# io.github.IsaiahDupree/devstack-mcp (remote · devstack-mcp.vercel.app)

Dev-registry data: npm/PyPI/Docker/VS Code packages, dep graphs, vulns, 50+ ecosystems.

- Trust score: 72/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `devstack-mcp.vercel.app`: 72/100 (this document), [markdown](https://verifymcp.io/servers/isaiahdupree-devstack-mcp/devstack-mcp.md), [page](https://verifymcp.io/servers/isaiahdupree-devstack-mcp/devstack-mcp)

## Channel facts

- Endpoint: `https://devstack-mcp.vercel.app/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 80/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 69/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1566 tokens (~156/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 7/100
  - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http isaiahdupree-devstack-mcp https://devstack-mcp.vercel.app/mcp
```

### Codex

```toml
[mcp_servers.isaiahdupree-devstack-mcp]
url = "https://devstack-mcp.vercel.app/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "isaiahdupree-devstack-mcp": {
      "type": "remote",
      "url": "https://devstack-mcp.vercel.app/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add isaiahdupree-devstack-mcp --url https://devstack-mcp.vercel.app/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  isaiahdupree-devstack-mcp:
    url: "https://devstack-mcp.vercel.app/mcp"
```

### Other

```json
{
  "mcpServers": {
    "isaiahdupree-devstack-mcp": {
      "type": "http",
      "url": "https://devstack-mcp.vercel.app/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 71, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-08-01 (score 71)

First indexed and scored.

## MCP tools (10)

### `get_package` (~170 tokens)

Get normalized package details

Full normalized details for one package by registry + name, in a single unified Package shape across npm, PyPI, Docker Hub, and the VS Code Marketplace. name handles scoped npm ids (e.g. @types/node), Docker namespaces (e.g. library/nginx or a bare nginx for official images), and VS Code publisher.extension ids. With registry=all the request fans out to every registry in parallel and returns a packages array (missing registries are silently dropped); otherwise a single package is returned.

Input parameters:

- `name` (string, required): Package name / id. Supports scoped npm ids (@scope/pkg), Docker namespaces (ns/name or a bare name for official images), and VS Code publisher.extension ids.
- `registry` (string, required): Target registry. "all" fans out to every registry and merges results.

### `search_packages` (~152 tokens)

Search packages across registries

Search a registry for packages matching q. registry=all fans out to npm, Docker Hub, and the VS Code Marketplace and merges the results. PyPI has no public search API, so registry=pypi returns 400 not_supported — look a PyPI package up by name via get_package instead. Results are normalized PackageSummary items (npm adds a relevance score; Docker adds isOfficial).

Input parameters:

- `limit` (integer): Max results per registry. Clamped to 1-50. Default 20.
- `q` (string, required): Search query.
- `registry` (string, required): Target registry. "all" fans out to npm, Docker, and VS Code and merges results. pypi returns not_supported.

### `get_versions` (~121 tokens)

Get published versions / tags

List published versions (npm/PyPI), image tags (Docker Hub, most recent 25), or extension versions (VS Code) for a package. registry=all is NOT supported here — pick a single registry. Each item carries version and released, plus registry-specific extras (files for PyPI, size for Docker tags).

Input parameters:

- `name` (string, required): Package name / id (scoped npm ids, Docker namespaces, and VS Code publisher.extension ids supported).
- `registry` (string, required): Target registry. "all" is not supported here — pick one.

### `get_downloads` (~103 tokens)

Get download / pull statistics

Download statistics for a package. Only npm (via api.npmjs.org) and PyPI (via pypistats.org) support this; any other registry returns 400 not_supported. npm returns a period window with downloads, start, and end; PyPI returns last_day, last_week, and last_month totals.

Input parameters:

- `name` (string, required): Package name.
- `registry` (string, required): Target registry. Only npm and pypi expose download stats.

### `get_dependency_graph` (~190 tokens)

Get resolved dependency graph

The fully resolved dependency graph for one exact package version, via deps.dev. Returns a flat nodes[] array plus integer-index edges[] (walk from/to to rebuild the tree). Each node carries relation (self | direct | indirect) and a direct boolean; node[0] is always the queried root (relation: self). Node order is NOT stable — look nodes up by name/relation, never by positional index. system is case-insensitive and lowercased (npm, pypi, cargo, go, maven, nuget). version is REQUIRED (a graph is resolved for one exact version).

