io.github.kimbobmarley03/devpick
NPM · @DEVPICK/MCP-SERVER
43 local developer tools for AI agents: PDF, subnet, regex, JSON, conversion, and more.
Available components
Last scanned (3 hours ago)
Scores higher than 61% of npm servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security80
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 33 of 98 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 250 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability80
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2404 tokens (~55/item across 43 items; 43 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "merge_pdfs" implies "merge" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 43 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 28 Oct 26 +1
- Stability: 0.97 → pass security
- 26 Oct 26 −1
- Stability: pass → 0.93 functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 17 Oct 26 +2
- Stability: 0.87 → pass security
- 15 Oct 26 −2
- Stability: pass → 0.83 functional
- 14 Oct 26 +1
- Stability: 0.97 → pass security
- 11 Oct 26 +2
No change was recorded against any check on this day. Stability & Change Management went from 77 to 90. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 7 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 70 to 77. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@devpick/mcp-server@1.0.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 98 packages
| Packages resolved | 98 |
|---|---|
| Stale | 33 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
calculate_chmod ~69
Calculate Unix file permissions — convert between numeric (755), symbolic (rwxr-xr-x), and explain each bit
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | yes | Permission mode: octal (e.g. '755', '644') or symbolic (e.g. 'rwxr-xr-x') |
No output schema declared.
No examples provided.
calculate_subnet ~81
Calculate subnet details from IP address and CIDR notation (network, broadcast, host range, mask, etc.)
| Name | Type | Req | Description |
|---|---|---|---|
| cidr | string | yes | IP address with CIDR notation (e.g. '192.168.1.0/24') or just IP |
| prefix | number | – | CIDR prefix length if not included in cidr parameter |
No output schema declared.
No examples provided.
count_words ~32
Count words, characters, lines, sentences, and paragraphs in text
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | Text to analyze |
No output schema declared.
No examples provided.
csv_to_json ~51
Convert CSV data to JSON array
| Name | Type | Req | Description |
|---|---|---|---|
| csv | string | yes | CSV string with header row |
| delimiter | string | – | Column delimiter (default: comma) |
| indent | number | – | JSON indent spaces |
No output schema declared.
No examples provided.
decode_base64 ~31
Decode a Base64 string back to text
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Base64 encoded string to decode |
No output schema declared.
No examples provided.
decode_html_entities ~30
Decode HTML entities back to their original characters
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | HTML with entities to decode |
No output schema declared.
No examples provided.
decode_url ~59
Decode a URL-encoded (percent-encoded) string
| Name | Type | Req | Description |
|---|---|---|---|
| full | boolean | – | If true, decode a full URL (use decodeURI); otherwise decode a component (decodeURIComponent) |
| input | string | yes | URL-encoded string to decode |
No output schema declared.
No examples provided.
encode_base64 ~30
Encode text or data to Base64
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Text to encode to Base64 |
No output schema declared.
No examples provided.
encode_html_entities ~39
Encode special characters to HTML entities (&, <, >, etc.)
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Text to encode HTML entities in |
No output schema declared.
No examples provided.
encode_url ~61
URL-encode (percent-encode) a string for use in URLs
| Name | Type | Req | Description |
|---|---|---|---|
| full | boolean | – | If true, encode the full URL (use encodeURI); otherwise encode a component (encodeURIComponent) |
| input | string | yes | String to URL-encode |
No output schema declared.
No examples provided.
escape_string ~53
Escape special characters in a string (newlines, tabs, quotes, backslashes)
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | String to escape |
| mode | string | – | Escape mode: json, js, regex, or shell |
No output schema declared.
No examples provided.
format_css ~60
Format and prettify CSS stylesheets with proper indentation
| Name | Type | Req | Description |
|---|---|---|---|
| css | string | yes | CSS string to format |
| indent | number | – | Indent spaces (default 2) |
| minify | boolean | – | If true, minify instead of format |
No output schema declared.
No examples provided.
format_html ~59
Format and prettify HTML markup with proper indentation
| Name | Type | Req | Description |
|---|---|---|---|
| html | string | yes | HTML string to format |
| indent | number | – | Indent spaces (default 2) |
| minify | boolean | – | If true, minify instead of format |
No output schema declared.
No examples provided.
format_json ~60
Format, prettify, or minify JSON data
| Name | Type | Req | Description |
|---|---|---|---|
| indent | number | – | Indent spaces (default 2) |
| json | string | yes | Raw JSON string |
| minify | boolean | – | If true, minify instead of prettify |
No output schema declared.
No examples provided.
format_sql ~48
Format and prettify SQL queries with keyword capitalization and proper indentation
| Name | Type | Req | Description |
|---|---|---|---|
| minify | boolean | – | If true, minify instead of format |
| sql | string | yes | SQL query to format |
No output schema declared.
