How do I install Devstack?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Devstack need an API key?

No required environment variable is listed on this record.

When was Devstack last checked?

Last checked 2026-11-09. Dev-registry data: npm/PyPI/Docker/VS Code packages, dep graphs, vulns, 50+ ecosystems.

Devstack MCP server

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://devstack-mcp.vercel.app/mcp

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http io.github.isaiahdupree-devstack-mcp https://devstack-mcp.vercel.app/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.isaiahdupree-devstack-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://devstack-mcp.vercel.app/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Live

Transport: http
Version: 1.0.0
Last checked

10 tools

Tools

tools/listVoice mode preview

Tool	What it does
get_package	Full normalized details for one package by registry + name, in a single unified Package shape across npm, PyPI, Docker Hub, and the VS Code Marketplace. name handles scoped npm ids (e.g. @types/node), Docker namespaces (e.g. library/nginx or a bare nginx for official images), and VS Code publisher.e
search_packages	Search a registry for packages matching q. registry=all fans out to npm, Docker Hub, and the VS Code Marketplace and merges the results. PyPI has no public search API, so registry=pypi returns 400 not_supported — look a PyPI package up by name via get_package instead. Results are normalized PackageS
get_versions	List published versions (npm/PyPI), image tags (Docker Hub, most recent 25), or extension versions (VS Code) for a package. registry=all is NOT supported here — pick a single registry. Each item carries version and released, plus registry-specific extras (files for PyPI, size for Docker tags).
get_downloads	Download statistics for a package. Only npm (via api.npmjs.org) and PyPI (via pypistats.org) support this; any other registry returns 400 not_supported. npm returns a period window with downloads, start, and end; PyPI returns last_day, last_week, and last_month totals.
get_dependency_graph	The fully resolved dependency graph for one exact package version, via deps.dev. Returns a flat nodes[] array plus integer-index edges[] (walk from/to to rebuild the tree). Each node carries relation (self \| direct \| indirect) and a direct boolean; node[0] is always the queried root (relation: self)
get_vulnerabilities	Known vulnerabilities (CVE / GHSA / PYSEC / GO advisories) for a package, via OSV.dev. Pass version to filter to advisories affecting that exact version, or omit it for the package's full advisory history. Each result carries the OSV id, cross-id aliases, a severity word grade (LOW\|MODERATE\|HIGH\|CRI
scan_vulnerabilities_batch	Scan many packages in one call — ideal for a whole lockfile. Pass a queries[] array (max 100) of { ecosystem, name, version? }; results are returned positionally aligned, one row per query, each with a count and a hydrated vulns[] array. Advisories are de-duplicated and hydrated across the batch. ec
get_insights	Health and security insights for a package's source project, via deps.dev. Returns the linked source repository, GitHub stars/forks/openIssues, licenses, resolved dependencyCount, security advisories, and the full OSSF Scorecard (ossfScore 0..10 plus the per-check breakdown). Omit version to use the
search_ecosystems	Look a package name up across 50+ registries at once, via ecosyste.ms. This is an EXACT-name lookup (not fuzzy full-text): q=react returns the react package everywhere it exists (npm, cargo, nuget, pub, bower, …), each as a normalized ecosystemsPackage with reverse-dependency counts. Pass ecosystem
get_ecosystems_package	Full normalized metadata for one package on one of 50+ registries, via ecosyste.ms — including the fields v1 registries can't give you: dependentReposCount and dependentPackagesCount (reverse dependencies), ecosystem, and vulnerabilityCount. Scoped/namespaced names are handled automatically. Returns

devstack-mcp

A remote MCP (Model Context Protocol) connector for DevStack API — the libraries.io successor: one keyless, normalized view of the whole developer registry across npm, PyPI, Docker Hub, and the VS Code Marketplace (search, package details, versions, download/pull stats), plus resolved dependency graphs (deps.dev), per-version vulnerabilities (OSV.dev), OSSF Scorecard insights (deps.dev), and cross-registry lookups over 50+ ecosystems (ecosyste.ms).

Target deploy: https://devstack-mcp.vercel.app/mcp — 10 tools. Since the upstream DevStack deployment is metered (RapidAPI/Apify) and gates /v1/* behind a RapidAPI proxy-secret guard, this connector authenticates its own outbound calls with that same proxy secret (DEVSTACK_MCP_PROXY_SECRET, sent as the X-RapidAPI-Proxy-Secret header) and applies a soft per-IP rate limit (DEVSTACK_MCP_RATE_LIMIT, default 30 tool-calls/hour, in-memory) so the free MCP tier stays a discovery channel rather than an unmetered bypass of the paid listing — see lib/ratelimit.js.

What this is, and why it's a separate connector

DevStack API is a plain REST API. Any HTTP client can already call it directly. This repo exists because MCP clients (Claude, ChatGPT, and other MCP-aware agents) don't consume arbitrary REST APIs — they consume MCP tools. devstack-mcp is a thin adapter layer that:

Exposes each DevStack endpoint as a discoverable, typed MCP tool (name, description, zod input schema, annotations) that an LLM can reason about and call directly, instead of having to be taught the REST surface out-of-band.
Speaks the MCP streamable-HTTP transport at a single /mcp endpoint, so it can be registered as a connector in Claude, ChatGPT, or any other MCP client with one URL.
Does nothing else. It has no business logic of its own — every tool call is a pass-through fetch to DevStack, and the JSON response DevStack returns is handed back verbatim as the tool result.

