Devstack MCP is answering right now. Last checked 2 min ago. It exposes 10 tools. Last commit 1 Aug 2026.
Dev-registry data: npm/PyPI/Docker/VS Code packages, dep graphs, vulns, 50+ ecosystems.
Uptime history
91 days of history · worst day 10%
91 days agonow
9.9%
Uptime 24h
9 of 91 checks
10
Tools
read from the server
534 ms
Response time
average over 24h
0
Stars
last commit 1 Aug 2026
Devstack MCP does not always answer
Over the last week it answered 51.8% of our checks. We check every 15 minutes, so you hear about the next outage within the hour — not from your users.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 2 min ago.
run in your terminal
claude mcp add devstack-mcp --transport http https://devstack-mcp.vercel.app/mcpSettings → Connectors → Add custom connector, then paste this address
https://devstack-mcp.vercel.app/mcp~/.codex/config.toml
[mcp_servers.devstack-mcp]
url = "https://devstack-mcp.vercel.app/mcp".cursor/mcp.json
{
"mcpServers": {
"devstack-mcp": {
"url": "https://devstack-mcp.vercel.app/mcp"
}
}
}.vscode/mcp.json
{
"servers": {
"devstack-mcp": {
"type": "http",
"url": "https://devstack-mcp.vercel.app/mcp"
}
}
}Available tools 10
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
ecosystems
get_ecosystems_package
Full normalized metadata for one package on one of 50+ registries, via ecosyste.ms — including the fields v1 registries can't give you: dependentReposCount and dependentPackagesCount (reverse dependencies), ecosystem, and vulnerabilityCount. Scoped/namespaced names are handled automatically. Returns 404 if the package does not exist on that ecosystem.
search_ecosystems
Look a package name up across 50+ registries at once, via ecosyste.ms. This is an EXACT-name lookup (not fuzzy full-text): q=react returns the react package everywhere it exists (npm, cargo, nuget, pub, bower, …), each as a normalized ecosystemsPackage with reverse-dependency counts. Pass ecosystem to narrow to one registry. Results carry dependentReposCount, dependentPackagesCount, and vulnerabilityCount.
dependency
get_dependency_graph
The fully resolved dependency graph for one exact package version, via deps.dev. Returns a flat nodes[] array plus integer-index edges[] (walk from/to to rebuild the tree). Each node carries relation (self | direct | indirect) and a direct boolean; node[0] is always the queried root (relation: self). Node order is NOT stable — look nodes up by name/relation, never by positional index. system is case-insensitive and lowercased (npm, pypi, cargo, go, maven, nuget). version is REQUIRED (a graph is resolved for one exact version).
downloads
get_downloads
Download statistics for a package. Only npm (via api.npmjs.org) and PyPI (via pypistats.org) support this; any other registry returns 400 not_supported. npm returns a period window with downloads, start, and end; PyPI returns last_day, last_week, and last_month totals.
insights
get_insights
Health and security insights for a package's source project, via deps.dev. Returns the linked source repository, GitHub stars/forks/openIssues, licenses, resolved dependencyCount, security advisories, and the full OSSF Scorecard (ossfScore 0..10 plus the per-check breakdown). Omit version to use the registry default version — note deps.dev's default is a MOVING target and an unverified default mirror may have no computed scorecard (ossfScore: null); pin version for a stable, scorecard-backed result. system is lowercased (npm, pypi, cargo, go, maven, …).
package
get_package
Full normalized details for one package by registry + name, in a single unified Package shape across npm, PyPI, Docker Hub, and the VS Code Marketplace. name handles scoped npm ids (e.g. @types/node), Docker namespaces (e.g. library/nginx or a bare nginx for official images), and VS Code publisher.extension ids. With registry=all the request fans out to every registry in parallel and returns a packages array (missing registries are silently dropped); otherwise a single package is returned.
packages
search_packages
Search a registry for packages matching q. registry=all fans out to npm, Docker Hub, and the VS Code Marketplace and merges the results. PyPI has no public search API, so registry=pypi returns 400 not_supported — look a PyPI package up by name via get_package instead. Results are normalized PackageSummary items (npm adds a relevance score; Docker adds isOfficial).
scan
scan_vulnerabilities_batch
Scan many packages in one call — ideal for a whole lockfile. Pass a queries[] array (max 100) of { ecosystem, name, version? }; results are returned positionally aligned, one row per query, each with a count and a hydrated vulns[] array. Advisories are de-duplicated and hydrated across the batch. ecosystem is CASE-SENSITIVE (OSV spelling).
versions
get_versions
List published versions (npm/PyPI), image tags (Docker Hub, most recent 25), or extension versions (VS Code) for a package. registry=all is NOT supported here — pick a single registry. Each item carries version and released, plus registry-specific extras (files for PyPI, size for Docker tags).
vulnerabilities
get_vulnerabilities
Known vulnerabilities (CVE / GHSA / PYSEC / GO advisories) for a package, via OSV.dev. Pass version to filter to advisories affecting that exact version, or omit it for the package's full advisory history. Each result carries the OSV id, cross-id aliases, a severity word grade (LOW|MODERATE|HIGH|CRITICAL), the cvss vector string, affectedRanges with fixed-version events, references, and cwes. A clean package returns count: 0 with an empty list (not an error). ecosystem is CASE-SENSITIVE — use OSV's spelling (npm, PyPI, Go, crates.io, Maven, NuGet, RubyGems, …). Use scan_vulnerabilities_batch for lockfile batch scans.
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://devstack-mcp.vercel.app/mcp | streamable-http | answering | 467 ms | 2 min ago |
Alternatives to Devstack MCP
same job, measured the same wayNPMScan
by salemalem
Detect malicious or vulnerable npm packages: registry search, OSV.dev and GitHub advisory lookups
Understand Quickly
by looptech-ai
Public registry of code-knowledge graphs for AI agents with schema validation and drift detection.
Slimdex MCP
by siddhukaushik
Narrow code retrieval for agents: outlines, symbol context, dep graph, persistent memory.
DevLens
by devlensio
Query a precomputed code graph (nodes, edges, summaries) of TS/JS/React/Next.js/Node repos via MCP.
Codesearch
by sk-dev-ai
Code, package, docs, paper and vulnerability search. 17 tools, keyless lanes.
Package Health
by orcsnren
Is this dependency still maintained? Scores npm, PyPI packages and GitHub repos 0-100.
devcontainer-mcp
by aniongithub
Manage dev container environments via MCP (Docker, DevPod, Codespaces).
RepoGates
by repogates
Trust verdicts on repos, models, VS Code and Docker Desktop extensions and agent skills.
Devstack MCP — questions
Answers built from our own checks of this server.
What can Devstack MCP do?
It exposes 10 tools, read directly from the server on our last check. Among them: get_dependency_graph, get_downloads, get_ecosystems_package, get_insights, get_package, get_versions and 4 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README.
How MCP servers expose tools in the first place →
Is Devstack MCP working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 9 of 91 checks got a reply (9.9%), average response time 534 ms. The bar chart above shows every period we have measured.
How do I connect Devstack MCP?
Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Devstack MCP need an API key?
No. Devstack MCP completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 10 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Devstack MCP?
It answers our handshake in 534 ms on average, which is faster than 22% of all working MCP servers we measure. That is on the slow side — worth knowing if the tool sits inside an interactive loop. The comparison comes from our own checks across the whole registry, every 15 minutes.
Is Devstack MCP open source?
We cannot say either way: written in JavaScript and 0 stars on GitHub, but we could not determine the licence, and without one the code is not open source by default.