← Back to search

@devicesdk/mcp

GitHub Actions Scanned 19d ago

Model Context Protocol server for DeviceSDK — gives AI agents tools to deploy, flash, inspect, and query DeviceSDK projects.

npm ↗
D
40 / 100

Versions

0.2.2latest
first seen Jun 6, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 15

devicesdk_whoami
annotations: verified low

Show the currently-authenticated DeviceSDK user: id, email, name, plan limits, and usage.

readOnlyHint true
devicesdk_list_projects
annotations: verified low

List every project owned by the authenticated user, paginated. Each item's

readOnlyHint true
devicesdk_list_devices
annotations: verified low

List devices in a project, paginated. Each item's device_id field is the

readOnlyHint true
devicesdk_device_status
annotations: verified low

Get a device's live WebSocket connection status: connected, connected_since,

readOnlyHint true
devicesdk_device_logs
annotations: verified low

Fetch a page of persisted device logs, newest first. Optionally filter by

level enum cursor string
readOnlyHint true
devicesdk_device_metrics
annotations: verified low

Get time-bucketed usage metrics (messages, bytes, commands) for a single device.

readOnlyHint true
devicesdk_project_metrics
annotations: verified low

Get aggregated usage metrics for every device in a project, plus project totals.

readOnlyHint true
devicesdk_env_list
annotations: verified low

List environment variable keys set on a project. Values are never returned by

readOnlyHint true destructiveHint true
devicesdk_list_script_versions
annotations: verified low

List every uploaded script version for a device, newest first, flagging which

readOnlyHint true destructiveHint true
devicesdk_docs_search
annotations: verified low

Full-text search over a local, offline copy of the DeviceSDK docs matching

query string
readOnlyHint true destructiveHint true
devicesdk_env_set
annotations: verified low

Set one or more environment variables on a project. Values become visible to

destructiveHint true
devicesdk_env_delete
annotations: verified low

Delete a single environment variable key from a project.

key string
destructiveHint true
devicesdk_send_command
annotations: none low

Send a hardware command to a connected device and wait for its response

devicesdk_upload_script
annotations: none low

Upload a new script version for a device and deploy it immediately. `script`

script string
devicesdk_deploy_version
annotations: none low

Activate a previously-uploaded script version on a device (rollback or

versionId string

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, open(), pathlib
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 113

