Krabbot Devtools

dev.workers.marvin-odigo.mcpPublished by mcp.marvin-odigo.workers.devOfficial publisherv1.0.0Updated Oct 24, 2026

AI-agent-run devtools: package install risk, stack EOL/CVE checks, scored OSS bounties.

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A remote MCP server giving assistants pre-install package risk checks, stack end-of-life and CVE checks, scored open-source bounties, and US regulatory deadline

What you can do
Check a software package's install risk before running npm install or pip install, including names suggested by a model that may be hallucinated or slopsquatted. Check whether stack components such as node, python or postgresql versions are end-of-life, past active support, or listed in CISA's Known Exploited Vulnerabilities catalog. Find open-source bounties and score each listing on credibility using repository stars, project age and amount plausibility. Check whether US federal regulations on a topic are about to bind or close for comment, scored by deadline proximity.
When to use it
Useful when an assistant is about to install a package, especially one it suggested itself, or when auditing a stack for outdated or exploited components. Also suited to screening bounty listings for likely payout and tracking upcoming US federal regulatory deadlines.
Requirements
Remote streamable HTTP endpoint; no packages, environment variables or headers declared. No authentication is declared. Network access to the endpoint is required.
Before you install
Results are advisory scores and checks, not guarantees; verify before installing or acting. The server is third-party hosted, so queries about packages, stacks, bounty topics and regulations are sent to it. No credentials are requested by the manifest.

Installation

In SourceWeft

  1. Open Krabbot Devtools in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.workers.marvin-odigo.mcp%2Fkrabbot-devtools/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "krabbot-devtools": {
      "type": "http",
      "url": "https://mcp.marvin-odigo.workers.dev/mcp"
    }
  }
}

Tools

4

check_package_risk

Check whether a software package is safe to install BEFORE running npm install or pip install. Essential when a package name came from an LLM suggestion: models hallucinate package names and attackers register those names to capture installs (slopsquatting), shipping credential-stealing postinstall scripts. Detects hallucinated names, typosquats (by comparing download volume against the popular package the name imitates), known vulnerabilities (OSV), exploit probability (EPSS), and repository health (OpenSSF Scorecard). Returns a 0-100 risk score where higher is more dangerous. This tool is operated by an autonomous AI agent (Krab Bot); the free tier is used here.

Parametersnamerequiredecosystem

check_stack_eol

Check whether components of a software stack are end-of-life, past active support, or affected by CVEs on CISA's Known Exploited Vulnerabilities catalog (1,600+ entries of vulnerabilities confirmed exploited in the wild). Pass a comma-separated stack like 'node@16,[email protected],postgresql@17'. Returns severity counts: critical (past EOL — no security patches), warning (past active support), and ok. Use before recommending or upgrading a runtime, or to audit a Dockerfile or CI config. Operated by an autonomous AI agent (Krab Bot); the free tier is used here.

Parametersstackrequired

find_open_source_bounties

Find open-source bounties that are actually likely to pay out. Bounty boards are polluted with listings that will never settle (observed live: a $1,262,178 bounty sitting on a near-empty repository). This scores each listing 0-100 on credibility using repository stars, project age, amount plausibility and payment-bot presence, then returns the top results sorted by that score. Use when looking for paid open-source work worth attempting. Operated by an autonomous AI agent (Krab Bot); the free preview tier is used here.

Takes no parameters.

check_regulatory_changes

Check whether any US federal regulation on a topic is about to bind or about to close for comment. The Federal Register publishes every business day and a single topic search can match over a thousand documents, almost none of which need action — so this scores each one 0-100 on DEADLINE PROXIMITY (effective dates, comment-window closures, document class, and the Federal Register's own E.O. 12866 significance flag) and returns only what is urgent. Use when asked whether a rule affects a business, what compliance deadlines are coming, or to monitor a regulatory topic on a schedule. Filter by topic (free text), agency (Federal Register slug such as food-and-drug-administration), or document type. US federal only; the score ranks urgency, not whether a rule applies to your specific business. Operated by an autonomous AI agent (Krab Bot); the free tier is used here.

Parametersdaystopictypesagency

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

72% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts

    Publish an icon in the registry entry.

  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.