devstack-mcp

A remote MCP connector that exposes DevStack API endpoints as typed tools for LLM agents. It provides normalized access to developer registry data across npm, PyPI, Docker Hub, and VS Code Marketplace, including package search, details, versions, download stats, dependency graphs, and vulnerability insights.

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

Community listingStreamable HTTPNo sign-inEndpoint checked 2026-11-06Published by IsaiahDupree

MCP endpoint (Streamable HTTP)

https://devstack-mcp.vercel.app/mcp

Vendor documentation

What its tools do

10 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.

10 of 10 have a description · 10 of 10 declare behavior hints · 10 of 10 with parameters document them all

Checks and signals

Each line is separate evidence, not a trust score.

Passed Endpoint answered the live check · Nov 6, 2026, 3:21 PM UTC
Availability 1 of 1 checks passed in 30 days

What you can do with it

Search packages across npm, PyPI, Docker, and VS Code
Retrieve normalized package details and version information
Fetch download and pull statistics for packages
Resolve dependency graphs and check for vulnerabilities

Source and maintenance

Community listingRegistry 1.0.0

mcp-registry: io.github.IsaiahDupree/devstack-mcp@1.0.0 Source repository Project website

Maintenance checked: Nov 6, 2026, 3:14 PM UTC

Protocol and capabilities

Server: devstack 1.0.0
MCP protocol negotiated in check: 2025-11-25
Tools: 10 advertised
Resources: Not advertised
Resource templates: Not advertised
Prompts: Not advertised

Server-advertised capabilities

{
  "tools": {
    "listChanged": true
  }
}

Tools

10 advertised

get_package — Get normalized package details

Advertised by the server during the last successful anonymous check.

Advertised read-onlyOpen-world

Full normalized details for one package by registry + name, in a single unified Package shape across npm, PyPI, Docker Hub, and the VS Code Marketplace. name handles scoped npm ids (e.g. @types/node), Docker namespaces (e.g. library/nginx or a bare nginx for official images), and VS Code publisher.extension ids. With registry=all the request fans out to every registry in parallel and returns a packages array (missing registries are silently dropped); otherwise a single package is returned.

get_package input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "registry",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Package name / id. Supports scoped npm ids (@scope/pkg), Docker namespaces (ns/name or a bare name for official images), and VS Code publisher.extension ids."
    },
    "registry": {
      "enum": [
        "npm",
        "pypi",
        "docker",
        "vscode",
        "all"
      ],
      "type": "string",
      "description": "Target registry. \"all\" fans out to every registry and merges results."
    }
  }
}

get_package annotations

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

search_packages — Search packages across registries

Advertised by the server during the last successful anonymous check.

Advertised read-onlyOpen-world

Search a registry for packages matching q. registry=all fans out to npm, Docker Hub, and the VS Code Marketplace and merges the results. PyPI has no public search API, so registry=pypi returns 400 not_supported — look a PyPI package up by name via get_package instead. Results are normalized PackageSummary items (npm adds a relevance score; Docker adds isOfficial).

search_packages input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "registry",
    "q"
  ],
  "properties": {
    "q": {
      "type": "string",
      "description": "Search query."
    },
    "limit": {
      "type": "integer",
      "maximum": 50,
      "minimum": 1,
      "description": "Max results per registry. Clamped to 1-50. Default 20."
    },
    "registry": {
      "enum": [
        "npm",
        "pypi",
        "docker",
        "vscode",
        "all"
      ],
      "type": "string",
      "description": "Target registry. \"all\" fans out to npm, Docker, and VS Code and merges results. pypi returns not_supported."
    }
  }
}

search_packages annotations

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

get_versions — Get published versions / tags

Advertised by the server during the last successful anonymous check.

Advertised read-onlyOpen-world

List published versions (npm/PyPI), image tags (Docker Hub, most recent 25), or extension versions (VS Code) for a package. registry=all is NOT supported here — pick a single registry. Each item carries version and released, plus registry-specific extras (files for PyPI, size for Docker tags).

get_versions input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "registry",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Package name / id (scoped npm ids, Docker namespaces, and VS Code publisher.extension ids supported)."
    },
    "registry": {
      "enum": [
        "npm",
        "pypi",
        "docker",
        "vscode"
      ],
      "type": "string",
      "description": "Target registry. \"all\" is not supported here — pick one."
    }
  }
}

get_versions annotations

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

get_downloads — Get download / pull statistics

Advertised by the server during the last successful anonymous check.

