Power your agent
URL ของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
https://devstack-mcp.vercel.app/mcpปุ่ม Claude ด้านบนจะเปิด Claude พร้อมกรอกชื่อและ URL ให้แล้ว คุณยังต้องยืนยันที่นั่นเอง
claude mcp add --transport http io.github.isaiahdupree-devstack-mcp https://devstack-mcp.vercel.app/mcpRun in a terminal.
{ "mcpServers": { "io.github.isaiahdupree-devstack-mcp": { "command": "npx", "args": [ "-y", "mcp-remote", "https://devstack-mcp.vercel.app/mcp" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดจากผู้เผยแพร่
A remote MCP (Model Context Protocol) connector for DevStack API — the libraries.io successor: one keyless, normalized view of the whole developer registry across npm, PyPI, Docker Hub, and the VS Code Marketplace (search, package details, versions, download/pull stats), plus resolved dependency graphs (deps.dev), (OSV.dev), (deps.dev), and (ecosyste.ms).
Dev-registry data: npm/PyPI/Docker/VS Code packages, dep graphs, vulns, 50+ ecosystems.
Target deploy: https://devstack-mcp.vercel.app/mcp — 10 tools. Since the upstream DevStack deployment is metered (RapidAPI/Apify) and gates /v1/* behind a RapidAPI proxy-secret guard, this connector authenticates its own outbound calls with that same proxy secret (DEVSTACK_MCP_PROXY_SECRET, sent as the X-RapidAPI-Proxy-Secret header) and applies a soft per-IP rate limit (DEVSTACK_MCP_RATE_LIMIT, default 30 tool-calls/hour, in-memory) so the free MCP tier stays a discovery channel rather than an unmetered bypass of the paid listing — see lib/ratelimit.js.
DevStack API is a plain REST API. Any HTTP client can already call it directly. This repo exists because MCP clients (Claude, ChatGPT, and other MCP-aware agents) don't consume arbitrary REST APIs — they consume MCP tools. devstack-mcp is a thin adapter layer that:
/mcp endpoint, so it can be registered as a connector in Claude, ChatGPT, or any other MCP client with one URL.fetch to DevStack, and the JSON response DevStack returns is handed back verbatim as the tool result.DevStack's data has no per-user dimension at all — it's public developer-registry metadata (package listings, versions, download counts, dependency graphs, published CVEs). There is nothing to gate per-caller, so this connector intentionally ships with:
The one server-side secret it carries (DEVSTACK_MCP_PROXY_SECRET) is not per-caller auth — it's how this connector, as a single consumer, gets past the upstream's RapidAPI proxy-secret guard to reach real data. Combined with the soft per-IP rate limit, that keeps this a free discovery tier over the metered DevStack product rather than an unmetered bypass of the paid RapidAPI/Apify listing.
One tool per DevStack /v1 endpoint (from devstack-api/openapi.yaml):
All 10 tools are read-only and annotated { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true }. scan_vulnerabilities_batch is an HTTP POST but is a read-only query (it mutates nothing), so it carries the same read-only annotations.
Each tool handler does a plain fetch(\${DEVSTACK_MCP_API_BASE_URL}${path}`, ...)` against the real DevStack REST API and returns the parsed JSON as MCP tool-result content:
{ content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] }
Upstream HTTP errors (4xx/5xx) are caught and surfaced as a typed MCP error result via an asError helper rather than crashing the request.
api/mcp.js MCP endpoint (StreamableHTTPServerTransport, stateless, no per-caller auth)
api/health.js GET /api/health
lib/tools.js All 10 tool definitions (zod schemas + fetch-and-forward handlers)
lib/ratelimit.js Soft per-IP tools/call cap (free discovery tier)
local-server.js Plain-Node http server for local dev / smoke testing (not deployed)
test/smoke.mjs Real end-to-end smoke test (initialize, tools/list, tools/call)
vercel.json Routes /mcp -> api/mcp.js, /health -> api/health.js
server.json MCP registry publish manifest
npm install
npm run dev # starts local-server.js on http://localhost:3900
Endpoints locally: POST http://localhost:3900/mcp, GET http://localhost:3900/health.
