Devopness MCP Server
by devopnessDevopness: AI DevOps on your cloud. Deploy apps, infra and CI/CD. Any cloud and any stack, one MCP. Deterministic API, opinionated and fully configurable. No cloud credentials in AI chats. Free plan.
Devopness is an open-source mcp server by devopness, written mainly in TypeScript, with 573 GitHub stars and the Apache-2.0 license. Its code was last updated Oct 30, 2026.
Scan summary: scanned Nov 5, 2026 at commit f571af4. Seen able to run shell commands. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
f571af4 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.Static code scanwarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Flagged. This check found an issue. See the findings below.Secrets scanfailFlagged. This check found an issue. See the findings below.
Flagged. This check found an issue. See the findings below.Dependency audit181 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Flagged. This check found an issue. See the findings below.BuildfailFlagged. This check found an issue. See the findings below.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Boot & handshaken/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Network egressn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Reproducible (×3)n/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Findings (95)
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
.github/scripts/pr-validate-description-test.js:38 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.async@3.2.0: 1 known vulnerabilityGHSA-fwr7-v2mv-hh25
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@2.0.1: 8 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +3 more
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.braces@3.0.2: 1 known vulnerabilityGHSA-grv7-fg5c-xmjg
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserify-sign@4.2.1: 1 known vulnerabilityGHSA-x9w5-v3q2-3rhw
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.21.3: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.cross-spawn@5.1.0: 1 known vulnerabilityGHSA-3xgq-45jj-v275
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.cross-spawn@7.0.3: 1 known vulnerabilityGHSA-3xgq-45jj-v275
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.extract-zip@2.0.1: 2 known vulnerabilitiesGHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.get-func-name@2.0.0: 1 known vulnerabilityGHSA-4q6p-r6v2-jvc5
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.http-cache-semantics@4.1.0: 1 known vulnerabilityGHSA-rc47-6667-2j5j
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@3.14.0: 5 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@3.14.1: 5 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.1.0: 5 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.linkify-it@2.2.0: 2 known vulnerabilitiesGHSA-22p9-wv53-3rq4, GHSA-v245-v573-v5vm
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.lodash@4.17.21: 2 known vulnerabilitiesGHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.markdown-it@10.0.0: 5 known vulnerabilitiesGHSA-253c-mchw-3w2r, GHSA-6v5v-wf23-fmfq, GHSA-6vfc-qv3f-vr6c, GHSA-r7fv-28h4-cvq7, GHSA-vfgh-jcmw-g37q
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@5.1.0: 3 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.node-fetch@1.7.3: 1 known vulnerabilityGHSA-r683-j2x4-v87g
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.picomatch@2.3.0: 2 known vulnerabilitiesGHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.picomatch@2.3.1: 2 known vulnerabilitiesGHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.qs@6.9.3: 5 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-hrpp-h998-j3pp, GHSA-w7fw-mjwx-w883
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.redoc@2.0.0-rc.77: 1 known vulnerabilityGHSA-9rhg-254w-fh9x
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.semver@6.3.0: 1 known vulnerabilityGHSA-c2qf-rxjj-qqgw
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.semver@7.3.7: 1 known vulnerabilityGHSA-c2qf-rxjj-qqgw
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.serialize-javascript@6.0.0: 4 known vulnerabilitiesGHSA-5c6j-r48x-rmvq, GHSA-76p7-773f-r4q5, GHSA-m5mm-p8h7-m29v, GHSA-qj8w-gfj5-8c6v
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.static-eval@0.2.3: 2 known vulnerabilitiesGHSA-5mjw-6jrh-hvfq, GHSA-x9hc-rw35-f44h
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tmp@0.0.33: 2 known vulnerabilitiesGHSA-52f5-9888-hmc6, GHSA-ph9p-34f9-6g65
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.underscore@1.1.7: 1 known vulnerabilityGHSA-qpx9-hpmf-5gmw
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.underscore@1.12.1: 1 known vulnerabilityGHSA-qpx9-hpmf-5gmw
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@3.4.0: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@7.0.3: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.validator@10.11.0: 3 known vulnerabilitiesGHSA-9965-vmph-33xx, GHSA-qgmg-gppg-76g5, GHSA-vghf-hv5q-vc2g
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.validator@13.7.0: 2 known vulnerabilitiesGHSA-9965-vmph-33xx, GHSA-vghf-hv5q-vc2g
