mcp-registry/dev.workers.marvin-odigo.mcp/krabbot-devtools · v1.0.0
As of 2026-10-17 11:14 UTC, the Workers Marvin Odigo Krabbot Devtools MCP server is up with a Glimind reliability score of 96/100 (grade A). Over the last 30 days it answered 100% of Glimind's liveness checks.
AI-agent-run devtools: package install risk, stack EOL/CVE checks, scored OSS bounties.
Claude Code
claude mcp add --transport http workers-marvin-odigo-krabbot-devtools-mc https://mcp.marvin-odigo.workers.dev/mcp
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"workers-marvin-odigo-krabbot-devtools-mc": {
"type": "http",
"url": "https://mcp.marvin-odigo.workers.dev/mcp"
}
}
}
Third-party server, listed as discovered. Review its source before installing.
4 of 4 tool(s) carry no readOnlyHint/destructiveHint annotations.
Annotate read-only tools with {"readOnlyHint": true}. Agents and gateways can then run them without a confirmation prompt, and route around destructive ones.
No tool declares an outputSchema.
Declare outputSchema and return structuredContent (MCP 2025-06-18+). Agents can then parse results without guessing, and chain tools reliably.
Paste-ready definitions with the problems above fixed. Changes marked verify need a human look. All of them as JSON: /v1/readiness/mcp-registry%2Fdev.workers.marvin-odigo.mcp%2Fkrabbot-devtools/fixes
{
"name": "check_package_risk",
"description": "Check whether a software package is safe to install BEFORE running npm install or pip install. Essential when a package name came from an LLM suggestion: models hallucinate package names and attackers register those names to capture installs (slopsquatting), shipping credential-stealing postinstall scripts. Detects hallucinated names, typosquats (by comparing download volume against the popular package the name imitates), known vulnerabilities (OSV), exploit probability (EPSS), and repository he",
"inputSchema": {
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Package name, e.g. 'express' or 'requests'"
},
"ecosystem": {
"enum": [
"npm",
"pypi"
],
"type": "string",
"description": "Registry to check (default npm)"
}
}
},
"annotations": {
"readOnlyHint": true
}
}{
"name": "check_regulatory_changes",
"description": "Check whether any US federal regulation on a topic is about to bind or about to close for comment. The Federal Register publishes every business day and a single topic search can match over a thousand documents, almost none of which need action — so this scores each one 0-100 on DEADLINE PROXIMITY (effective dates, comment-window closures, document class, and the Federal Register's own E.O. 12866 significance flag) and returns only what is urgent. Use when asked whether a rule affects a business",
"inputSchema": {
"type": "object",
"properties": {
"days": {
"type": "integer",
"description": "Lookback window in days (default 30)"
},
"topic": {
"type": "string",
"description": "Free-text term searched across full document text, e.g. 'artificial intelligence'"
},
"types": {
"type": "string",
"description": "Comma-separated document types: rule,proposed,notice,presidential"
},
"agency": {
"type": "string",
"description": "Federal Register agency slug, e.g. environmental-protection-agency"
}
},
"additionalProperties": false
},
"annotations": {
"readOnlyHint": true
}
}{
"name": "check_stack_eol",
"description": "Check whether components of a software stack are end-of-life, past active support, or affected by CVEs on CISA's Known Exploited Vulnerabilities catalog (1,600+ entries of vulnerabilities confirmed exploited in the wild). Pass a comma-separated stack like 'node@16,[email protected],postgresql@17'. Returns severity counts: critical (past EOL — no security patches), warning (past active support), and ok. Use before recommending or upgrading a runtime, or to audit a Dockerfile or CI config. Operated by an",
"inputSchema": {
"type": "object",
"required": [
"stack"
],
"properties": {
"stack": {
"type": "string",
"description": "Comma-separated components, each optionally product@version (max 25)"
}
}
},
"annotations": {
"readOnlyHint": true
}
}Get an email or webhook when this server's readiness drops by 10+ points, tool-poisoning text appears, or a tool breaks:
curl -X POST https://glimind.com/v1/subscriptions -H 'content-type: application/json' -d '{"tools":["mcp-registry/dev.workers.marvin-odigo.mcp/krabbot-devtools"],"email":"[email protected]"}'Agents: watch_tool({"toolId": "mcp-registry/dev.workers.marvin-odigo.mcp/krabbot-devtools"}) over MCP.
