
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
devglow-mcp
Advanced tools
MCP server for devglow — let Claude Code, Codex, and Cursor start, stop, and inspect your local dev processes
Lets Claude Code, Codex CLI, Cursor, and any MCP-compatible tool start, stop, and inspect your local dev processes through devglow.
devglow is a desktop process manager for macOS and Windows. You register a shell command once (next dev, vite, cargo run, docker compose up), and devglow runs it in a GUI instead of a terminal tab. This package is the MCP server that lets an agent drive it.
Requires the devglow desktop app. This server talks to it. Download for macOS or Windows.
When an agent runs a dev server with a plain shell tool, the process is attached to the agent's session. Output scrolls past, the port stays invisible until something collides with it, and the process dies with the session.
Through devglow the same process gets a window. You watch it run, read its logs, and stop it yourself. The agent started it; you own it.
Claude Code
claude mcp add -s user devglow -- npx -y --prefer-offline devglow-mcp@latest
Codex CLI
codex mcp add devglow -- npx -y --prefer-offline devglow-mcp@latest
Cursor and other clients. Add as a stdio MCP server in your client's settings (don't run it directly):
npx -y --prefer-offline devglow-mcp@latest
HTTP / SSE transport
npx -y --prefer-offline devglow-mcp@latest --transport http --port 26215
Streamable HTTP on /mcp, SSE on /sse.
Keep the @latest tag. A bare devglow-mcp spec makes npx cache a second copy and the handshake can time out.
| Tool | What it does |
|---|---|
list_projects | List registered projects and AI processes with status |
get_project | Full metadata for one project (path, command, port, tags) |
get_status | Running status of a project or AI process |
get_logs | Recent log lines from a running or stopped process |
check_port | Check if a TCP port is taken, and by what |
create_project | Register a project without starting it |
update_project | Edit a registered project |
delete_project | Remove a registered project |
start_project | Start a registered project with its own command |
stop_project | Stop a registered project |
run_process | Register and start one new temporary process |
workspace_run | Start several processes and lay them out on screen together |
stop_process | Stop a temporary AI process by name |
start_project over run_process. If you already registered a project, the agent should start your command rather than inventing its own. The tool descriptions tell it to call list_projects first and prefer start_project on a match.
workspace_run for two or more. Repeated run_process calls leave each process waiting in the sidebar until you click it into a pane, so starting three that way makes the app look like nothing happened. workspace_run puts them on screen together. It always creates a new workspace and never rearranges an existing one, so a repeat call can't disturb your layout.
check_port is worth calling before anything binds: when a port is occupied it reports who holds it, including whether it's another devglow project.
The server reads and writes devglow's local project files on your machine. Nothing is sent anywhere.
MIT
FAQs
MCP server for devglow — let Claude Code, Codex, and Cursor start, stop, and inspect your local dev processes
The npm package devglow-mcp receives a total of 169 weekly downloads. As such, devglow-mcp popularity was classified as not popular.
We found that devglow-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.