Input parameters:

- `name` (string, required): Package name / id.
- `system` (string, required): Package system / ecosystem for deps.dev. Case-insensitive, lowercased server-side.
- `version` (string, required): Exact version to resolve (e.g. 18.2.0). Required.

### `get_vulnerabilities` (~232 tokens)

Get vulnerabilities for a package

Known vulnerabilities (CVE / GHSA / PYSEC / GO advisories) for a package, via OSV.dev. Pass version to filter to advisories affecting that exact version, or omit it for the package's full advisory history. Each result carries the OSV id, cross-id aliases, a severity word grade (LOW|MODERATE|HIGH|CRITICAL), the cvss vector string, affectedRanges with fixed-version events, references, and cwes. A clean package returns count: 0 with an empty list (not an error). ecosystem is CASE-SENSITIVE — use OSV's spelling (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, …). Use scan_vulnerabilities_batch for lockfile batch scans.

Input parameters:

- `ecosystem` (string, required): OSV ecosystem, CASE-SENSITIVE (e.g. npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems).
- `name` (string, required): Package name.
- `version` (string): Exact version to filter advisories to. Omit for full history.

### `scan_vulnerabilities_batch` (~118 tokens)

Batch vulnerability scan (lockfile)

Scan many packages in one call — ideal for a whole lockfile. Pass a queries[] array (max 100) of { ecosystem, name, version? }; results are returned positionally aligned, one row per query, each with a count and a hydrated vulns[] array. Advisories are de-duplicated and hydrated across the batch. ecosystem is CASE-SENSITIVE (OSV spelling).

Input parameters:

- `queries` (array, required): Up to 100 { ecosystem, name, version? } queries, ideal for a whole lockfile.

### `get_insights` (~195 tokens)

Get project insights — OSSF Scorecard + repo signal

Health and security insights for a package's source project, via deps.dev. Returns the linked source repository, GitHub stars/forks/openIssues, licenses, resolved dependencyCount, security advisories, and the full OSSF Scorecard (ossfScore 0..10 plus the per-check breakdown). Omit version to use the registry default version — note deps.dev's default is a MOVING target and an unverified default mirror may have no computed scorecard (ossfScore: null); pin version for a stable, scorecard-backed result. system is lowercased (npm, pypi, cargo, go, maven, …).

Input parameters:

- `name` (string, required): Package name / id.
- `system` (string, required): Package system / ecosystem for deps.dev. Case-insensitive, lowercased server-side.
- `version` (string): Exact version. Omit for the (moving) registry default version.

### `search_ecosystems` (~165 tokens)

Cross-registry package lookup (50+ ecosystems)

Look a package name up across 50+ registries at once, via ecosyste.ms. This is an EXACT-name lookup (not fuzzy full-text): q=react returns the react package everywhere it exists (npm, cargo, nuget, pub, bower, …), each as a normalized ecosystemsPackage with reverse-dependency counts. Pass ecosystem to narrow to one registry. Results carry dependentReposCount, dependentPackagesCount, and vulnerabilityCount.

Input parameters:

- `ecosystem` (string): Narrow to one ecosystem (e.g. pypi, npm, cargo). Omit to search all.
- `limit` (integer): Max results. Clamped to 1-50. Default 20.
- `q` (string, required): Exact package name to look up across registries.

### `get_ecosystems_package` (~120 tokens)

Get one package on one registry (with reverse-dep counts)

Full normalized metadata for one package on one of 50+ registries, via ecosyste.ms — including the fields v1 registries can't give you: dependentReposCount and dependentPackagesCount (reverse dependencies), ecosystem, and vulnerabilityCount. Scoped/namespaced names are handled automatically. Returns 404 if the package does not exist on that ecosystem.

Input parameters:

- `ecosystem` (string, required): Target ecosyste.ms ecosystem slug (e.g. npm, pypi, cargo, rubygems).
- `name` (string, required): Package name / id.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/isaiahdupree-devstack-mcp/devstack-mcp#diagnostics

## Score history

- 2026-08-03: 72
- 2026-08-02: 71
- 2026-08-01: 71

## Links

- Remote endpoint: https://devstack-mcp.vercel.app/mcp
- Repository: https://github.com/IsaiahDupree/devstack-mcp
- Website: https://devstack-mcp.vercel.app/
- Changelog RSS feed: https://verifymcp.io/servers/isaiahdupree-devstack-mcp/devstack-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/isaiahdupree-devstack-mcp/devstack-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/isaiahdupree-devstack-mcp/devstack-mcp