apps/api-docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.basic-ftp@5.3.1: 2 known vulnerabilitiesGHSA-c475-qrg2-pj4r, GHSA-c475-qrg2-pj4r
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Install or build failed in a clean environmentng 'edgesOut') npm error A complete log of this run can be found in: /tmp/home/.npm/_logs/2026-11-05T20_36_35_090Z-debug-0.log npm error Cannot read properties of null (reading 'edgesOut') npm error A complete log of this run can be found in: /tmp/home/.npm/_logs/2026-11-05T20_36_39_679Z-debug-0.log
- lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: digitalocean-pat
apps/api-docs/docs/spec/auto-generated/models/credential-digital-ocean.yaml:7 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: private-key
apps/api-docs/docs/spec/auto-generated/models/credential-google-cloud.yaml:7 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: private-key2 matches in this file
apps/api-docs/docs/spec/auto-generated/models/ssl-certificate-environment-create.yaml:16 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: jwt
packages/sdks/javascript/tests/DevopnessApiClient.spec.ts:61 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: digitalocean-pat
docs/openapi.json:18067 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: private-key3 matches in this file
docs/openapi.json:18080 - lowLow. Minor, or common in normal tools. Shown for information.@babel/core@7.24.3: 1 known vulnerabilityGHSA-4x5r-pxfx-6jf8
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@babel/runtime@7.16.7: 1 known vulnerabilityGHSA-968p-4wvh-cqc8
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@5.5.2: 2 known vulnerabilitiesGHSA-2g4f-4pwh-qvx6, GHSA-v88g-cgmw-v5xw
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@6.12.3: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@6.12.6: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@8.11.0: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.bn.js@4.12.0: 1 known vulnerabilityGHSA-378v-28hj-76wf
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.bn.js@5.2.0: 1 known vulnerabilityGHSA-378v-28hj-76wf
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.deepmerge@4.3.1: 1 known vulnerabilityGHSA-gcqx-w48m-w2h4
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.got@2.4.0: 1 known vulnerabilityGHSA-pfrx-2q88-qq97
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.got@9.6.0: 1 known vulnerabilityGHSA-pfrx-2q88-qq97
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.mem@1.1.0: 1 known vulnerabilityGHSA-4xcv-9jjx-gfj3
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.micromatch@4.0.5: 1 known vulnerabilityGHSA-952p-6rrq-rcjv
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.prismjs@1.27.0: 1 known vulnerabilityGHSA-x7hr-w5r2-h6wg
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.11.0: 4 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-w7fw-mjwx-w883
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.5.3: 2 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6rw7-vpxm-498p
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.request@2.88.2: 1 known vulnerabilityGHSA-p8p7-x288-28g6
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.tough-cookie@2.5.0: 1 known vulnerabilityGHSA-72xf-g2v4-qvf3
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.xml2js@0.4.23: 1 known vulnerabilityGHSA-776f-qx25-q3cc
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.yaml@1.10.2: 1 known vulnerabilityGHSA-48c2-rrv3-qjmp
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.yargs-parser@7.0.0: 1 known vulnerabilityGHSA-p9pc-299p-vxgp
apps/api-docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.glob@11.1.0: 1 known vulnerabilityGHSA-3g3m-2fjr-6pw4
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.6: 1 known vulnerabilityGHSA-g3hv-75wg-m249
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.glob@13.0.6: 1 known vulnerabilityGHSA-3g3m-2fjr-6pw4
packages/sdks/javascript/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ip-address@10.7.2: 1 known vulnerabilityGHSA-rxp7-6hxx-x8q5
packages/sdks/javascript/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.4: 1 known vulnerabilityGHSA-g3hv-75wg-m249
packages/sdks/javascript/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.idna@3.10: 1 known vulnerabilityPYSEC-2026-215
packages/sdks/python/poetry.lock - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Network activity
During install
registry.npmjs.org
While running
Not run — the code wasn't started in this scan
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Devopness alternatives
View more →Similar mcp servers in Deployment & DevOps, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Devopness (this page) devopness | 573 | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |
| OpenMetadata open-metadata | 16k | Apache-2.0 | Nov 1, 2026 | Scanned, see report |
| Drawio Skill Agents365-ai | 10k | MIT | Nov 1, 2026 | Scanned, no flagged issues |
| Openstatus openstatusHQ | 9.2k | AGPL-3.0 | Nov 1, 2026 | Scanned, no flagged issues |
| Ghidra MCP bethington | 6k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |
| Kubefwd txn2 | 4.2k | Apache-2.0 | Oct 27, 2026 | Scanned, no flagged issues |