To point at a self-hosted / open DevStack instance instead of production (useful for a fully keyless end-to-end run, since production's /v1/* is behind the RapidAPI proxy-secret guard):
# In devstack-api (guard is inert when RAPIDAPI_PROXY_SECRET is unset):
node server.js # listens on :8080
# In devstack-mcp:
DEVSTACK_MCP_API_BASE_URL=http://localhost:8080 npm run dev
npm run dev & # terminal 1
npm run smoke # terminal 2
test/smoke.mjs drives the running server over real HTTP/JSON-RPC and verifies:
GET /health returns { ok: true, ... }initialize succeeds and reports serverInfo.name === "devstack"tools/list returns all 10 tools with their zod-derived JSON schemastools/call for get_package with { registry: "npm", name: "react" } returns real package data fetched live (not mocked)Against production, step 4 needs DEVSTACK_MCP_PROXY_SECRET set (the RapidAPI proxy guard); against a locally self-hosted devstack-api with no RAPIDAPI_PROXY_SECRET, the guard is inert and real data flows keyless.
Not deployed by this build. Once ready:
cd /Users/isaiahdupree/Software/devstack-mcp
npx vercel --yes --prod
After deploy, set DEVSTACK_MCP_PROXY_SECRET in the Vercel project so the connector can reach the guarded production /v1/*, then register the MCP connector URL in Claude/ChatGPT/any MCP client:
https://<deployment-domain>/mcp
Dev-registry data: npm/PyPI/Docker/VS Code packages, dep graphs, vulns, 50+ ecosystems.
{ "mcpServers": { "io.github.isaiahdupree-devstack-mcp": { "url": "https://devstack-mcp.vercel.app/mcp", "headers": {} } }}10 เครื่องมือ
FAQ
| List published versions (npm/PyPI), image tags (Docker Hub, most recent 25), or extension versions (VS Code) for a package. registry=all is NOT supported here — pick a single registry. Each item carries version and released, plus registry-specific extras (files for PyPI, size for Docker tags). |
| get_downloads | Download statistics for a package. Only npm (via api.npmjs.org) and PyPI (via pypistats.org) support this; any other registry returns 400 not_supported. npm returns a period window with downloads, start, and end; PyPI returns last_day, last_week, and last_month totals. |
| get_dependency_graph | The fully resolved dependency graph for one exact package version, via deps.dev. Returns a flat nodes[] array plus integer-index edges[] (walk from/to to rebuild the tree). Each node carries relation (self | direct | indirect) and a direct boolean; node[0] is always the queried root (relation: self) |
| get_vulnerabilities | Known vulnerabilities (CVE / GHSA / PYSEC / GO advisories) for a package, via OSV.dev. Pass version to filter to advisories affecting that exact version, or omit it for the package's full advisory history. Each result carries the OSV id, cross-id aliases, a severity word grade (LOW|MODERATE|HIGH|CRI |
| scan_vulnerabilities_batch | Scan many packages in one call — ideal for a whole lockfile. Pass a queries[] array (max 100) of { ecosystem, name, version? }; results are returned positionally aligned, one row per query, each with a count and a hydrated vulns[] array. Advisories are de-duplicated and hydrated across the batch. ec |
| get_insights | Health and security insights for a package's source project, via deps.dev. Returns the linked source repository, GitHub stars/forks/openIssues, licenses, resolved dependencyCount, security advisories, and the full OSSF Scorecard (ossfScore 0..10 plus the per-check breakdown). Omit version to use the |
| search_ecosystems | Look a package name up across 50+ registries at once, via ecosyste.ms. This is an EXACT-name lookup (not fuzzy full-text): q=react returns the react package everywhere it exists (npm, cargo, nuget, pub, bower, …), each as a normalized ecosystemsPackage with reverse-dependency counts. Pass ecosystem |
| get_ecosystems_package | Full normalized metadata for one package on one of 50+ registries, via ecosyste.ms — including the fields v1 registries can't give you: dependentReposCount and dependentPackagesCount (reverse dependencies), ecosystem, and vulnerabilityCount. Scoped/namespaced names are handled automatically. Returns |
คัดลอกคอนฟิก http สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
Devstack เข้าถึงได้ผ่าน HTTP
ตรวจสอบล่าสุดเมื่อ 2026-11-09 Dev-registry data: npm/PyPI/Docker/VS Code packages, dep graphs, vulns, 50+ ecosystems.