Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

Devloop

NPM · DEVLOOP-MCP · SCANNED AUG 3

Browser + dev-server logs on one correlated timeline, for Claude Code and AI agents.

Available components

+57 this week 81 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security89
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 27 of 29 dependencies flagged as unhealthy (27 deprecated). View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to vincentvella/devloop). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 11 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability81
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 4050 tokens (~88/item across 46 items; 46 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
  • Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · devloop-mcp

# add to Claude Code
claude mcp add vincentvella-devloop -- npx -y devloop-mcp
# add to Codex CLI
codex mcp add vincentvella-devloop -- npx -y devloop-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vincentvella-devloop": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "devloop-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add vincentvella-devloop --command npx --arg -y --arg devloop-mcp
# ~/.hermes/config.yaml
mcp_servers:
  vincentvella-devloop:
    command: "npx"
    args: ["-y", "devloop-mcp"]
// mcp.json
{
  "mcpServers": {
    "vincentvella-devloop": {
      "command": "npx",
      "args": [
        "-y",
        "devloop-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

  • 2 Aug 26 +15
    • Provenance: pass → unverified security
    • Install scripts: pass → unverified security
    • Known CVEs: pass → unverified security
    • Malware scan: unverified → pass security
    • The attested source repository moved: vincentvella/devloop security
    • Dependency health: 0.94 → 0.14 functional
    • License: pass → unverified functional
    • Dependency health: 0.94 → unverified functional
    • Maintenance: pass → unverified functional
    • Stability: unverified → 0.20 functional
    • Licence: MIT functional
  • 31 Jul 26 +2
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 +17
    • Malware scan: pass → unverified security
    • Install scripts: unverified → pass security
    • Provenance: unverified → pass security
    • Known CVEs: unverified → pass security
    • The attested source repository moved: vincentvella/devloop security
    • License: unverified → pass functional
    • Dependency health: unverified → 0.94 functional
    • Maintenance: unverified → pass functional
    • Licence: MIT functional
  • 28 Jul 26 +22
    • Tool coverage: unverified → 100 functional
    • First check of Schema quality: unverified functional
    • First check of Tool coverage: 100 functional
    • First check of Schema quality: pass functional
    • First check of Schema quality: fail functional
  • 27 Jul 26 24

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:
vincentvella/devloop
Certificate issuer:
https://token.actions.githubusercontent.com
Certificate SAN:
https://github.com/vincentvella/devloop/.github/workflows/release.yml@refs/tags/v0.10.2
Rekor log index:
2215930996
Predicate type:
https://slsa.dev/provenance/v1
Subject digest:
sha512:a1a82583c2f0affbbd39883076ce3416d63a39cb71bece817386a12ed90732eaf47ed5e930ad2b101f761fa10e42f070d286e771668c756ade424de0d
Discovery method:
attestation_endpoint
Dependencies 29 packages

29 packages in the resolved dependency tree · 27 deprecated · 4 stale.

MCP tools — 46 exposed · ~4,050 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
browser_back ~46

Go back one entry in the active pane's history (no-op if there's nothing to go back to). Pairs with browser_forward; use browser_navigate to go to a new URL.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

browser_clear_storage ~77

Clear the active page's storage — cookies, localStorage, IndexedDB, cache, service workers — for the current origin. Set allOrigins to wipe the whole browser session. Use to log out or test a fresh-user flow; reload afterward.

NameTypeReqDescription
allOriginsbooleanWipe the entire session, not just the current origin.

No output schema declared.

No examples provided.

browser_click ~59

Click the element matching a CSS selector (real mouse click). For keyboard keys use browser_press; to only hover use browser_hover.

NameTypeReqDescription
selectorstringyesCSS selector of the element to click (e.g. a `ref` from browser_snapshot).

No output schema declared.

No examples provided.

browser_emulate ~179

Emulate a device/viewport on the active page. Pass a `device` preset, or custom `width`+`height`. `reset: true` restores a desktop viewport. For network conditions use browser_throttle instead.

