preview based on project detection without writing to file
validate_setupValidate existing MCP DevTools configuration and setup, checking commands, tools, and configuration validity
rollback_setupRollback to a previous configuration from backup
get_current_datetimeGet current date and time with rich temporal context for LLM awareness. Provides human-readable format, timezone info, calendar context (quarter, week, day-of-year), and relative calculations.
python_project_infoAnalyze Python project configuration, dependencies, and structure (pyproject.toml, setup.py, requirements.txt detection with caching)
python_testRun Python tests using pytest with coverage reporting and test selection
python_lintLint Python code using ruff check with auto-fix support
python_formatFormat Python code using ruff format with check mode support
python_check_typesCheck Python types using pyright with watch and verbose mode support
python_install_depsInstall Python dependencies using uv, poetry, pipenv, or pip with package manager auto-detection
python_versionGet version information for Python tools (python, pip, uv, poetry, pyright, ruff, pytest) with caching
python_securityScan for known vulnerabilities using bandit (code issues) and pip-audit (dependencies)
python_buildBuild Python packages (wheels and sdists) using modern python -m build
python_venvManage Python virtual environments (create, delete, info, list packages)
python_benchmarkRun performance benchmarks using pytest-benchmark with statistical analysis
python_update_depsCheck for outdated packages and update dependencies safely with compatibility checking
python_compatibilityCheck Python version compatibility using vermin and suggest syntax upgrades with pyupgrade
python_profileProfile Python code performance using cProfile, py-spy, or memray
lint_filesRun custom linting rules on project files
check_conventionsCheck project conventions and architecture rules
branch_createCreate a new stacked branch
branch_checkoutCheckout an existing branch
stack_submitSubmit entire stack as pull requests
stack_restackRebase stack on latest changes
log_shortView current stack visualization
repo_syncSync with remote and cleanup merged branches
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
LOG_LEVELe =debug \Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
79/79 tools missing one or more hints — make_lint (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); make_test (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); make_depend (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +76 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
Only 1/79 tools referenced in tests (1%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
3 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.23.0 (high), @modelcontextprotocol/sdk@1.23.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/rshade/mcp-devtools-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check