
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
devmcp-server
Advanced tools
A from-scratch MCP server exposing git, CI, filesystem, SQLite, and Docker tooling over the full protocol surface (tools, resources, prompts, roots, sampling).
A from-scratch MCP server exposing git and CI tooling over the full protocol surface — tools, resources with live push subscriptions, prompts, roots negotiation, and sampling — not just the tools primitive most example servers stop at.
Standalone and independently installable; has no import dependency on
verimcp (the sibling package in this repo that proxies and verifies
backends like this one — see the root README for how they
fit together, though devmcp works fine as a plain MCP server on its own).
Run devmcp --repo-path ./some-repo and it:
tools/call for write_file, git_commit, git_branch,
run_ci_pipeline — each produces a real, independently-checkable side
effect on disk or in git, not just a claimed resultresources/read for repo://status, repo://log,
repo://file/{path}, ci://last-run, and pushes
notifications/resources/updated unprompted when a subscribed resource
changesprompts/get for commit-message and pr-description templatesroots/list and relocates its own working
directory to whatever the Client declares, rather than trusting its own
--repo-path flag blindlysummarize_diff, asks the Client's own model to do the
summarization via sampling/createMessage — devmcp never needs its own
LLM API key, it borrows whatever model the Host already haspip install devmcp-server # PyPI distribution name -- CLI/import are still plain `devmcp`
devmcp --repo-path ./some-repo
Contributing to this repo instead:
pip install -e ".[dev]"
pytest tests
ruff check src tests
MIT — see LICENSE.
FAQs
A from-scratch MCP server exposing git, CI, filesystem, SQLite, and Docker tooling over the full protocol surface (tools, resources, prompts, roots, sampling).
We found that devmcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.