NameTypeReqDescription
devicestringDevice preset to emulate. Use this OR width+height.
deviceScaleFactornumberDevice pixel ratio (e.g. 2 for retina). Default 1.
heightnumberCustom viewport height in CSS pixels (with width).
mobilebooleanEmulate a mobile device (touch + mobile UA hints). Default false.
resetbooleanRestore the default desktop viewport and clear emulation.
userAgentstringOverride the User-Agent string.
widthnumberCustom viewport width in CSS pixels (with height).

No output schema declared.

No examples provided.

browser_eval ~79

Evaluate a JavaScript expression in the active page (via CDP) and return its value. Runs in the page's main world and can mutate page state. Prefer browser_snapshot for reading structure and browser_click/type for interactions.

NameTypeReqDescription
expressionstringyesA JavaScript expression evaluated in the page; its result is returned (JSON-serializable values).

No output schema declared.

No examples provided.

browser_forward ~46

Go forward one entry in the active pane's history (no-op if there's nothing to go forward to). Pairs with browser_back; use browser_navigate to go to a new URL.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

browser_hover ~46

Hover the pointer over an element to trigger hover menus/tooltips. Does not click — use browser_click for that.

NameTypeReqDescription
selectorstringyesCSS selector of the element to hover over.

No output schema declared.

No examples provided.

browser_navigate ~70

Navigate the active pane to a URL (full page load). Returns the resolved URL and HTTP status. Use browser_back / browser_forward to move through history, browser_reload to refresh the same URL.

NameTypeReqDescription
urlstringyesAbsolute URL to load (e.g. http://localhost:3000/path).

No output schema declared.

No examples provided.

browser_press ~75

Press a single key (e.g. Enter, Escape, Tab, ArrowDown) on the page. For typing text use browser_type.

NameTypeReqDescription
keystringyesKey name to press, e.g. Enter, Escape, Tab, ArrowDown.
selectorstringOptional CSS selector to focus before pressing the key.

No output schema declared.

No examples provided.

browser_reload ~50

Reload the active pane's current page. Use browser_navigate to change URL instead.

NameTypeReqDescription
hardbooleanIgnore the cache (hard reload). Default false. Cockpit only; ignored under Puppeteer.

No output schema declared.

No examples provided.

browser_screenshot ~53

Capture a PNG screenshot of the active page. To find/target elements, prefer browser_snapshot (returns selectors).

NameTypeReqDescription
fullPagebooleanCapture the full scrollable page, not just the viewport (default false).

No output schema declared.

No examples provided.

browser_scroll ~94

Scroll an element into view (pass selector), or scroll the window to coordinates (pass x and y). Provide a selector OR x+y, not both.

NameTypeReqDescription
selectorstringCSS selector to scroll into view. Omit to scroll the window instead.
xnumberWindow scroll-x in pixels (used when no selector).
ynumberWindow scroll-y in pixels (used when no selector).

No output schema declared.

No examples provided.

browser_select ~70

Set the value of a <select> (or input) and fire input/change events. For typing free text use browser_type.

NameTypeReqDescription
selectorstringyesCSS selector of the <select> or input.
valuestringyesThe option's value attribute (not its visible label) to select.

No output schema declared.

No examples provided.

browser_snapshot ~135

Capture a structured snapshot of the active page: url, title, and the interactive + landmark elements (role, accessible name, value/state, heading level), each with a CSS selector `ref`. Pass a returned `ref` to browser_click / browser_type. Caps at 250 elements by default (raise `limit` for dense pages); `truncated:true` means the cap was hit. Prefer this over browser_screenshot to find and target elements reliably.

NameTypeReqDescription
limitnumberMax elements to return (default 250). Raise it for dense pages (large tables / long forms) where the default truncates the snapshot.

No output schema declared.

No examples provided.

browser_throttle ~57

Throttle the active page's network conditions to a named profile. Use `none` to clear. For viewport/device emulation use browser_emulate.

NameTypeReqDescription
profilestringyesNetwork profile to apply; `none` removes throttling.

