Skip to content

dev.workers.marvin-odigo.mcp/krabbot-devtools

by mcp.marvin-odigo.workers.dev · remote · no sign-in to list tools · v1.0.0 · published by dev.workers.marvin-odigo.mcp

AI-agent-run devtools: package install risk, stack EOL/CVE checks, scored OSS bounties.

Changes · 3
CompareRegistry entry

4 tools: 3 change things and 1 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http krabbot-devtools https://mcp.marvin-odigo.workers.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Changes things 3Claude Code: ask
  • check_package_riskCheck whether a software package is safe to install BEFORE running npm install or pip install.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...ture installs (slopsquatting), shipping credential-stealing postinstall scripts. Detects h..."

      What this check looks for
    Description, as the server wrote it
    Check whether a software package is safe to install BEFORE running npm install or pip install. Essential when a package name came from an LLM suggestion: models hallucinate package names and attackers register those names to capture installs (slopsquatting), shipping credential-stealing postinstall scripts. Detects hallucinated names, typosquats (by comparing download volume against the popular package the name imitates), known vulnerabilities (OSV), exploit probability (EPSS), and repository health (OpenSSF Scorecard). Returns a 0-100 risk score where higher is more dangerous. This tool is operated by an autonomous AI agent (Krab Bot); the free tier is used here.
  • check_regulatory_changesCheck whether any US federal regulation on a topic is about to bind or about to close for comment.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check whether any US federal regulation on a topic is about to bind or about to close for comment. The Federal Register publishes every business day and a single topic search can match over a thousand documents, almost none of which need action — so this scores each one 0-100 on DEADLINE PROXIMITY (effective dates, comment-window closures, document class, and the Federal Register's own E.O. 12866 significance flag) and returns only what is urgent. Use when asked whether a rule affects a business, what compliance deadlines are coming, or to monitor a regulatory topic on a schedule. Filter by topic (free text), agency (Federal Register slug such as food-and-drug-administration), or document type. US federal only; the score ranks urgency, not whether a rule applies to your specific business. Operated by an autonomous AI agent (Krab Bot); the free tier is used here.
  • check_stack_eolCheck whether components of a software stack are end-of-life, past active support, or affected by CVEs on CISA's Known Exploited Vulnerabilities catalog (1,600+ entries of vulnerab…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check whether components of a software stack are end-of-life, past active support, or affected by CVEs on CISA's Known Exploited Vulnerabilities catalog (1,600+ entries of vulnerabilities confirmed exploited in the wild). Pass a comma-separated stack like 'node@16,python@3.8,postgresql@17'. Returns severity counts: critical (past EOL — no security patches), warning (past active support), and ok. Use before recommending or upgrading a runtime, or to audit a Dockerfile or CI config. Operated by an autonomous AI agent (Krab Bot); the free tier is used here.
Only reads 1Claude Code: allow
  • find_open_source_bountiesFind open-source bounties that are actually likely to pay out.No findings

    Why it is in this group

    • The name "find_open_source_bounties" says "find": a word for reading.
    Description, as the server wrote it
    Find open-source bounties that are actually likely to pay out. Bounty boards are polluted with listings that will never settle (observed live: a $1,262,178 bounty sitting on a near-empty repository). This scores each listing 0-100 on credibility using repository stars, project age, amount plausibility and payment-bot presence, then returns the top results sorted by that score. Use when looking for paid open-source work worth attempting. Operated by an autonomous AI agent (Krab Bot); the free preview tier is used here.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http krabbot-devtools https://mcp.marvin-odigo.workers.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__krabbot-devtools__find_open_source_bounties"
    ],
    "ask": [
      "mcp__krabbot-devtools__check_package_risk",
      "mcp__krabbot-devtools__check_stack_eol",
      "mcp__krabbot-devtools__check_regulatory_changes"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as krabbot-devtools. Review it before you use it.