Devo MCP Server

by 7df-lab• 341•• Scanned•Claim this listing•Request removal
Data Science & MLagent runtimeai agentanthropic compatiblecode searchcoding agent

A self-improving agent. Tested on DeepSeek, Qwen, Kimi, GLM models. Supports MCP, Skills.

Devo is an open-source mcp server by 7df-lab, written mainly in Rust, with 341 GitHub stars and the MIT license. Its code was last updated Oct 22, 2026.

Scan summary: scanned Nov 5, 2026 at commit af1a254. Seen able to read environment and secrets. Scan policy

Scanned
Full scan at af1a254 · Nov 5, 2026
Scanned
Static code scanwarn
Secrets scanfail
Dependency audit376 known vulnerabilitiesfail
Manifestnonewarn
Buildn/a
Boot & handshaken/a
Network egressn/a
Reproducible (×3)n/a

Findings (99)

  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    Very long encoded string literal. Often used to hide a payload.
    apps/tui/lib/coding-agent/src/modes/interactive/components/daxnuts.ts:12
  • medium
    quinn-proto@0.11.14: 5 known vulnerabilities
    RUSTSEC-2026-0185, RUSTSEC-2026-0338, RUSTSEC-2026-0339, RUSTSEC-2026-0340, RUSTSEC-2026-0342
    Cargo.lock
  • medium
    rmcp@0.15.0: 5 known vulnerabilities
    RUSTSEC-2026-0189, GHSA-33f5-2c5q-wgwj, GHSA-9g45-5xwm-f3wc, GHSA-9pj6-vhgr-3mwh, GHSA-c9xm-49cp-xcr9
    Cargo.lock
  • medium
    @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities
    GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
    apps/desktop/bun.lock
  • medium
    @xmldom/xmldom@0.8.13: 10 known vulnerabilities
    GHSA-27p8-2357-5qqv, GHSA-4w3w-2rp5-g8jm, GHSA-6gmq-8vp8-gcm6, GHSA-6h8r-xr42-gp59, GHSA-8344-3jmq-59r6 +5 more
    apps/desktop/bun.lock
  • medium
    body-parser@2.3.0: 1 known vulnerability
    GHSA-27r3-jxmh-p828
    apps/desktop/bun.lock
  • medium
    brace-expansion@1.1.15: 12 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +7 more
    apps/desktop/bun.lock
  • medium
    brace-expansion@2.1.1: 12 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +7 more
    apps/desktop/bun.lock
  • medium
    brace-expansion@5.0.6: 12 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +7 more
    apps/desktop/bun.lock
  • medium
    browserslist@4.28.4: 2 known vulnerabilities
    GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
    apps/desktop/bun.lock
  • medium
    electron@43.4.1: 9 known vulnerabilities
    GHSA-2p8c-gr87-2676, GHSA-3qxv-5xgr-q7w9, GHSA-98mx-cjp9-gchm, GHSA-997q-gvvc-jwmx, GHSA-fw47-9c62-h3vw +4 more
    apps/desktop/bun.lock
  • medium
    fast-uri@3.1.2: 11 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +6 more
    apps/desktop/bun.lock
  • medium
    happy-dom@20.14.5: 3 known vulnerabilities
    GHSA-5fpq-26gf-qwcr, GHSA-834v-8h66-3h79, GHSA-c8p4-j97h-3vg8
    apps/desktop/bun.lock
  • medium
    hono@4.11.9: 35 known vulnerabilities
    GHSA-26pp-8wgv-hjvm, GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-458j-xx4x-4375, GHSA-5pq2-9x2x-5p6w +30 more
    apps/desktop/bun.lock
  • medium
    ip-address@10.2.0: 8 known vulnerabilities
    GHSA-22jq-vg5j-6vgg, GHSA-2vr4-cq9g-pvrc, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv +3 more
    apps/desktop/bun.lock
  • medium
    js-yaml@4.2.0: 3 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj
    apps/desktop/bun.lock
  • medium
    linkify-it@3.0.3: 2 known vulnerabilities
    GHSA-22p9-wv53-3rq4, GHSA-v245-v573-v5vm
    apps/desktop/bun.lock
  • medium
    nanoid@3.3.15: 2 known vulnerabilities
    GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
    apps/desktop/bun.lock
  • medium
    nanoid@5.1.15: 1 known vulnerability
    GHSA-28wg-ghj8-5hjv
    apps/desktop/bun.lock
  • medium
    postcss@8.5.15: 4 known vulnerabilities
    GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849, GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
    apps/desktop/bun.lock
  • medium
    source-map-js@1.2.1: 3 known vulnerabilities
    GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q
    apps/desktop/bun.lock
  • medium
    systeminformation@5.31.9: 3 known vulnerabilities
    GHSA-3f7j-7jwc-fxfj, GHSA-4vjg-vx72-qq4g, GHSA-7648-jmwf-vw7j
