Devstack MCP server

• get_dependency_graphFree

  The fully resolved dependency graph for one exact package version, via deps.dev. Returns a flat nodes[] array plus integer-index edges[] (walk from/to to rebuild the tree). Each node carries relation (self | direct | indirect) and a direct boolean; node[0] is always the queried root (relation: self). Node order is NOT stable — look nodes up by name/relation, never by positional index. system is case-insensitive and lowercased (npm, pypi, cargo, go, maven, nuget). version is REQUIRED (a graph is resolved for one exact version).

• get_downloadsFree

  Download statistics for a package. Only npm (via api.npmjs.org) and PyPI (via pypistats.org) support this; any other registry returns 400 not_supported. npm returns a period window with downloads, start, and end; PyPI returns last_day, last_week, and last_month totals.

• get_ecosystems_packageFree

  Full normalized metadata for one package on one of 50+ registries, via ecosyste.ms — including the fields v1 registries can't give you: dependentReposCount and dependentPackagesCount (reverse dependencies), ecosystem, and vulnerabilityCount. Scoped/namespaced names are handled automatically. Returns 404 if the package does not exist on that ecosystem.

• get_insightsFree

  Health and security insights for a package's source project, via deps.dev. Returns the linked source repository, GitHub stars/forks/openIssues, licenses, resolved dependencyCount, security advisories, and the full OSSF Scorecard (ossfScore 0..10 plus the per-check breakdown). Omit version to use the registry default version — note deps.dev's default is a MOVING target and an unverified default mirror may have no computed scorecard (ossfScore: null); pin version for a stable, scorecard-backed result. system is lowercased (npm, pypi, cargo, go, maven, …).

• get_packageFree

  Full normalized details for one package by registry + name, in a single unified Package shape across npm, PyPI, Docker Hub, and the VS Code Marketplace. name handles scoped npm ids (e.g. @types/node), Docker namespaces (e.g. library/nginx or a bare nginx for official images), and VS Code publisher.extension ids. With registry=all the request fans out to every registry in parallel and returns a packages array (missing registries are silently dropped); otherwise a single package is returned.

• get_versionsFree

  List published versions (npm/PyPI), image tags (Docker Hub, most recent 25), or extension versions (VS Code) for a package. registry=all is NOT supported here — pick a single registry. Each item carries version and released, plus registry-specific extras (files for PyPI, size for Docker tags).

• get_vulnerabilitiesFree

  Known vulnerabilities (CVE / GHSA / PYSEC / GO advisories) for a package, via OSV.dev. Pass version to filter to advisories affecting that exact version, or omit it for the package's full advisory history. Each result carries the OSV id, cross-id aliases, a severity word grade (LOW|MODERATE|HIGH|CRITICAL), the cvss vector string, affectedRanges with fixed-version events, references, and cwes. A clean package returns count: 0 with an empty list (not an error). ecosystem is CASE-SENSITIVE — use OSV's spelling (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, …). Use scan_vulnerabilities_batch for lockfile batch scans.

• scan_vulnerabilities_batchFree

  Scan many packages in one call — ideal for a whole lockfile. Pass a queries[] array (max 100) of { ecosystem, name, version? }; results are returned positionally aligned, one row per query, each with a count and a hydrated vulns[] array. Advisories are de-duplicated and hydrated across the batch. ecosystem is CASE-SENSITIVE (OSV spelling).

• search_ecosystemsFree

  Look a package name up across 50+ registries at once, via ecosyste.ms. This is an EXACT-name lookup (not fuzzy full-text): q=react returns the react package everywhere it exists (npm, cargo, nuget, pub, bower, …), each as a normalized ecosystemsPackage with reverse-dependency counts. Pass ecosystem to narrow to one registry. Results carry dependentReposCount, dependentPackagesCount, and vulnerabilityCount.

• search_packagesFree

  Search a registry for packages matching q. registry=all fans out to npm, Docker Hub, and the VS Code Marketplace and merges the results. PyPI has no public search API, so registry=pypi returns 400 not_supported — look a PyPI package up by name via get_package instead. Results are normalized PackageSummary items (npm adds a relevance score; Docker adds isOfficial).

• –Code scanremote-only server, no package to scann/a
• Live reliabilityremote reachable in 349ms20/20
• Tool poisoning10 tool descriptions checked15/15
• Auth qualityopen endpoint, read-only tools10/15
• Maintenancelast push 54 days ago12/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

87/100

higher than 73% of 1,119 Developer tools servers

Tools

10

the typical Developer tools server has 7

Tools that change things

0%

typical: 5%. Fewer write tools means less an agent can break

Uptime

100%

of our recent checks; the typical remote Developer tools server answers 100%

Response time

218 ms

faster than 56% of 443 Developer tools servers

Devstack: common questions

Is Devstack MCP server safe?

Yes, by our scan: it is graded A (87/100). Read the Devstack safety report

How do I install Devstack?

It runs remotely at devstack-mcp.vercel.app. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.

Does Devstack need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Devstack maintained?

The last commit was 95 days ago (2026-08-01). The latest release is v1.0.0.

Is Devstack up?

100% of our last 28 checks got an answer. We check remote servers about four times a day.

What can I use instead of Devstack?

Servers from other publishers that do the same job: Repowise MCP server, Homebutler MCP server and Metaplex Agent Registry MCP server.

How does Devstack compare with other Developer tools MCP servers?

safety score 87/100 (higher than 73% of 1,119 Developer tools servers); tools 10 (the typical Developer tools server has 7); tools that change things 0% (typical: 5%. Fewer write tools means less an agent can break). Full comparison.