DevtoSAFE
MCP Server of DevTo
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This repository contains a Model Context Protocol server implementation for Dev.to that allows AI assistants to access and interact with Dev.to content.
What is MCP?
The Model Context Protocol (MCP) is a standard for enabling AI assistants to interface with external services, tools, and data sources. This server implements the MCP specification to provide access to Dev.to content. To know more about MCP, Check this video
Features
- Fetch latest and trending articles from Dev.to
- Search for articles by various criteria
- Get detailed information about specific articles
- Get Detailed information about a User.
- Access articles by tag or username
- Create and publish new articles to Dev.to
- Update existing articles
- Caching mechanism to improve performance and reduce API calls
Installation
- Clone this repository
git clone https://github.com/Arindam200/devto-mcp.git cd devto-mcp
- Connect to the MCP server
Copy the below json with the appropriate {{PATH}} values:
{
"mcpServers": {
"devto": {
"command": "{{PATH_TO_UV}}", // Run `which uv` and place the output here
"args": [
"--directory",
"{{PATH_TO_SRC}}",// cd into the repo, run `pwd` and enter the output here
"run",
"server.py"
],
"env": {
"DEV_TO_API_KEY":"Your Dev.to API Key" // Get it from https://dev.to/settings/extensions.
}
}
}
}You can obtain a Dev.to API key from your Dev.to settings page.
For Claude, save this as claude_desktop_config.json in your Claude Desktop config
a074db7e2d5aOBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add devto-mcp-server --env DEV_TO_API_KEY=${DEV_TO_API_KEY} -- uvx devto-mcp-server{
"mcpServers": {
"devto-mcp-server": {
"command": "uvx",
"args": [
"devto-mcp-server"
],
"env": {
"DEV_TO_API_KEY": "${DEV_TO_API_KEY}"
}
}
}
}Exposed tools (10)
8 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
create_article | write | |
get_article_by_id | read | Get a specific article by ID from Dev.to |
get_article_details | read | |
get_articles_by_tag | read | Get articles by tag from Dev.to |
get_articles_by_username | read | |
get_latest_articles | read | Get the latest articles from Dev.to |
get_top_articles | read | Get the top articles from Dev.to |
get_user_info | read | |
search_articles | read | |
update_article | write |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (0)
No findings outside the package's declared scope.
Gates applied: no_behavioural_pass.
a074db7e2d5afull audit observations/trust-audit/mcp-server/arindam200__devto.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | a074db7e2d5a | SAFE | B | 89 | first audit |
Questions
What is the Devto MCP server?
MCP Server of DevTo
What tools does Devto expose?
10 in total: 8 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Devto safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Devto need?
It reads DEV_TO_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (a074db7e2d5a), read on 2026-10-07. The repository is watched and re-audited when it changes.