Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.devhelmhq/mcp-server -->
Model Context Protocol (MCP) server for DevHelm — gives AI coding assistants (Cursor, Claude Desktop, Windsurf, etc.) access to your uptime monitors, incidents, alerting, and more.
Use the hosted server at mcp.devhelm.io. Two connection modes:
Bearer auth:
URL: https://mcp.devhelm.io/mcp
Authorization: Bearer <your-api-token>API key in URL (for clients that only accept a URL):
URL: https://mcp.devhelm.io/<your-api-token>/mcppip install devhelm-mcp-server
export DEVHELM_API_TOKEN=your-token
devhelm-mcp-serverOr with uvx (no install required):
export DEVHELM_API_TOKEN=your-token
uvx devhelm-mcp-serverAdd to your MCP config:
{
"mcpServers": {
"devhelm": {
"url": "https://mcp.devhelm.io/<your-api-token>/mcp"
}
}
}| Category | Tools |
|---|---|
| Monitors | list, get, create, update (inline code for BROWSER / MULTI_STEP_API), delete (confirmation), restore, trash, pause, resume, mute, unmute, quarantine, release quarantine, drift, versions, history (list_monitor_results is a deprecated alias until 2027-01-31) |
| Code checks | test, probe, test ad hoc, run now, trigger; revisions list, get, files, create draft, test, diff, discard; publish and rollback (confirmation), rollback preview |
| Runs | get (run envelope, wait_s ≤ 25), list, steps, console, network, artifacts (screenshots as images, traces/HARs as signed URLs), trace summary, diff, cancel |
| Account | runtimes list/get, usage, entitlements |
| Incidents | list, get, create, update, acknowledge, add update, resolve, runs, events, related, trigger; prompt investigate_incident |
| Alert Channels | list, get, create, update, delete, test |
| Notification Policies | list, get, create, update, delete, test |
| Environments | list, get, create, update, delete |
| Secrets | list, set value, create, update (values via elicitation or a dashboard link, never in chat), delete |
| Tags | list, get, create, update, delete |
| Resource Groups | list, get, create, update, delete, add member, remove member |
| Webhooks | list, get, create, update, delete, test |
| API Keys | list, create, revoke, delete |
| Dependencies | list, get, track, delete |
| Deploy Lock | acquire, current, release, force-release |
| Status | overview |
| Status Pages | pages, components, groups, incidents, maintenance, subscribers, domains |
| Email Testing | create address, wait (≤25 s), latest, list/get messages, source, OTP codes, links, inject; domains list, get, create, update, verify, activity |
| Webhook Testing | inboxes list, get, create, update, activity; wait (≤25 s), latest, list/get events |
Delete, publish and rollback return {status: "confirmation_required", changes, confirmationToken} first; call again with confirmation_token after the user agrees. Tokens are HMACs signed by the server process (set DEVHELM_MCP_CONFIRMATION_SECRET so every replica shares the key) and last 15 minutes. Errors come back as isError with every ErrorResponse field and a sentence for the agent.
uv sync
make dev # Start with MCP Inspector (stdio)
make serve # Start HTTP server on :8000
make test # Run unit tests
make lint # Check formatting
make typecheck # Run mypyMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.