No output schema declared.

No examples provided.

browser_type ~70

Type text into the element matching a CSS selector (focuses, then types). For single keys use browser_press; for <select> use browser_select.

NameTypeReqDescription
selectorstringyesCSS selector of the input/textarea to type into.
textstringyesText to type into the focused element.

No output schema declared.

No examples provided.

browser_wait_for ~116

Wait until a CSS selector appears or text is present on the page (e.g. after a navigation or async render). Returns { ok, waitedMs } — ok=false on timeout. To wait for the network to go quiet instead, use browser_wait_for_idle.

NameTypeReqDescription
selectorstringCSS selector to wait for.
textstringSubstring of page text to wait for (if no selector).
timeoutMsnumberMax time to wait before giving up, in ms (default 10000).

No output schema declared.

No examples provided.

browser_wait_for_idle ~85

Wait until network activity settles (no requests for idleMs). Returns { ok }. To wait for a specific element/text use browser_wait_for.

NameTypeReqDescription
idleMsnumberQuiet period with no requests that counts as idle, in ms (default 500).
timeoutMsnumberMax time to wait before giving up, in ms (default 10000).

No output schema declared.

No examples provided.

clear_logs ~37

Clear the event buffer (irreversible). Call before reproducing an issue for a clean window. Note: repro clears for you unless clear=false.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

dev_start ~153

Start a dev server and tee its logs into the buffer. Three ways to specify it: (1) `project` — a saved registry project (resolves cmd/cwd); (2) explicit `cmd`+`cwd`; (3) neither — `cwd` defaults to the server's directory and `cmd` is auto-detected from package.json. Explicit cmd/cwd override the project's. Stop it with dev_stop; check it with dev_status.

NameTypeReqDescription
cmdstringFull dev command. If omitted, auto-detected from package.json.
cwdstringProject directory. Defaults to the server's cwd.
projectstringName of a saved project (see project_list).

No output schema declared.

No examples provided.

dev_status ~33

Report whether the dev server is running, plus its cmd/cwd/pid. Start/stop with dev_start/dev_stop.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

dev_stop ~29

Stop the running dev server (SIGTERM). Returns whether one was running. Start one with dev_start.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

diagnose ~92

Triage what's broken right now: group repeated errors (browser console/page errors + server errors) with counts, list failed/4xx-5xx network requests, and return a one-line summary. Start here before digging through get_logs.

NameTypeReqDescription
appstringScope to one app/project (pane label or id).
windowMsnumberOnly consider events from the last N ms (default: all).

No output schema declared.

No examples provided.

export_bundle ~109

Export a shareable bug-report bundle as one JSON object: the diagnose summary, the timeline (logs), captured screenshots, a HAR of network, and repro steps if provided. For just the network log use export_har; for a quick triage use diagnose.

NameTypeReqDescription
appstringScope to one app/project (pane label or id; see pane_list). Omit for all.
windowMsnumberOnly include events from the last N ms (default: the whole buffer).

No output schema declared.

No examples provided.

export_har ~96

Export captured network requests as a HAR 1.2 document (importable into Chrome DevTools / Charles). Covers ALL requests (the full network ring, independent of DEVLOOP_NET_THRESHOLD — bodies kept for the curated subset: failures + status ≥ threshold). To browse requests in JSON use get_network.

NameTypeReqDescription
appstringScope to one app/project (pane label or id; see pane_list). Omit for all.

No output schema declared.

No examples provided.

ext_install ~60

Install a Chrome extension from a Web Store id or URL (downloads from the Web Store). Returns the updated list. (Cockpit only.) Remove with ext_remove.

NameTypeReqDescription
inputstringyesExtension id (32 chars) or a Chrome Web Store URL.

No output schema declared.

No examples provided.

ext_list ~40

List Chrome extensions (loaded + disabled): id, name, version, enabled. (Cockpit only.) Install with ext_install, toggle with ext_set_enabled.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

ext_remove ~60

Remove (uninstall/unload) a Chrome extension by id (irreversible for store extensions). (Cockpit only.) To keep it but turn it off, use ext_set_enabled.

