← Back to search

devloop-mcp

GitHub Actions Scanned 12d ago

Unified dev-loop: one MCP server exposing browser control + dev-server logs on a correlated timeline. Headless (stdio) or Electron cockpit (HTTP).

npm
C
69 / 100

Versions

0.10.2latest
Jul 22, 2026
0.10.1
Jul 11, 2026
0.10.0
Jul 11, 2026
0.9.1
Jul 1, 2026
0.9.0
Jul 1, 2026
+ show 23 moreshow less
0.8.0
Jun 30, 2026
0.7.1
Jun 27, 2026
0.7.0
Jun 26, 2026
0.6.2
Jun 26, 2026
0.6.1
Jun 26, 2026
0.6.0
Jun 25, 2026
0.5.2
Jun 24, 2026
0.5.1
Jun 23, 2026
0.5.0
Jun 23, 2026
0.4.0
Jun 23, 2026
0.3.7
Jun 22, 2026
0.3.6
Jun 22, 2026
0.3.5
Jun 22, 2026
0.3.4
Jun 18, 2026
0.3.3
Jun 17, 2026
0.3.2
Jun 17, 2026
0.3.1
Jun 17, 2026
0.3.0
Jun 17, 2026
0.2.2
Jun 12, 2026
0.2.1
Jun 12, 2026
0.2.0
Jun 12, 2026
0.1.1
Jun 11, 2026
0.1.0
Jun 11, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 48

clear_logs
annotations: verified low

Scope to one app/project (pane label or id; see pane_list). Omit for all.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
export_bundle
annotations: verified low

Scope to one app/project (pane label or id; see pane_list). Omit for all.

readOnlyHint true openWorldHint false idempotentHint false
diagnose
annotations: verified low

Only consider events from the last N ms (default: all).

readOnlyHint true openWorldHint false idempotentHint false
browser_navigate
annotations: verified low

Absolute URL to load (e.g. http://localhost:3000/path).

readOnlyHint true openWorldHint true idempotentHint false destructiveHint false
browser_back
annotations: verified low

Ignore the cache (hard reload). Default false. Cockpit only; ignored under Puppeteer.

readOnlyHint true openWorldHint true idempotentHint false destructiveHint false
browser_forward
annotations: verified low

Ignore the cache (hard reload). Default false. Cockpit only; ignored under Puppeteer.

readOnlyHint true openWorldHint true idempotentHint false destructiveHint false
browser_reload
annotations: verified low

Ignore the cache (hard reload). Default false. Cockpit only; ignored under Puppeteer.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
browser_screenshot
annotations: verified low

Capture the full scrollable page, not just the viewport (default false).

readOnlyHint true openWorldHint false destructiveHint false
browser_click
annotations: verified low

CSS selector of the element to click (e.g. a `ref` from browser_snapshot).

openWorldHint true destructiveHint false
browser_type
annotations: verified low

CSS selector of the input/textarea to type into.

openWorldHint true destructiveHint false
browser_eval
annotations: verified low

A JavaScript expression evaluated in the page; its result is returned (JSON-serializable values).

openWorldHint true idempotentHint true destructiveHint false
browser_hover
annotations: verified low

CSS selector of the element to hover over.

openWorldHint true idempotentHint true destructiveHint false
browser_scroll
annotations: verified low

CSS selector to scroll into view. Omit to scroll the window instead.

openWorldHint true idempotentHint true destructiveHint false
browser_select
annotations: verified low

CSS selector of the <select> or input.

openWorldHint true idempotentHint true destructiveHint false
browser_press
annotations: verified low

Key name to press, e.g. Enter, Escape, Tab, ArrowDown.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
browser_emulate
annotations: verified low

Device preset to emulate. Use this OR width+height.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
browser_throttle
annotations: verified low

Network profile to apply; `none` removes throttling.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
browser_clear_storage
annotations: verified low

Wipe the entire session, not just the current origin.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
browser_wait_for_idle
annotations: verified low

Quiet period with no requests that counts as idle, in ms (default 500).

readOnlyHint true openWorldHint false idempotentHint true
browser_snapshot
annotations: verified low

Max elements to return (default 250). Raise it for dense pages (large tables / long forms) where the default truncates the snapshot.

readOnlyHint true openWorldHint false idempotentHint true
browser_wait_for
annotations: verified low

CSS selector to wait for.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
get_logs
annotations: mismatch low

Limit to one source: server, browser, or native.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
get_logs_around
annotations: mismatch low

Center timestamp (ms since epoch).

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
export_har
annotations: verified low

Scope to one app/project (pane label or id; see pane_list). Omit for all.

readOnlyHint true openWorldHint false idempotentHint false destructiveHint false
get_network
annotations: verified low

Substring match on the request line (status/method/url).

readOnlyHint true openWorldHint false idempotentHint false destructiveHint false
dev_start
annotations: verified low

Name of a saved project (see project_list).

readOnlyHint true openWorldHint true idempotentHint false destructiveHint false
dev_stop
annotations: verified low

Unique project name (used to dev_start it later).