No examples provided.
format_xml ~59
Format and prettify XML data with proper indentation
| Name | Type | Req | Description |
|---|---|---|---|
| indent | number | – | Indent spaces (default 2) |
| minify | boolean | – | If true, minify instead of format |
| xml | string | yes | XML string to format |
No output schema declared.
No examples provided.
generate_cron_expression ~163
Generate a cron expression from common schedule descriptions or explicit fields
| Name | Type | Req | Description |
|---|---|---|---|
| day_of_month | string | – | Day of month field (1-31, *, */n) |
| day_of_week | string | – | Day of week field (0-7, *, 0=Sunday, MON-SUN) |
| hour | string | – | Hour field (0-23, *, */n, or comma-separated) |
| minute | string | – | Minute field (0-59, *, */n, or comma-separated) |
| month | string | – | Month field (1-12, *, */n, or JAN-DEC) |
| preset | string | – | Common schedule description (e.g. 'every 5 minutes', 'every day at midnight', 'every weekday') |
No output schema declared.
No examples provided.
generate_hash ~59
Generate cryptographic hash of input text (MD5, SHA-1, SHA-256, SHA-512)
| Name | Type | Req | Description |
|---|---|---|---|
| algorithm | string | – | Hash algorithm |
| encoding | string | – | Output encoding |
| input | string | yes | Text to hash |
No output schema declared.
No examples provided.
generate_lorem_ipsum ~55
Generate Lorem Ipsum placeholder text
| Name | Type | Req | Description |
|---|---|---|---|
| classic | boolean | – | Start with the classic 'Lorem ipsum' opening |
| count | number | – | Number of units to generate |
| unit | string | – | Unit of generation |
No output schema declared.
No examples provided.
generate_slug ~64
Generate a URL-safe slug from text
| Name | Type | Req | Description |
|---|---|---|---|
| lowercase | boolean | – | Convert to lowercase |
| max_length | number | – | Maximum slug length |
| separator | string | – | Word separator (default: hyphen) |
| text | string | yes | Text to convert to a slug |
No output schema declared.
No examples provided.
generate_uuid ~49
Generate one or more random UUID v4 identifiers
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Number of UUIDs to generate (1-100) |
| uppercase | boolean | – | If true, return uppercase UUIDs |
No output schema declared.
No examples provided.
hex_to_rgb ~52
Convert a hex color code to RGB (and HSL) values
| Name | Type | Req | Description |
|---|---|---|---|
| hex | string | yes | Hex color code (e.g. '#FF5733' or 'FF5733' or '#F53') |
No output schema declared.
No examples provided.
json_diff ~54
Compare two JSON objects and show a structured diff of all changes (added, removed, changed keys)
| Name | Type | Req | Description |
|---|---|---|---|
| left | string | yes | First (original) JSON string |
| right | string | yes | Second (modified) JSON string |
No output schema declared.
No examples provided.
json_to_csv ~45
Convert a JSON array to CSV format
| Name | Type | Req | Description |
|---|---|---|---|
| delimiter | string | – | Column delimiter (default: comma) |
| json | string | yes | JSON array (or object) to convert |
No output schema declared.
No examples provided.
json_to_typescript ~50
Generate TypeScript interfaces/types from a JSON object or array
| Name | Type | Req | Description |
|---|---|---|---|
| json | string | yes | JSON string to convert |
| root_name | string | – | Name for the root interface (default: Root) |
No output schema declared.
No examples provided.
json_to_yaml ~25
Convert JSON to YAML
| Name | Type | Req | Description |
|---|---|---|---|
| json | string | yes | JSON string to convert |
No output schema declared.
No examples provided.
markdown_to_html ~26
Convert Markdown text to HTML
| Name | Type | Req | Description |
|---|---|---|---|
| markdown | string | yes | Markdown text to convert |
No output schema declared.
No examples provided.
merge_pdfs ~53
Merge multiple PDF files into a single PDF. Provide absolute file paths.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | yes | Array of absolute paths to PDF files to merge |
| output | string | yes | Absolute path for the merged output PDF |
No output schema declared.
No examples provided.
number_base_convert ~97
Convert a number between bases (binary, octal, decimal, hex, or any base 2-36)
| Name | Type | Req | Description |
|---|---|---|---|
| from_base | number | yes | Source base (e.g. 10 for decimal, 16 for hex, 2 for binary) |
| to_base | number | yes | Target base |
| value | string | yes | Number to convert (as string, e.g. '255', 'FF', '11111111') |
No output schema declared.
No examples provided.
parse_cron ~39
Parse and describe a cron expression in human-readable language
| Name | Type | Req | Description |
|---|---|---|---|
| expression | string | yes | Cron expression with 5 fields (minute hour day month weekday) |
No output schema declared.
No examples provided.
parse_jwt ~37
Decode and inspect a JWT token (header, payload, expiry — does NOT verify signature)
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | JWT token string |
No output schema declared.