NameTypeReqDescription
idstringyesExtension id to remove (see ext_list).

No output schema declared.

No examples provided.

ext_set_enabled ~68

Enable or disable a Chrome extension by id without uninstalling. Returns the updated list. (Cockpit only.) To uninstall entirely, use ext_remove.

NameTypeReqDescription
enabledbooleanyestrue to enable, false to disable.
idstringyesExtension id to toggle (see ext_list).

No output schema declared.

No examples provided.

get_logs ~201

Return recent events from the unified buffer (server stdout/stderr + browser console/network/pageerror), newest last. Filter by source, stream, grep, and tail incrementally with sinceSeq. Scope to one project's logs with `app`. For events around a specific moment use get_logs_around; to triage errors first use diagnose.

NameTypeReqDescription
appstringScope to a specific app/project — matches a pane's label (project name) or id (see pane_list). Omit for all apps.
grepstringCase-insensitive regex (or substring if invalid).
limitnumberMax events (default 200).
sinceSeqnumberOnly events with seq >= this (for incremental tailing).
sourcestringLimit to one source: server, browser, or native.
streamstringLimit to one stream, e.g. stdout, stderr, console, network, pageerror.

No output schema declared.

No examples provided.

get_logs_around ~129

Return ALL events (server + browser) within +/- windowMs of a timestamp, time-ordered — the correlation tool. E.g. the browser console error and the backend stack trace from the same moment. Timestamps come from the `ts` field on any event.

NameTypeReqDescription
appstringOptional: scope to one app/project (pane label or id; see pane_list).
sourcestringOptional: limit to one side.
tsnumberyesCenter timestamp (ms since epoch).
windowMsnumberHalf-window in ms (default 500).

No output schema declared.

No examples provided.

get_network ~118

List captured network requests (the full ring — every request, independent of DEVLOOP_NET_THRESHOLD). Each row has method/url/status/timing/headers (bodies for the curated subset). Unlike get_logs (curated timeline only); for an importable HAR file use export_har.

NameTypeReqDescription
appstringScope to one app/project (pane label or id).
grepstringSubstring match on the request line (status/method/url).
limitnumberMax rows (most recent), default 200.

No output schema declared.

No examples provided.

native_build ~150

Build + launch the native dev build for the active pane (`expo run:ios` / `expo run:android`); output streams to the timeline. Cockpit-only, local build. Needs the native toolchain (Xcode for iOS; Android SDK + `adb` + a JDK + `$ANDROID_HOME` for Android). If the Android toolchain isn't set up it returns `started:false` with a checklist of exactly what to install, instead of failing cryptically. After it boots, use native_open to drive it.

NameTypeReqDescription
cwdstringProject directory to build; defaults to the active pane's project.
platformstringyesWhich platform to build: ios or android.

No output schema declared.

No examples provided.

native_close ~36

Close the active native target; browser_* route back to the pane's web content. (Cockpit only.) Open one with native_open.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

native_doctor ~118

Report native readiness without building or opening anything: iOS simulator interactions, Android device interactions, and the Android local build toolchain — each a ✓/✗ checklist with the fix for anything missing. Cockpit-only, read-only. Re-probes live each call — run it after installing a missing tool to confirm it's resolved before native_build / native_open, or proactively before a long build. Returns { ios, androidInteractions, androidBuild }, each { ready, checks, summary }. native_build to build; native_open to drive a device.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

native_open ~134

Open a native target for the active pane (Expo/React Native): the iOS simulator or the Android device mirror. browser_* (snapshot/click/type/scroll/press/screenshot) then drive the native app via idb/adb, and JS + native logs stream to the timeline. Cockpit-only (needs the Electron app + a booted simulator/emulator). Returns ok:false with a reason if the device/tooling isn't ready. Build the app first with native_build; close with native_close.

NameTypeReqDescription
platformstringyesWhich native target to open: ios (simulator) or android (emulator mirror).