    apps/desktop/bun.lock
  • medium
    undici@6.27.0: 11 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-4qv8-2p9j-2685, GHSA-8xcm-r25x-g524, GHSA-9fm3-97px-rjf6 +6 more
    apps/desktop/bun.lock
  • medium
    undici@7.28.0: 23 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +18 more
    apps/desktop/bun.lock
  • medium
    vite@7.3.5: 5 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22
    apps/desktop/bun.lock
  • medium
    zod@3.25.76: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    apps/desktop/bun.lock
  • medium
    zod@4.4.3: 2 known vulnerabilities
    GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5
    apps/desktop/bun.lock
  • medium
    basic-ftp@5.3.1: 1 known vulnerability
    GHSA-c475-qrg2-pj4r
    apps/tui/package-lock.json
  • medium
    extract-zip@2.0.1: 2 known vulnerabilities
    GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv
    apps/tui/package-lock.json
  • medium
    undici@7.29.1: 8 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more
    apps/tui/package-lock.json
  • medium
    vite@8.3.0: 6 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +1 more
    apps/tui/package-lock.json
  • medium
    zod@4.6.5: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    apps/tui/package-lock.json
  • medium
    @opennextjs/cloudflare@1.19.11: 1 known vulnerability
    GHSA-2vc4-c4r6-p6v6
    apps/web/package-lock.json
  • medium
    body-parser@2.2.2: 2 known vulnerabilities
    GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
    apps/web/package-lock.json
  • medium
    browserslist@4.28.2: 2 known vulnerabilities
    GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
    apps/web/package-lock.json
  • medium
    form-data@4.0.5: 1 known vulnerability
    GHSA-hmw2-7cc7-3qxx
    apps/web/package-lock.json
  • medium
    js-yaml@4.1.1: 4 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
    apps/web/package-lock.json
  • medium
    nanoid@3.3.12: 2 known vulnerabilities
    GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
    apps/web/package-lock.json
  • medium
    postcss@8.4.31: 4 known vulnerabilities
    GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
    apps/web/package-lock.json
  • medium
    sharp@0.34.5: 3 known vulnerabilities
    GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w
    apps/web/package-lock.json
  • medium
    undici@7.24.8: 29 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-35p6-xmwp-9g52, GHSA-3xpg-4rpp-hhhm +24 more
    apps/web/package-lock.json
  • medium
    ws@8.20.1: 1 known vulnerability
    GHSA-96hv-2xvq-fx4p
    apps/web/package-lock.json
  • medium
    mcp@2.0.0: 4 known vulnerabilities
    GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv, GHSA-rwrf-2pqf-9j8j, GHSA-w4fh-qvv9-3v23
    crates/kernel/rlm-runtime/uv.lock
  • low
    Possible example credential in docs/tests: generic-api-key
    apps/desktop/src/renderer/lib/mock-data.ts:24
  • low
    Possible example credential in docs/tests: generic-api-key
    4 matches in this file
    crates/server/tests/approval_park_preemption.rs:179
  • low
    anyhow@1.0.102: 1 known vulnerability
    RUSTSEC-2026-0190
    Cargo.lock
  • low
    atomic-polyfill@1.0.3: 1 known vulnerability
    RUSTSEC-2023-0089
    Cargo.lock
  • low
    crossbeam-epoch@0.9.18: 1 known vulnerability
    RUSTSEC-2026-0204
    Cargo.lock
  • low
    derivative@2.2.0: 1 known vulnerability
    RUSTSEC-2024-0388
    Cargo.lock
  • low
    event-listener@5.4.1: 1 known vulnerability
    RUSTSEC-2026-0221
    Cargo.lock
  • low
    fxhash@0.2.1: 1 known vulnerability
    RUSTSEC-2025-0057
    Cargo.lock
  • low
    h2@0.4.14: 1 known vulnerability
    RUSTSEC-2026-0258
    Cargo.lock
  • low
    lru@0.12.5: 2 known vulnerabilities
    RUSTSEC-2026-0002, RUSTSEC-2026-0253
    Cargo.lock
  • low
    paste@1.0.15: 1 known vulnerability
    RUSTSEC-2024-0436
    Cargo.lock
  • low
    rustls@0.23.40: 4 known vulnerabilities
    RUSTSEC-2026-0285, RUSTSEC-2026-0346, RUSTSEC-2026-0348, RUSTSEC-2026-0349
    Cargo.lock
  • low
    rustls-webpki@0.103.13: 1 known vulnerability
