DevForge-MCP (Sanket2329/DevForge-MCP) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 44 tools. No publisher has claimed this listing.

C
Caution
60/100

DevForge-MCP

A production-ready MCP server that enables AI assistants to intelligently understand, analyze, edit, navigate, and review software projects with multi-workspace support, Git integration, and semantic search.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Sanket2329

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: MCP_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes44 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_projects

List every project under the configured workspace root. Use this when the user wants to know what repos are available or switch projects.

select_project

Switch the active project by name (relative to the workspace root) or absolute path. Re-indexes and reattaches the file watcher — no restart needed. Use this when the user says 'work on <other project>' or 'switch to <repo>'.

get_current_project

Return the active project's name, path, indexed file count, detected architecture, and last scan time.

refresh_index

Re-scan the active project and rebuild the file index + architecture profile. Use this after large external changes (e.g. a git pull).

get_project_files

List indexed files with metadata (path, size, extension, last modified).

get_file_content

Read a single source file by relative path. Reads directly from disk — never truncated, always returns the full file content.

get_full_codebase

Use this when the user asks a coding question about the project, BEFORE answering. Returns the entire indexed codebase plus architecture summary so suggestions respect existing conventions.

get_architecture

Returns the detected architecture profile: language, framework, primary pattern, patterns in use, tech stack, conventions, namespace, layer map. Call alongside get_full_codebase.

search_codebase

Full-text search across indexed files. Use this to find relevant classes/functions/usages before generating code.

get_dependency_graph

Map of every file → its imports/usings and namespace. Use before modifying or creating files to understand coupling.

get_context

Current build state: last error, last changed file, index stats, architecture summary.

write_file

Create or overwrite one file. Always call get_full_codebase + get_architecture first so the code matches the project's conventions.

write_multiple_files

Write several files in one operation — ideal for refactors spanning multiple layers/files at once.

trigger_build

Auto-detects the right build tool (dotnet/npm/pnpm/yarn/python/maven/gradle/go/cargo) for the active project and runs it. Returns pass/fail and full output.

add_conversation_turn

Store a user/assistant turn in rolling conversation memory.

get_conversation_history

Retrieve the last 10 conversation turns for context continuity.

find_symbol

Find every occurrence of an identifier (variable, function, class — any symbol) across the codebase.

find_class

Find where a class/struct/interface/type is declared.

find_method

Find where a function/method is declared (C#, Java, JS/TS, Python, Go signatures supported).

find_interface

Find where an interface/type-interface is declared.

find_references

Find every place a symbol is referenced (broader than find_symbol — used for 'what calls this' questions).

find_unused_files

Heuristically flag files that no other file appears to reference — candidates for deletion. Always verify before deleting.

find_duplicate_code

Detect blocks of near-identical code repeated across files — candidates for extraction into a shared function.

patch_file

Surgically replace one exact, unique snippet of text in a file. The safest edit — preserves all surrounding formatting. Fails loudly if the snippet isn't unique.

replace_method

Replace an entire method/function body by name, keeping the rest of the file untouched.

insert_method

Insert a new method into an existing class (start or end of its body).

insert_class

Append a new class/type to a file (inside the last namespace block for C#, end-of-file otherwise).

rename_symbol

Rename a symbol everywhere it's used across the indexed codebase (word-boundary match, comment/string-safe) and write every changed file back to disk. Use scope='file' with rel_path to rename within a single file only (safer). scope='project' (default) renames across all files — always confirm with

delete_method

Remove a method/function (and its immediately preceding doc-comment/decorator/attribute lines) from a file.

git_status

Short git status + current branch for the active project.

git_diff

Git diff for the working tree, optionally scoped to one file.

git_log

Recent commit history.

show_untracked_files

List files git sees as untracked.

git_checkout

Checkout an existing branch.

create_branch

Create and checkout a new branch.

commit_changes

Stage and commit changes with a message.

add_project_note

Record a durable project-level note (an architecture decision, a coding convention, a known issue, or a free-form note) that persists across conversations, not just this chat.

get_project_memory

Retrieve all stored project-level notes: decisions, conventions, known issues, notes.

review_file

Heuristic review of one file: long methods, TODOs, magic numbers, deep nesting.

review_project

Project-wide stats: file counts by extension, largest files, total TODO/FIXME count.

find_code_smells

Aggregate code-smell scan across the whole project (long methods, duplication, deep nesting, TODOs), ranked by severity.

review_architecture

Architecture-aware suggestions based on the detected stack (e.g. missing tests, missing DI, missing validation).

suggest_refactoring

Consolidated, prioritized refactoring suggestions combining code smells + architecture review.

explain_build_error

Parse a raw compiler/build error into structured {file, line, code, message} entries (C#, TS, Java, Go, Python) so it's easy to explain in plain language. Defaults to the last build error if none is provided.

// known CVEs in dependencies3 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.11.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.11.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.11.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowexpress@4.19.2GHSA-qw6h-vgh9-j6wx

express vulnerable to XSS via response.redirect()

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configLOG_LEVELinfo Logging level
🔐 secretMCP_API_KEYunset Protects REST API endpoints
configPROJECT_PATHSample project Initial project to index
configWORKSPACE_ROOTParent directory Workspace containing projects
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

44/44 tools missing one or more hints — list_projects (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); select_project (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_current_project (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +41 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 0/44 tools referenced in tests (0%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

6 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.11.0 (high), @modelcontextprotocol/sdk@1.11.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/sanket2329/devforge-mcp?variant=verified)](https://m8ven.ai/mcp/sanket2329/devforge-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 3e5c5c33a56067b6d78d8300c5cf9ec7ced26307
code hash: b79356e77f656f1dda911fa36f36016cffceea7ccdbaf37fb7453d7e007ea8f8
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client