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
project_list
annotations: verified low

Unique project name (used to dev_start it later).

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
project_add
annotations: verified low

Unique project name (used to dev_start it later).

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
project_remove
annotations: verified low

Name of the saved project to remove (see project_list).

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
pane_list
annotations: verified low

Optional URL to open (else the project's URL, else a blank pane).

readOnlyHint true openWorldHint false idempotentHint false destructiveHint true
pane_new
annotations: verified low

Optional URL to open (else the project's URL, else a blank pane).

readOnlyHint true openWorldHint true idempotentHint false destructiveHint true
pane_select
annotations: verified low

Id of the pane to activate (from pane_list).

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
pane_close
annotations: verified low

Id of the pane to close (from pane_list).

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
pane_pop
annotations: verified low

Id of the pane to pop out (from pane_list).

readOnlyHint true openWorldHint false idempotentHint false
pane_set_label
annotations: verified low

Id of the pane to label (from pane_list).

readOnlyHint true openWorldHint false idempotentHint true
dev_status
annotations: verified low

Which native target to open: ios (simulator) or android (emulator mirror).

readOnlyHint true openWorldHint false idempotentHint true
native_open
annotations: verified low

Which native target to open: ios (simulator) or android (emulator mirror).

readOnlyHint true openWorldHint true idempotentHint true
native_close
annotations: verified low

Which platform to build: ios or android.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
native_build
annotations: verified low

Which platform to build: ios or android.

readOnlyHint true openWorldHint true idempotentHint false destructiveHint true
native_doctor
annotations: verified low

Extension id (32 chars) or a Chrome Web Store URL.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
ext_list
annotations: verified low

Extension id (32 chars) or a Chrome Web Store URL.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint true
ext_install
annotations: verified low

Extension id (32 chars) or a Chrome Web Store URL.

openWorldHint true idempotentHint true destructiveHint true
ext_remove
annotations: verified low

Extension id to remove (see ext_list).

openWorldHint false idempotentHint true destructiveHint true
ext_set_enabled
annotations: verified low

Extension id to toggle (see ext_list).

openWorldHint false idempotentHint true destructiveHint false
repro
annotations: verified low

Sequence of actions performed in order. Use this OR `action`.

openWorldHint true destructiveHint false
x
annotations: verified low

the a

readOnlyHint true
y
annotations: none low

Permissions 3

network medium
Server uses network capabilities via: fetch(), http
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 120