    RUSTSEC-2026-0382
    Cargo.lock
  • low
    tokio@1.52.3: 1 known vulnerability
    RUSTSEC-2026-0386
    Cargo.lock
  • low
    unsafe-libyaml@0.2.11: 1 known vulnerability
    RUSTSEC-2024-0449
    Cargo.lock
  • low
    webbrowser@1.2.1: 1 known vulnerability
    RUSTSEC-2026-0257
    Cargo.lock
  • low
    webpki-roots@1.0.7: 1 known vulnerability
    RUSTSEC-2026-0381
    Cargo.lock
  • low
    zbus_names@3.0.0: 1 known vulnerability
    RUSTSEC-2026-0371
    Cargo.lock
  • low
    zvariant@4.2.0: 1 known vulnerability
    RUSTSEC-2026-0370
    Cargo.lock
  • low
    zvariant_derive@4.2.0: 1 known vulnerability
    RUSTSEC-2026-0372
    Cargo.lock
  • low
    @ai-sdk/provider-utils@4.0.30: 1 known vulnerability
    GHSA-866g-f22w-33x8
    apps/desktop/bun.lock
  • low
    @hono/node-server@1.19.14: 2 known vulnerabilities
    GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f
    apps/desktop/bun.lock
  • low
    baseline-browser-mapping@2.10.38: 1 known vulnerability
    GHSA-w5vr-8v7q-w6rv
    apps/desktop/bun.lock
  • low
    deepmerge@4.3.1: 1 known vulnerability
    GHSA-gcqx-w48m-w2h4
    apps/desktop/bun.lock
  • low
    esbuild@0.27.7: 1 known vulnerability
    GHSA-g7r4-m6w7-qqqr
    apps/desktop/bun.lock
  • low
    katex@0.16.47: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    apps/desktop/bun.lock
  • low
    mermaid@11.15.0: 5 known vulnerabilities
    GHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6x64-9x62-f2gx, GHSA-c4c3-pg64-4m4v, GHSA-rhh3-jpg6-66xh
    apps/desktop/bun.lock
  • low
    minimatch@10.2.5: 2 known vulnerabilities
    GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249
    apps/desktop/bun.lock
  • low
    minimatch@9.0.9: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    apps/desktop/bun.lock
  • low
    postcss-selector-parser@7.1.4: 1 known vulnerability
    GHSA-rj75-hqrm-r3gf
    apps/desktop/bun.lock
  • low
    qs@6.15.2: 6 known vulnerabilities
    GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw +1 more
    apps/desktop/bun.lock
  • low
    @earendil-works/pi-coding-agent@0.9.4: 1 known vulnerability
    GHSA-mqxh-6gq7-558m
    apps/tui/package-lock.json
  • low
    @vitest/mocker@4.1.11: 2 known vulnerabilities
    GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp
    apps/tui/package-lock.json
  • low
    glob@13.0.6: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    apps/tui/package-lock.json
  • low
    ip-address@10.7.2: 1 known vulnerability
    GHSA-rxp7-6hxx-x8q5
    apps/tui/package-lock.json
  • low
    minimatch@10.2.6: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    apps/tui/package-lock.json
  • low
    baseline-browser-mapping@2.10.33: 1 known vulnerability
    GHSA-w5vr-8v7q-w6rv
    apps/web/package-lock.json
  • low
    esbuild@0.27.3: 1 known vulnerability
    GHSA-g7r4-m6w7-qqqr
    apps/web/package-lock.json
  • low
    esbuild@0.28.0: 1 known vulnerability
    GHSA-g7r4-m6w7-qqqr
    apps/web/package-lock.json
  • low
    glob@12.0.0: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    apps/web/package-lock.json
  • low
    glob@9.3.5: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    apps/web/package-lock.json
  • low
    minimatch@8.0.7: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    apps/web/package-lock.json
  • low
    opentelemetry-api@1.44.0: 1 known vulnerability
    GHSA-xcq7-p3pf-p88h
    crates/kernel/rlm-runtime/uv.lock
  • low
    No manifest declaring network access and environment variables (agent.json)

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Devo alternatives

View more →

Similar mcp servers in Data Science & ML, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Devo (this page)
7df-lab
341MITOct 22, 2026Scanned, no flagged issues
MaxKB
1Panel-dev
23kGPL-3.0Nov 1, 2026Scanned, no flagged issues
FunASR
modelscope
21kMITNov 1, 2026Scanned, no flagged issues
Ida Pro MCP
mrexodia
13kMITSep 26, 2026Scanned, no flagged issues
Pal MCP Server
BeehiveInnovations
12kNone foundDec 15, 2025Not scanned yet
Osaurus
osaurus-ai
8.1kMITNov 1, 2026Scanned, no flagged issues