No examples provided.
pdf_info ~44
Get metadata and page info from a PDF file (page count, title, author, file size, page dimensions).
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Absolute path to the PDF file |
No output schema declared.
No examples provided.
pdf_watermark ~90
Add a text watermark to every page of a PDF.
| Name | Type | Req | Description |
|---|---|---|---|
| fontSize | number | – | Font size (default 50) |
| input | string | yes | Absolute path to the input PDF |
| opacity | number | – | Watermark opacity (0-1, default 0.3) |
| output | string | yes | Absolute path for the output PDF |
| text | string | yes | Watermark text |
No output schema declared.
No examples provided.
remove_pdf_pages ~64
Remove specific pages from a PDF. Pages are 1-indexed.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Absolute path to the input PDF |
| output | string | yes | Absolute path for the output PDF |
| pages | array | yes | Page numbers to remove (1-indexed) |
No output schema declared.
No examples provided.
rgb_to_hex ~58
Convert RGB color values to a hex color code
| Name | Type | Req | Description |
|---|---|---|---|
| b | number | yes | Blue channel (0-255) |
| g | number | yes | Green channel (0-255) |
| r | number | yes | Red channel (0-255) |
No output schema declared.
No examples provided.
rotate_pdf ~99
Rotate pages in a PDF by 90, 180, or 270 degrees. Rotates all pages or specific pages.
| Name | Type | Req | Description |
|---|---|---|---|
| angle | string | yes | Rotation angle: 90, 180, or 270 |
| input | string | yes | Absolute path to the input PDF |
| output | string | yes | Absolute path for the output PDF |
| pages | array | – | Specific pages to rotate (1-indexed). Omit to rotate all. |
No output schema declared.
No examples provided.
split_pdf ~67
Extract specific pages from a PDF into a new file. Pages are 1-indexed.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | Absolute path to the input PDF |
| output | string | yes | Absolute path for the output PDF |
| pages | array | yes | Page numbers to extract (1-indexed) |
No output schema declared.
No examples provided.
test_regex ~72
Test a regular expression pattern against text and return all matches with details
| Name | Type | Req | Description |
|---|---|---|---|
| flags | string | – | Regex flags (g, i, m, s, u — default: g) |
| pattern | string | yes | Regular expression pattern (without delimiters) |
| text | string | yes | Text to test the pattern against |
No output schema declared.
No examples provided.
text_diff ~70
Compare two text strings line-by-line and show added, removed, and unchanged lines
| Name | Type | Req | Description |
|---|---|---|---|
| text1 | string | yes | First (original) text |
| text2 | string | yes | Second (modified) text |
| unified | boolean | – | If true, return unified diff format; otherwise return structured diff |
No output schema declared.
No examples provided.
unescape_string ~56
Unescape escape sequences in a string (\n, \t, \\, \", etc.)
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | yes | String with escape sequences to unescape |
| mode | string | – | Unescape mode: json or unicode |
No output schema declared.
No examples provided.
validate_toml ~32
Validate TOML and report any syntax errors
| Name | Type | Req | Description |
|---|---|---|---|
| toml | string | yes | TOML string to validate |
No output schema declared.
No examples provided.
validate_yaml ~27
Validate YAML and report any syntax errors
| Name | Type | Req | Description |
|---|---|---|---|
| yaml | string | yes | YAML string to validate |
No output schema declared.
No examples provided.
yaml_to_json ~35
Convert YAML to JSON
| Name | Type | Req | Description |
|---|---|---|---|
| indent | number | – | JSON indent spaces |
| yaml | string | yes | YAML string to convert |
No output schema declared.
No examples provided.
How do I install the io.github.kimbobmarley03/devpick MCP server?
io.github.kimbobmarley03/devpick runs locally as an npm package, launched with npx -y @devpick/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @devpick/mcp-server
claude mcp add kimbobmarley03-devpick -- npx -y @devpick/mcp-server
What is the io.github.kimbobmarley03/devpick MCP server?
io.github.kimbobmarley03/devpick is an MCP server listed in the public MCP registry as io.github.kimbobmarley03/devpick. 43 local developer tools for AI agents: PDF, subnet, regex, JSON, conversion, and more. This page covers its npm package (@devpick/mcp-server).
Is the io.github.kimbobmarley03/devpick MCP server safe to use?
io.github.kimbobmarley03/devpick scores 79 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.kimbobmarley03/devpick MCP server expose?
io.github.kimbobmarley03/devpick exposes 43 tools: merge_pdfs, split_pdf, pdf_info, rotate_pdf, pdf_watermark, and 38 more. Their descriptions and schemas cost roughly 2,404 tokens of context every time the server is loaded.
Is the io.github.kimbobmarley03/devpick MCP server still maintained?
io.github.kimbobmarley03/devpick is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.kimbobmarley03/devpick MCP server under?
io.github.kimbobmarley03/devpick declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.