Authentication: None on the MCP side (deliberate)

DevStack's data has no per-user dimension at all — it's public developer-registry metadata (package listings, versions, download counts, dependency graphs, published CVEs). There is nothing to gate per-caller, so this connector intentionally ships with:

No OAuth, no login, no per-user bearer tokens
No Supabase / database
No demo-vs-real account split — every caller gets the same real, live data

The one server-side secret it carries (DEVSTACK_MCP_PROXY_SECRET) is not per-caller auth — it's how this connector, as a single consumer, gets past the upstream's RapidAPI proxy-secret guard to reach real data. Combined with the soft per-IP rate limit, that keeps this a free discovery tier over the metered DevStack product rather than an unmetered bypass of the paid RapidAPI/Apify listing.

Tool list

One tool per DevStack /v1 endpoint (from devstack-api/openapi.yaml):

Tool	DevStack endpoint	Description
`get_package`	`GET /v1/package`	Normalized package details by registry + name (`registry=all` fans out).
`search_packages`	`GET /v1/search`	Search npm/Docker/VS Code (or `all`); PyPI has no search API.
`get_versions`	`GET /v1/versions`	Published versions / image tags / extension versions.
`get_downloads`	`GET /v1/downloads`	Download / pull statistics (npm + PyPI only).
`get_dependency_graph`	`GET /v1/deps`	Fully resolved dependency graph for one exact version (deps.dev).
`get_vulnerabilities`	`GET /v1/vulns`	Known CVEs/GHSAs per package/version (OSV.dev).
`scan_vulnerabilities_batch`	`POST /v1/vulns`	Batch/lockfile vulnerability scan — up to 100 queries in one call (OSV.dev).
`get_insights`	`GET /v1/insights`	OSSF Scorecard + repo signal + licenses/advisories (deps.dev).
`search_ecosystems`	`GET /v1/ecosystems/search`	Cross-registry exact-name lookup across 50+ ecosystems (ecosyste.ms).
`get_ecosystems_package`	`GET /v1/ecosystems/package`	One package on one registry, with reverse-dependency counts (ecosyste.ms).

All 10 tools are read-only and annotated { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true }. scan_vulnerabilities_batch is an HTTP POST but is a read-only query (it mutates nothing), so it carries the same read-only annotations.

How it wraps devstack-api

Each tool handler does a plain fetch(\${DEVSTACK_MCP_API_BASE_URL}${path}`, ...)` against the real DevStack REST API and returns the parsed JSON as MCP tool-result content:

{ content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] }

Upstream HTTP errors (4xx/5xx) are caught and surfaced as a typed MCP error result via an asError helper rather than crashing the request.

Environment variables

Env var	Purpose	Default
`DEVSTACK_MCP_API_BASE_URL`	Upstream DevStack base URL.	`https://devstack-api.vercel.app`
`DEVSTACK_MCP_PROXY_SECRET`	RapidAPI proxy secret, sent as `X-RapidAPI-Proxy-Secret` to pass the upstream `/v1/*` guard.	`""` (omitted)
`DEVSTACK_MCP_RATE_LIMIT`	Soft per-IP tool-calls/hour cap for this free tier.	`30`

Project layout

api/mcp.js       MCP endpoint (StreamableHTTPServerTransport, stateless, no per-caller auth)
api/health.js    GET /api/health
lib/tools.js     All 10 tool definitions (zod schemas + fetch-and-forward handlers)
lib/ratelimit.js Soft per-IP tools/call cap (free discovery tier)
local-server.js  Plain-Node http server for local dev / smoke testing (not deployed)
test/smoke.mjs   Real end-to-end smoke test (initialize, tools/list, tools/call)
vercel.json      Routes /mcp -> api/mcp.js, /health -> api/health.js
server.json      MCP registry publish manifest

Local development

npm install
npm run dev          # starts local-server.js on http://localhost:3900

Endpoints locally: POST http://localhost:3900/mcp, GET http://localhost:3900/health.

To point at a self-hosted / open DevStack instance instead of production (useful for a fully keyless end-to-end run, since production's /v1/* is behind the RapidAPI proxy-secret guard):

# In devstack-api (guard is inert when RAPIDAPI_PROXY_SECRET is unset):
node server.js                                   # listens on :8080

# In devstack-mcp:
DEVSTACK_MCP_API_BASE_URL=http://localhost:8080 npm run dev

Smoke test

npm run dev &                 # terminal 1
npm run smoke                 # terminal 2

test/smoke.mjs drives the running server over real HTTP/JSON-RPC and verifies:

GET /health returns { ok: true, ... }
initialize succeeds and reports serverInfo.name === "devstack"
tools/list returns all 10 tools with their zod-derived JSON schemas
tools/call for get_package with { registry: "npm", name: "react" } returns real package data fetched live (not mocked)

Against production, step 4 needs DEVSTACK_MCP_PROXY_SECRET set (the RapidAPI proxy guard); against a locally self-hosted devstack-api with no RAPIDAPI_PROXY_SECRET, the guard is inert and real data flows keyless.

Deploy

Not deployed by this build. Once ready:

cd /Users/isaiahdupree/Software/devstack-mcp
npx vercel --yes --prod

After deploy, set DEVSTACK_MCP_PROXY_SECRET in the Vercel project so the connector can reach the guarded production /v1/*, then register the MCP connector URL in Claude/ChatGPT/any MCP client:

https://<deployment-domain>/mcp

Devstack

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Devstack?

Does Devstack need an API key?

What transport does Devstack use?

When was Devstack last checked?

Documentation

devstack-mcp

What this is, and why it's a separate connector

Authentication: None on the MCP side (deliberate)

Tool list

How it wraps devstack-api

Environment variables

Project layout

Local development

Smoke test

Deploy