No output schema declared.

No examples provided.

pane_close ~54

Close a browser pane by id (irreversible). To detach a pane into its own window instead, use pane_pop. (Cockpit only.)

NameTypeReqDescription
idstringyesId of the pane to close (from pane_list).

No output schema declared.

No examples provided.

pane_list ~46

List browser panes (multi-target): each has id, url, active. The active pane is what browser_*/repro act on. Switch with pane_select. (Cockpit only.)

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

pane_new ~210

Open a new browser pane and make it active. Optionally navigate it to a URL and/or scope it to a project. Pass a saved `project` (resolves cwd/cmd/url/name), or explicit `cwd`/`cmd`/`label`, to scope the pane — cwd isolates its storage partition and names it. With none of these it's a blank, unscoped pane. To switch panes use pane_select; to close use pane_close. (Cockpit only.)

NameTypeReqDescription
cmdstringDev command to associate with the pane (used by a later dev_start).
cwdstringProject directory to scope the pane to (isolates its storage partition).
labelstringDisplay name for the pane (defaults to the project name or cwd basename).
projectstringName of a saved project to scope this pane to (see project_list).
urlstringOptional URL to open (else the project's URL, else a blank pane).

No output schema declared.

No examples provided.

pane_pop ~62

Detach a pane into its own standalone window (to view targets side-by-side). Closing that window re-docks the pane. pane_close removes it. (Cockpit only.)

NameTypeReqDescription
idstringyesId of the pane to pop out (from pane_list).

No output schema declared.

No examples provided.

pane_select ~51

Make a pane active so subsequent browser_*/repro calls target it. Find ids with pane_list. (Cockpit only.)

NameTypeReqDescription
idstringyesId of the pane to activate (from pane_list).

No output schema declared.

No examples provided.

pane_set_label ~73

Set a pane's display label (the tab name). Also what `app` filters match in get_logs/diagnose. (Cockpit only.)

NameTypeReqDescription
idstringyesId of the pane to label (from pane_list).
labelstringyesNew display label (e.g. the project name).

No output schema declared.

No examples provided.

project_add ~97

Save (or replace) a project in the registry so you can dev_start it by name. Replaces any existing project with the same name.

NameTypeReqDescription
cmdstringDev command (optional; auto-detected if omitted).
cwdstringyesProject directory.
namestringyesUnique project name (used to dev_start it later).
urlstringDefault URL to open in the browser pane (optional).

No output schema declared.

No examples provided.

project_list ~34

List saved projects (name, cwd, cmd, url) from the registry. Add with project_add, remove with project_remove.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

project_remove ~51

Remove a saved project from the registry by name (irreversible; doesn't stop a running server). List names with project_list.

NameTypeReqDescription
namestringyesName of the saved project to remove (see project_list).

No output schema declared.

No examples provided.

repro ~302

One-shot reproduce-and-correlate: clear the buffer (unless clear=false), perform one action OR a sequence in order, wait for async console/network/server events to land, then return EVERYTHING that happened on both sides plus per-step results and an errors summary. Use a sequence for flows like navigate → click → type → click submit.

NameTypeReqDescription
actionobjectA single action (convenience for a one-step sequence). Ignored if `actions` is given.
actionsarraySequence of actions performed in order. Use this OR `action`.
clearbooleanClear the buffer first (default true).
continueOnErrorbooleanKeep going if a step fails (default false: stop after the failing step).
idleMsnumberQuiet period that counts as idle for waitFor=networkidle (default 500).
settleMsnumberFixed wait after the FINAL action for waitFor=settle (default 1000).
stepSettleMsnumberFixed wait BETWEEN steps for waitFor=settle (default 300).
timeoutMsnumberMax wait for waitFor=networkidle before giving up (default 10000).
waitForstringHow to wait after each action: 'settle' = fixed sleep; 'networkidle' = wait until no network activity (more reliable for slow/streaming). Default 'settle'.

No output schema declared.

No examples provided.