info
Tool 'devicesdk_whoami' annotations are consistent annotation_checker · 80%
info
Tool 'devicesdk_list_projects' annotations are consistent annotation_checker · 80%
info
Tool 'devicesdk_list_devices' annotations are consistent annotation_checker · 80%
info
Tool 'devicesdk_device_status' annotations are consistent annotation_checker · 80%
info
Tool 'devicesdk_device_logs' annotations are consistent annotation_checker · 80%
info
Tool 'devicesdk_device_metrics' annotations are consistent annotation_checker · 80%
info
Tool 'devicesdk_project_metrics' annotations are consistent annotation_checker · 80%
info
Tool 'devicesdk_env_list' annotations are consistent annotation_checker · 80%
info
Tool 'devicesdk_list_script_versions' annotations are consistent annotation_checker · 80%
info
Tool 'devicesdk_docs_search' annotations are consistent annotation_checker · 80%
info
Tool 'devicesdk_env_set' annotations are consistent annotation_checker · 80%
info
Tool 'devicesdk_env_delete' annotations are consistent annotation_checker · 80%
low
Tool 'devicesdk_send_command' has no annotations annotation_checker · 100%
low
Tool 'devicesdk_upload_script' has no annotations annotation_checker · 100%
low
Tool 'devicesdk_deploy_version' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client ID in device-sdk-devicesdk-1723343/apps/server/tests/e2e/oauth.test.ts auth_checker · 85%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: astro@7.0.0 (GHSA-4g3v-8h47-v7g6) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@7.0.0 (GHSA-7pw4-f3q4-r2p2) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@7.0.0 (GHSA-8mv7-9c27-98vc) dependency_analyzer · 95%
medium
Vulnerable dependency: astro@7.0.0 (GHSA-f48w-9m4c-m7f5) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-54fx-42gc-7vw4) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-79qm-7rj5-m7r9) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-88fw-hqm2-52qc) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-8j4g-w8fx-2239) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-f23p-vx2j-j53r) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-hvrm-45r6-mjfj) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-j6c9-x7qj-28xf) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-rv63-4mwf-qqc2) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-w62v-xxxg-mg59) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-wgpf-jwqj-8h8p) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-wwfh-h76j-fc44) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.23 (GHSA-xgm2-5f3f-mvvc) dependency_analyzer · 95%
medium
Vulnerable dependency: zod@catalog:zod4 (GHSA-m95q-7qp3-xv42) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.0 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.0 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.0 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.0 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.0 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.0 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.0 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.3.0 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@catalog: (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@catalog: (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
Vulnerable dependency: wrangler@catalog: (GHSA-8c93-4hch-xgxp) dependency_analyzer · 95%
medium
Vulnerable dependency: markdown-it@14.1.0 (GHSA-38c4-r59v-3vqw) dependency_analyzer · 95%
medium
Vulnerable dependency: markdown-it@14.1.0 (GHSA-6v5v-wf23-fmfq) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.0 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: echarts@5.6.0 (GHSA-fgmj-fm8m-jvvx) dependency_analyzer · 95%
medium
Vulnerable dependency: quasar@2.16.0 (GHSA-3r53-75j5-3g7j) dependency_analyzer · 95%
medium
Vulnerable dependency: ws@8.18.0 (GHSA-58qx-3vcg-4xpx) dependency_analyzer · 95%
medium
Vulnerable dependency: ws@8.18.0 (GHSA-96hv-2xvq-fx4p) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in device-sdk-devicesdk-1723343/apps/server/src/endpoints/devices/downloadFirmware.ts:19 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in device-sdk-devicesdk-1723343/apps/server/tests/e2e/firmware.test.ts:10 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in device-sdk-devicesdk-1723343/apps/dashboard/tests/e2e/seed.ts:49 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in device-sdk-devicesdk-1723343/firmware/pico/test.js:73 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
Tool: devicesdk_whoami manifest_parser · 85%
info
Tool: devicesdk_list_projects manifest_parser · 85%
info
Tool: devicesdk_list_devices manifest_parser · 85%
info
Tool: devicesdk_device_status manifest_parser · 85%
info
Tool: devicesdk_device_logs manifest_parser · 85%
info
Tool: devicesdk_device_metrics manifest_parser · 85%
info
Tool: devicesdk_project_metrics manifest_parser · 85%
info
Tool: devicesdk_env_list manifest_parser · 85%
info
Tool: devicesdk_list_script_versions manifest_parser · 85%
info
Tool: devicesdk_docs_search manifest_parser · 85%
info
Tool: devicesdk_env_set manifest_parser · 85%
info
Tool: devicesdk_env_delete manifest_parser · 85%
info
Tool: devicesdk_send_command manifest_parser · 85%
info
Tool: devicesdk_upload_script manifest_parser · 85%
info
Tool: devicesdk_deploy_version manifest_parser · 85%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (17) manifest_parser · 80%
medium
Hardcoded OAuth client ID in device-sdk-devicesdk-1723343/apps/server/tests/e2e/oauth.test.ts oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 91 components sbom_generator · 100%
critical
RSA Private Key found in device-sdk-devicesdk-1723343/plans/008-tls-by-default-device-websocket.md secret_scanner · 95%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/apps/docs/src/content/docs/recipes/post-discord-webhook.md secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/apps/docs/src/content/docs/recipes/ds18b20-probe.md secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/apps/docs/src/content/docs/recipes/daily-cron-summary.md secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/apps/docs/src/content/docs/recipes/button-toggles-led.md secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/apps/docs/src/content/docs/recipes/sensor-to-home-assistant.md secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/apps/docs/src/content/docs/recipes/two-devices-rpc.md secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/apps/docs/src/content/docs/recipes/read-bme280.md secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/apps/docs/src/content/docs/recipes/oled-live-data.md secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/apps/docs/src/content/docs/recipes/ws2812-rainbow.md secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/apps/docs/src/content/docs/recipes/persist-counter-kv.md secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/packages/cli/src/commands/init.ts secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/examples/temperature-to-discord/devicesdk.ts secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/examples/esp32c3-clock/devicesdk.ts secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/examples/basic/devicesdk.ts secret_scanner · 65%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/examples/nextion-dashboard/devicesdk.ts secret_scanner · 65%
high
Generic API Key Assignment found in device-sdk-devicesdk-1723343/firmware/pico/CMakeLists.txt secret_scanner · 75%
high
Hardcoded Password found in device-sdk-devicesdk-1723343/firmware/pico/CMakeLists.txt secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%
high
Declared package '@devicesdk/mcp' matches no manifest in the repo identity_guard · 70%