info
Tool 'browser_back' annotations are consistent annotation_checker · 80%
info
Tool 'browser_forward' annotations are consistent annotation_checker · 80%
info
Tool 'browser_reload' annotations are consistent annotation_checker · 80%
info
Tool 'browser_screenshot' annotations are consistent annotation_checker · 80%
info
Tool 'browser_click' annotations are consistent annotation_checker · 80%
info
Tool 'browser_type' annotations are consistent annotation_checker · 80%
info
Tool 'browser_eval' annotations are consistent annotation_checker · 80%
info
Tool 'browser_navigate' annotations are consistent annotation_checker · 80%
info
Tool 'browser_hover' annotations are consistent annotation_checker · 80%
info
Tool 'browser_scroll' annotations are consistent annotation_checker · 80%
info
Tool 'browser_select' annotations are consistent annotation_checker · 80%
info
Tool 'browser_press' annotations are consistent annotation_checker · 80%
info
Tool 'browser_emulate' annotations are consistent annotation_checker · 80%
info
Tool 'browser_throttle' annotations are consistent annotation_checker · 80%
info
Tool 'browser_clear_storage' annotations are consistent annotation_checker · 80%
info
Tool 'browser_wait_for_idle' annotations are consistent annotation_checker · 80%
info
Tool 'browser_snapshot' annotations are consistent annotation_checker · 80%
info
Tool 'browser_wait_for' annotations are consistent annotation_checker · 80%
medium
Tool 'get_logs' claims destructive but name implies read-only operation annotation_checker · 80%
medium
Tool 'get_logs_around' claims destructive but name implies read-only operation annotation_checker · 80%
info
Tool 'clear_logs' annotations are consistent annotation_checker · 80%
info
Tool 'export_bundle' annotations are consistent annotation_checker · 80%
info
Tool 'diagnose' annotations are consistent annotation_checker · 80%
info
Tool 'export_har' annotations are consistent annotation_checker · 80%
info
Tool 'get_network' annotations are consistent annotation_checker · 80%
info
Tool 'dev_start' annotations are consistent annotation_checker · 80%
info
Tool 'dev_stop' annotations are consistent annotation_checker · 80%
info
Tool 'project_list' annotations are consistent annotation_checker · 80%
info
Tool 'project_add' annotations are consistent annotation_checker · 80%
info
Tool 'project_remove' annotations are consistent annotation_checker · 80%
info
Tool 'pane_list' annotations are consistent annotation_checker · 80%
info
Tool 'pane_new' annotations are consistent annotation_checker · 80%
info
Tool 'pane_select' annotations are consistent annotation_checker · 80%
info
Tool 'pane_close' annotations are consistent annotation_checker · 80%
info
Tool 'pane_pop' annotations are consistent annotation_checker · 80%
info
Tool 'pane_set_label' annotations are consistent annotation_checker · 80%
info
Tool 'dev_status' annotations are consistent annotation_checker · 80%
info
Tool 'native_open' annotations are consistent annotation_checker · 80%
info
Tool 'native_close' annotations are consistent annotation_checker · 80%
info
Tool 'native_build' annotations are consistent annotation_checker · 80%
info
Tool 'native_doctor' annotations are consistent annotation_checker · 80%
info
Tool 'ext_list' annotations are consistent annotation_checker · 80%
info
Tool 'ext_install' annotations are consistent annotation_checker · 80%
info
Tool 'ext_remove' annotations are consistent annotation_checker · 80%
info
Tool 'ext_set_enabled' annotations are consistent annotation_checker · 80%
info
Tool 'repro' annotations are consistent annotation_checker · 80%
info
Tool 'x' annotations are consistent annotation_checker · 80%
low
Tool 'y' has no annotations annotation_checker · 100%
high
Remote transport without authentication auth_checker · 70%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Suspicious package name: react-native dependency_analyzer · 60%
medium
Vulnerable dependency: mermaid@11.4.1 (GHSA-2v8p-3f2j-5mp7) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.4.1 (GHSA-6m6c-36f7-fhxh) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.4.1 (GHSA-6x64-9x62-f2gx) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.4.1 (GHSA-7rqq-prvp-x9jh) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.4.1 (GHSA-87f9-hvmw-gh4p) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.4.1 (GHSA-8gwm-58g9-j8pw) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.4.1 (GHSA-c4c3-pg64-4m4v) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.4.1 (GHSA-ghcm-xqfw-q4vr) dependency_analyzer · 95%
medium
Vulnerable dependency: mermaid@11.4.1 (GHSA-xcj9-5m2h-648r) dependency_analyzer · 95%
medium
Buffer.from base64 in vincentvella-devloop-50f0e70/src/sourcemap.ts:61 entropy_analyzer · 75%
medium
Buffer.from base64 in vincentvella-devloop-50f0e70/src/electronBrowser.ts:167 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: browser_navigate manifest_parser · 75%
info
Tool: browser_back manifest_parser · 75%
info
Tool: browser_forward manifest_parser · 75%
info
Tool: browser_reload manifest_parser · 75%
info
Tool: browser_screenshot manifest_parser · 75%
info
Tool: browser_click manifest_parser · 75%
info
Tool: browser_type manifest_parser · 75%
info
Tool: browser_eval manifest_parser · 75%
info
Tool: browser_hover manifest_parser · 75%
info
Tool: browser_scroll manifest_parser · 75%
info
Tool: browser_select manifest_parser · 75%
info
Tool: browser_press manifest_parser · 75%
info
Tool: browser_emulate manifest_parser · 75%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
info
Tool: browser_throttle manifest_parser · 75%
info
Tool: browser_clear_storage manifest_parser · 75%
info
Tool: browser_wait_for_idle manifest_parser · 75%
info
Tool: browser_snapshot manifest_parser · 75%
info
Tool: browser_wait_for manifest_parser · 75%
info
Tool: get_logs manifest_parser · 75%
info
Tool: get_logs_around manifest_parser · 75%
info
Tool: clear_logs manifest_parser · 75%
info
Tool: export_bundle manifest_parser · 75%
info
Tool: diagnose manifest_parser · 75%
info
Tool: export_har manifest_parser · 75%
info
Tool: get_network manifest_parser · 75%
info
Tool: dev_start manifest_parser · 75%
info
Tool: dev_stop manifest_parser · 75%
info
Tool: project_list manifest_parser · 75%
info
Tool: project_add manifest_parser · 75%
info
Tool: project_remove manifest_parser · 75%
info
Tool: pane_list manifest_parser · 75%
info
Tool: pane_new manifest_parser · 75%
info
Tool: pane_select manifest_parser · 75%
info
Tool: pane_close manifest_parser · 75%
info
Tool: pane_pop manifest_parser · 75%
info
Tool: pane_set_label manifest_parser · 75%
info
Tool: dev_status manifest_parser · 75%
info
Tool: native_open manifest_parser · 75%
info
Tool: native_close manifest_parser · 75%
info
Tool: native_build manifest_parser · 75%
info
Tool: native_doctor manifest_parser · 75%
info
Tool: ext_list manifest_parser · 75%
info
Tool: ext_install manifest_parser · 75%
info
Tool: ext_remove manifest_parser · 75%
info
Tool: ext_set_enabled manifest_parser · 75%
info
Tool: repro manifest_parser · 75%
info
Tool: x manifest_parser · 75%
info
Tool: y manifest_parser · 75%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (28) manifest_parser · 80%
medium
Permission: network access detected permission_analyzer · 80%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 36 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%