Advertised read-onlyOpen-world

Download statistics for a package. Only npm (via api.npmjs.org) and PyPI (via pypistats.org) support this; any other registry returns 400 not_supported. npm returns a period window with downloads, start, and end; PyPI returns last_day, last_week, and last_month totals.

get_downloads input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "registry",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Package name."
    },
    "registry": {
      "enum": [
        "npm",
        "pypi"
      ],
      "type": "string",
      "description": "Target registry. Only npm and pypi expose download stats."
    }
  }
}

get_downloads annotations

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

get_dependency_graph — Get resolved dependency graph

Advertised by the server during the last successful anonymous check.

Advertised read-onlyOpen-world

The fully resolved dependency graph for one exact package version, via deps.dev. Returns a flat nodes[] array plus integer-index edges[] (walk from/to to rebuild the tree). Each node carries relation (self | direct | indirect) and a direct boolean; node[0] is always the queried root (relation: self). Node order is NOT stable — look nodes up by name/relation, never by positional index. system is case-insensitive and lowercased (npm, pypi, cargo, go, maven, nuget). version is REQUIRED (a graph is resolved for one exact version).

get_dependency_graph input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "system",
    "name",
    "version"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Package name / id."
    },
    "system": {
      "enum": [
        "npm",
        "pypi",
        "cargo",
        "go",
        "maven",
        "nuget"
      ],
      "type": "string",
      "description": "Package system / ecosystem for deps.dev. Case-insensitive, lowercased server-side."
    },
    "version": {
      "type": "string",
      "description": "Exact version to resolve (e.g. 18.2.0). Required."
    }
  }
}

get_dependency_graph annotations

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

get_vulnerabilities — Get vulnerabilities for a package

Advertised by the server during the last successful anonymous check.

Advertised read-onlyOpen-world

Known vulnerabilities (CVE / GHSA / PYSEC / GO advisories) for a package, via OSV.dev. Pass version to filter to advisories affecting that exact version, or omit it for the package's full advisory history. Each result carries the OSV id, cross-id aliases, a severity word grade (LOW|MODERATE|HIGH|CRITICAL), the cvss vector string, affectedRanges with fixed-version events, references, and cwes. A clean package returns count: 0 with an empty list (not an error). ecosystem is CASE-SENSITIVE — use OSV's spelling (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, …). Use scan_vulnerabilities_batch for lockfile batch scans.

get_vulnerabilities input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "ecosystem",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Package name."
    },
    "version": {
      "type": "string",
      "description": "Exact version to filter advisories to. Omit for full history."
    },
    "ecosystem": {
      "type": "string",
      "description": "OSV ecosystem, CASE-SENSITIVE (e.g. npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems)."
    }
  }
}

get_vulnerabilities annotations

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

scan_vulnerabilities_batch — Batch vulnerability scan (lockfile)

Advertised by the server during the last successful anonymous check.

Advertised read-onlyOpen-world

Scan many packages in one call — ideal for a whole lockfile. Pass a queries[] array (max 100) of { ecosystem, name, version? }; results are returned positionally aligned, one row per query, each with a count and a hydrated vulns[] array. Advisories are de-duplicated and hydrated across the batch. ecosystem is CASE-SENSITIVE (OSV spelling).

scan_vulnerabilities_batch input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "queries"
  ],
  "properties": {
    "queries": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "name"
        ],
        "properties": {
          "name": {
            "type": "string",
            "description": "Package name (required)."
          },
          "version": {
            "type": "string",
            "description": "Exact version. Omit for full history."
          },
          "ecosystem": {
            "type": "string",
            "description": "OSV ecosystem (case-sensitive). e.g. npm, PyPI, Go."
          }
        }
      },
      "maxItems": 100,
      "minItems": 1,
      "description": "Up to 100 { ecosystem, name, version? } queries, ideal for a whole lockfile."
    }
  }
}

scan_vulnerabilities_batch annotations

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

get_insights — Get project insights — OSSF Scorecard + repo signal

Advertised by the server during the last successful anonymous check.

Advertised read-onlyOpen-world

Health and security insights for a package's source project, via deps.dev. Returns the linked source repository, GitHub stars/forks/openIssues, licenses, resolved dependencyCount, security advisories, and the full OSSF Scorecard (ossfScore 0..10 plus the per-check breakdown). Omit version to use the registry default version — note deps.dev's default is a MOVING target and an unverified default mirror may have no computed scorecard (ossfScore: null); pin version for a stable, scorecard-backed result. system is lowercased (npm, pypi, cargo, go, maven, …).

get_insights input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "system",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Package name / id."
    },
    "system": {
      "enum": [
        "npm",
        "pypi",
        "cargo",
        "go",
        "maven",
        "nuget"
      ],
      "type": "string",
      "description": "Package system / ecosystem for deps.dev. Case-insensitive, lowercased server-side."
    },
    "version": {
      "type": "string",
      "description": "Exact version. Omit for the (moving) registry default version."
    }
  }
}

get_insights annotations

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

search_ecosystems — Cross-registry package lookup (50+ ecosystems)

Advertised by the server during the last successful anonymous check.