check_regulatory_changes ~292 tokenscheck_package_risk ~222 tokenscheck_stack_eol ~201 tokensfind_open_source_bounties ~175 tokensStatic checks of the advertised tools/list (schema, descriptions, annotations, tool-poisoning patterns, names, size) plus observed protocol, uptime, latency and contract changes. Read-only: no tool is ever called. Weights: schema 15, docs 20, safety 15, efficiency 15, compatibility 15, protocol 5, reliability 10, stability 5. Token counts are estimates (~3.6 characters per token).
Operator? Fix these, then re-check live. Embed the readiness badge:
[](https://glimind.com/server/mcp-registry%2Fdev.workers.marvin-odigo.mcp%2Fkrabbot-devtools?ref=badge)
<a href="https://glimind.com/server/mcp-registry%2Fdev.workers.marvin-odigo.mcp%2Fkrabbot-devtools?ref=badge"><img src="https://glimind.com/v1/readiness/badge/mcp-registry%2Fdev.workers.marvin-odigo.mcp%2Fkrabbot-devtools.svg" alt="MCP agent-readiness"></a>
.. image:: https://glimind.com/v1/readiness/badge/mcp-registry%2Fdev.workers.marvin-odigo.mcp%2Fkrabbot-devtools.svg :target: https://glimind.com/server/mcp-registry%2Fdev.workers.marvin-odigo.mcp%2Fkrabbot-devtools?ref=badge :alt: MCP agent-readiness
Glimind records every version of this server's tool definitions in a signed, append-only transparency log. Current manifest sha256:5a9070d9bbed2d67…, first seen 2026-10-17, included at leaf 6266 of 17,474. Version history · verify what your client received.
Compare: most reliable security servers · most reliable search servers · most reliable other servers
Glimind tells agents whether a server is up right now and how to call it, then fails over to a live alternative when it isn't.
Claude Code
claude mcp add --transport http glimind https://glimind.com/mcp
Claude Desktop · Windsurf · Cline (mcpServers JSON)
{
"mcpServers": {
"glimind": {
"type": "http",
"url": "https://glimind.com/mcp"
}
}
}
As of 2026-10-17 11:14 UTC, the Workers Marvin Odigo Krabbot Devtools MCP server is up with a Glimind reliability score of 96/100 (grade A). Over the last 30 days it answered 100% of Glimind's liveness checks.
Workers Marvin Odigo Krabbot Devtools MCP server advertises 4 tools, including check_package_risk, check_regulatory_changes, check_stack_eol, find_open_source_bounties.
Point your MCP client at this streamable-http endpoint: https://mcp.marvin-odigo.workers.dev/mcp
Glimind scanned all 4 tool definitions for tool-poisoning patterns — hidden or invisible characters, instructions that override the model, concealment from the user, requests to read credential or MCP config files, conversation exfiltration and cross-tool shadowing — and found none. This checks what the server tells the model, not what its code does; review the source before granting access to sensitive data.
Status page: 90-day uptime, every outage and how long it lasted.
Claim this listing to get the Verified operator marker, a remediation checklist and owner analytics, or embed the live badge from any of the tool pages above. Maintainers: alerts, deploy attestation and monthly reports.
Status is an automated estimate from Glimind's liveness checks (handshake and tool listing only; no tool is ever called) and may lag or differ from your network. Glimind is not affiliated with this server or its operator. Operator? Request a correction or opt out at https://glimind.com/opt-out.