DevForge-MCP (Sanket2329/DevForge-MCP) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 44 tools. No publisher has claimed this listing.
A production-ready MCP server that enables AI assistants to intelligently understand, analyze, edit, navigate, and review software projects with multi-workspace support, Git integration, and semantic search.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Sanket2329
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list_projectsList every project under the configured workspace root. Use this when the user wants to know what repos are available or switch projects.
select_projectSwitch the active project by name (relative to the workspace root) or absolute path. Re-indexes and reattaches the file watcher — no restart needed. Use this when the user says 'work on <other project>' or 'switch to <repo>'.
get_current_projectReturn the active project's name, path, indexed file count, detected architecture, and last scan time.
refresh_indexRe-scan the active project and rebuild the file index + architecture profile. Use this after large external changes (e.g. a git pull).
get_project_filesList indexed files with metadata (path, size, extension, last modified).
get_file_contentRead a single source file by relative path. Reads directly from disk — never truncated, always returns the full file content.
get_full_codebaseUse this when the user asks a coding question about the project, BEFORE answering. Returns the entire indexed codebase plus architecture summary so suggestions respect existing conventions.
get_architectureReturns the detected architecture profile: language, framework, primary pattern, patterns in use, tech stack, conventions, namespace, layer map. Call alongside get_full_codebase.
search_codebaseFull-text search across indexed files. Use this to find relevant classes/functions/usages before generating code.
get_dependency_graphMap of every file → its imports/usings and namespace. Use before modifying or creating files to understand coupling.
get_contextCurrent build state: last error, last changed file, index stats, architecture summary.
write_fileCreate or overwrite one file. Always call get_full_codebase + get_architecture first so the code matches the project's conventions.
write_multiple_filesWrite several files in one operation — ideal for refactors spanning multiple layers/files at once.
trigger_buildAuto-detects the right build tool (dotnet/npm/pnpm/yarn/python/maven/gradle/go/cargo) for the active project and runs it. Returns pass/fail and full output.
add_conversation_turnStore a user/assistant turn in rolling conversation memory.
get_conversation_historyRetrieve the last 10 conversation turns for context continuity.
find_symbolFind every occurrence of an identifier (variable, function, class — any symbol) across the codebase.
find_classFind where a class/struct/interface/type is declared.
find_methodFind where a function/method is declared (C#, Java, JS/TS, Python, Go signatures supported).
find_interfaceFind where an interface/type-interface is declared.
find_referencesFind every place a symbol is referenced (broader than find_symbol — used for 'what calls this' questions).
find_unused_filesHeuristically flag files that no other file appears to reference — candidates for deletion. Always verify before deleting.
find_duplicate_codeDetect blocks of near-identical code repeated across files — candidates for extraction into a shared function.
patch_fileSurgically replace one exact, unique snippet of text in a file. The safest edit — preserves all surrounding formatting. Fails loudly if the snippet isn't unique.
replace_methodReplace an entire method/function body by name, keeping the rest of the file untouched.
insert_methodInsert a new method into an existing class (start or end of its body).
insert_classAppend a new class/type to a file (inside the last namespace block for C#, end-of-file otherwise).
rename_symbolRename a symbol everywhere it's used across the indexed codebase (word-boundary match, comment/string-safe) and write every changed file back to disk. Use scope='file' with rel_path to rename within a single file only (safer). scope='project' (default) renames across all files — always confirm with …
delete_methodRemove a method/function (and its immediately preceding doc-comment/decorator/attribute lines) from a file.
git_statusShort git status + current branch for the active project.
git_diffGit diff for the working tree, optionally scoped to one file.
git_logRecent commit history.
show_untracked_filesList files git sees as untracked.
git_checkoutCheckout an existing branch.
create_branchCreate and checkout a new branch.
commit_changesStage and commit changes with a message.
add_project_noteRecord a durable project-level note (an architecture decision, a coding convention, a known issue, or a free-form note) that persists across conversations, not just this chat.
get_project_memoryRetrieve all stored project-level notes: decisions, conventions, known issues, notes.
review_fileHeuristic review of one file: long methods, TODOs, magic numbers, deep nesting.
review_projectProject-wide stats: file counts by extension, largest files, total TODO/FIXME count.
find_code_smellsAggregate code-smell scan across the whole project (long methods, duplication, deep nesting, TODOs), ranked by severity.
review_architectureArchitecture-aware suggestions based on the detected stack (e.g. missing tests, missing DI, missing validation).
suggest_refactoringConsolidated, prioritized refactoring suggestions combining code smells + architecture review.
explain_build_errorParse a raw compiler/build error into structured {file, line, code, message} entries (C#, TS, Java, Go, Python) so it's easy to explain in plain language. Defaults to the last build error if none is provided.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
express vulnerable to XSS via response.redirect()
LOG_LEVELinfo Logging levelMCP_API_KEYunset Protects REST API endpointsPROJECT_PATHSample project Initial project to indexWORKSPACE_ROOTParent directory Workspace containing projectsPORTTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
44/44 tools missing one or more hints — list_projects (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); select_project (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_current_project (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +41 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
Only 0/44 tools referenced in tests (0%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
6 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.11.0 (high), @modelcontextprotocol/sdk@1.11.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sanket2329/devforge-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check