Advertised read-onlyOpen-world

Look a package name up across 50+ registries at once, via ecosyste.ms. This is an EXACT-name lookup (not fuzzy full-text): q=react returns the react package everywhere it exists (npm, cargo, nuget, pub, bower, …), each as a normalized ecosystemsPackage with reverse-dependency counts. Pass ecosystem to narrow to one registry. Results carry dependentReposCount, dependentPackagesCount, and vulnerabilityCount.

search_ecosystems input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "q"
  ],
  "properties": {
    "q": {
      "type": "string",
      "description": "Exact package name to look up across registries."
    },
    "limit": {
      "type": "integer",
      "maximum": 50,
      "minimum": 1,
      "description": "Max results. Clamped to 1-50. Default 20."
    },
    "ecosystem": {
      "type": "string",
      "description": "Narrow to one ecosystem (e.g. pypi, npm, cargo). Omit to search all."
    }
  }
}

search_ecosystems annotations

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

get_ecosystems_package — Get one package on one registry (with reverse-dep counts)

Advertised by the server during the last successful anonymous check.

Advertised read-onlyOpen-world

Full normalized metadata for one package on one of 50+ registries, via ecosyste.ms — including the fields v1 registries can't give you: dependentReposCount and dependentPackagesCount (reverse dependencies), ecosystem, and vulnerabilityCount. Scoped/namespaced names are handled automatically. Returns 404 if the package does not exist on that ecosystem.

get_ecosystems_package input schema

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "ecosystem",
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Package name / id."
    },
    "ecosystem": {
      "type": "string",
      "description": "Target ecosyste.ms ecosystem slug (e.g. npm, pypi, cargo, rubygems)."
    }
  }
}

get_ecosystems_package annotations

{
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

Prompts

Not advertised

No prompt definitions available.

Resources

Not advertised

No resource definitions available.

90-day uptime

A lightweight connection check about every six hours, sampled on hosts with many listings. It shows the server answered, not that its tools work.

Too few checks for a percentage yet (1 of 1 answered).

2026-11-06: 1 of 1 checks answered

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks: 1 of 1 (100%)
Average latency: 562 ms
95th percentile latency: 562 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

Nov 6, 2026, 3:21 PM UTC · probe · passed · 562 ms · metadata changed · 10 tool(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.

Claude Code configuration

claude mcp add --transport http devstack-mcp https://devstack-mcp.vercel.app/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).

Codex configuration

codex mcp add devstack-mcp --url https://devstack-mcp.vercel.app/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable devstack-mcp in your MCP settings.

Cursor configuration

{
  "mcpServers": {
    "devstack-mcp": {
      "url": "https://devstack-mcp.vercel.app/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).

Cline configuration

{
  "mcpServers": {
    "devstack-mcp": {
      "type": "streamableHttp",
      "url": "https://devstack-mcp.vercel.app/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start devstack-mcp and inspect its tools.

VS Code configuration

{
  "servers": {
    "devstack-mcp": {
      "type": "http",
      "url": "https://devstack-mcp.vercel.app/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.

Gemini CLI configuration

gemini mcp add --transport http devstack-mcp https://devstack-mcp.vercel.app/mcp

Claude Desktop

Open Claude Settings > Connectors > Add custom connector, enter this server URL and enable it for the conversation. This is a manual remote-connector handoff, not a desktop JSON configuration.

Claude Desktop configuration

https://devstack-mcp.vercel.app/mcp

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.

Windsurf configuration

{
  "mcpServers": {
    "devstack-mcp": {
      "serverUrl": "https://devstack-mcp.vercel.app/mcp"
    }
  }
}

Let your agent find its tools

Find servers like devstack-mcp from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows

See all 7,870

devstack-mcp

Endpoint and access

What its tools do

Read-only (10)

Checks and signals

What you can do with it

Source and maintenance

Protocol and capabilities

Tools

Prompts

Resources

90-day uptime

30-day availability

Maintenance history

Connect from your client

Claude Code

Codex

Cursor

Cline

VS Code

Gemini CLI

Claude Desktop

Windsurf

Let your agent find its tools

Other developer tools servers