Atlas / MCP servers / timmikeladze / devbar.sh

devbar.shBLOCK

mcp/timmikeladze/devbar

Drop-in toolbar for any website — annotate the UI and capture selectors, computed styles, React component trees, and screenshots as an agent-ready prompt.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
18 17r · 1w · 0d
Transport
streamable-http
License
MIT
Stars
30
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Drop-in toolbar for any website. Annotate the UI and capture selectors, computed styles, React component trees, and screenshots as an agent-ready prompt.

[](https://www.npmjs.com/package/devbar.sh) [](./LICENSE)

It follows the host page's theme, so it does not look pasted onto a light app:

Installation

bun add devbar.sh

Usage

Mount `` once, anywhere in your tree. It renders a fixed toolbar and owns its own overlays.

import { Devbar } from "devbar.sh";

function App() {
return (
<>



);
}

The stylesheet ships as a separate file — import it once alongside the component:

import "devbar.sh/styles.css";

The CDN build (devbar.sh/cdn) inlines its own styles, so it needs no separate import.

Server-rendered apps

The toolbar is safe to import from a server-rendered tree — a Next.js root layout, a Remix root, an Astro island. It renders nothing on the server and nothing on the first client render, then appears once mounted, because what it draws depends on the host page's theme, a stored bar position and stored settings; producing markup without them would only fail to hydrate.

In Next.js, mount it in the root layout from a 'use client' module:

"use client";

import { Devbar } from "devbar.sh";

import "devbar.sh/styles.css";

export function DevToolbar() {
if (process.env.NODE_ENV !== "development") return null;

return ;
}

That still ships the toolbar's stylesheet to production, where the guard means it is never used. To keep it out, put the two imports in a module of their own and pull that module i

Read from source at commit 715696cf4a33OBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add devbar-test-ui --env BETTER_AUTH_GITHUB_CLIENT_ID=${BETTER_AUTH_GITHUB_CLIENT_ID} --env BETTER_AUTH_GITHUB_CLIENT_SECRET=${BETTER_AUTH_GITHUB_CLIENT_SECRET} --env BETTER_AUTH_GOOGLE_CLIENT_ID=${BETTER_AUTH_GOOGLE_CLIENT_ID} --env BETTER_AUTH_GOOGLE_CLIENT_SECRET=${BETTER_AUTH_GOOGLE_CLIENT_SECRET} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "devbar-test-ui": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "BETTER_AUTH_GITHUB_CLIENT_ID": "${BETTER_AUTH_GITHUB_CLIENT_ID}",
        "BETTER_AUTH_GITHUB_CLIENT_SECRET": "${BETTER_AUTH_GITHUB_CLIENT_SECRET}",
        "BETTER_AUTH_GOOGLE_CLIENT_ID": "${BETTER_AUTH_GOOGLE_CLIENT_ID}",
        "BETTER_AUTH_GOOGLE_CLIENT_SECRET": "${BETTER_AUTH_GOOGLE_CLIENT_SECRET}"
      }
    }
  }
}
03

Exposed tools (18)

17 read · 1 write · 0 destructive.

ToolRiskDescription
boomreadthrows
claim_reportreadMark a report as yours before working it. Claiming stops the dispatcher from spawning a
dispatch_reportreadHand a report to the configured agent CLI as a background task instead of working it yourself.
echoreadEchoes its arguments
get_annotationsread
get_console_errorsread
get_element_dataread
get_promptread
get_reportread
highlight_elementreadFlash an outline around an element in the user
inspect_elementreadRead a live element: selector, React component path with source file and line, accessibility
list_pagesreadPages currently running the devbar toolbar. These are live browser tabs you can inspect,
list_reportsread
list_tasksreadDispatcher tasks and their status, including runs started by other sessions.
resolve_reportreadClose a report once the work is done, recording what changed.
screenshot_pagereadCapture the live page, or one element of it. Use this after a change to check the result
search_reportsread
wait_for_reloadwriteBlock until the page reloads (after an HMR update or a navigation), then report the new page.
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryFAIL
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (5 observation(s))
Shell
declared (1 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (22)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104
src/output/payload.ts
payload.ts
Why it matters. member named after an attack tool
Fix. remove or justify
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
src/server/auth.ts:20
console.log(`[auth] Password reset requested for ${user.email}: ${url}`);
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
src/server/local-cli.ts:514
console.log(`token: ${token}`);
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
src/workspace/server/git.ts:107
return createHash("sha1").update(`blob ${bytes.length}\0`).update(bytes).digest("hex");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/workspace/server/collab.ts:1
import type { WorkspaceConfig } from "../../config";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/workspace/server/errors.ts:1
import type { WorkspaceConfig } from "../../config";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/workspace/server/github-backend.ts:2
import type { WorkspaceConfig } from "../../config";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/workspace/server/index.ts:8
import type { WorkspaceConfig } from "../../config";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/workspace/server/index.ts:236
export type { WorkspaceConfig } from "../../config";
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:311
shell is also at `http://127.0.0.1:3100/`. Pages save to disk as you edit
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/AGENT-DISPATCH-PLAN.md:535
- `host_permissions` for `http://127.0.0.1/*` and `http://localhost/*`. (G15)
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/AGENT-DISPATCH-PLAN.md:559
project's `origins`, or `http://localhost:*` / `http://127.0.0.1:*`. Everything
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/LOCAL-AGENT.md:96
requests. The server serves it at `http://127.0.0.1:3100/`; see
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/LOCAL-AGENT.md:266
`http://localhost:*`, `http://127.0.0.1:*`, and any origin a project claims
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
src/server/hmac.ts:10
return atob(padded.replace(/-/g, "+").replace(/_/g, "/"));
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
src/workspace/server/github-backend.ts:95
const binary = atob(data.replace(/\s/g, ""));
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
app/package.json
@base-ui/react, @fontsource-variable/geist, better-auth, class-variance-authority, clsx, lucide-react, react, react-dom
Why it matters. 23 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
examples/nextjs/package.json
next, react, react-dom, @types/node, @types/react, typescript
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
html-to-image, jiti, @drizzle-team/brocli, @libsql/client, @modelcontextprotocol/sdk, @playwright/test, @types/bun, @types/react
Why it matters. 22 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
test/ui/package.json
react, react-dom, @types/bun, @types/react, @types/react-dom
Why it matters. 5 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
app/index.html:217
session, a webhook, or a report you attach to a ticket.
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/superpowers/prompts/2026-09-25-github-native-workspace.md:256
webhook route (`POST <mount>/webhook`, HMAC-verified with the webhook secret)
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 715696cf4a33full audit observations/trust-audit/mcp-server/timmikeladze__devbar.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11715696cf4a33BLOCKD69first audit
06

Questions

What is the devbar.sh MCP server?

Drop-in toolbar for any website — annotate the UI and capture selectors, computed styles, React component trees, and screenshots as an agent-ready prompt.

What tools does devbar.sh expose?

18 in total: 17 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is devbar.sh safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does devbar.sh need?

It reads BETTER_AUTH_GITHUB_CLIENT_ID, BETTER_AUTH_GITHUB_CLIENT_SECRET, BETTER_AUTH_GOOGLE_CLIENT_ID, BETTER_AUTH_GOOGLE_CLIENT_SECRET, BETTER_AUTH_SECRET, BETTER_AUTH_URL, DEVBAR_HMAC_SECRET, DEVBAR_TOKEN, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET and TURSO_AUTH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does devbar.sh run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as devbar-test-ui at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (715696cf4a33), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement