Skip to main content
Glama

Devici MCP Server

A Model Context Protocol (MCP) server for interacting with the Devici API. This server provides LLM tools to manage users, collections, threat models, components, threats, mitigations, teams, and dashboard data through the Devici platform.

License: MIT Python 3.10+ uv

Features

The Devici MCP Server provides tools for:

User Management

  • Get users with pagination

  • Get specific user by ID

  • Search users by field and text

  • Invite new users

Collections Management

  • Get collections with pagination

  • Get specific collection by ID

  • Create new collections

Threat Models Management

  • Get all threat models with pagination

  • Get threat models by collection

  • Get specific threat model by ID

  • Create new threat models

Components Management

  • Get components with pagination

  • Get specific component by ID

  • Get components by canvas

  • Create new components

Threats Management

  • Get threats with pagination

  • Get specific threat by ID

  • Get threats by component

  • Create new threats

Mitigations Management

  • Get mitigations with pagination

  • Get specific mitigation by ID

  • Get mitigations by threat

  • Create new mitigations

Teams Management

  • Get teams with pagination

  • Get specific team by ID

  • Get team users

  • Create new teams

Dashboard & Reports

  • Get dashboard data

  • Get report data

  • Get threat model statistics

Comments & Audit

  • Get comments with pagination

  • Get specific comment by ID

  • Get audit logs

Codex Integration

  • Get codex attributes

  • Get codex mitigations

  • Get codex threats

Related MCP server: TODO MCP Server

Quick Start

Option 1: From GitHub (Current)

uvx git+https://github.com/geoffwhittington/devici-mcp.git

Option 2: From PyPI (Future - when published)

uvx devici-mcp-server

Using uv

Install from GitHub

uv pip install git+https://github.com/geoffwhittington/devici-mcp.git
devici-mcp-server

Install from PyPI (when available)

uv pip install devici-mcp-server
devici-mcp-server

Using pip

Install from GitHub

pip install git+https://github.com/geoffwhittington/devici-mcp.git
devici-mcp-server

Install from PyPI (when available)

pip install devici-mcp-server
devici-mcp-server

Configuration

The server requires three environment variables:

  • DEVICI_API_BASE_URL: Your Devici instance URL (e.g., https://api.devici.com/v1)

  • DEVICI_CLIENT_ID: Your Devici client ID

  • DEVICI_CLIENT_SECRET: Your Devici client secret

Setting Environment Variables

Option 1: Environment Variables

export DEVICI_API_BASE_URL="https://api.devici.com/v1"
export DEVICI_CLIENT_ID="your-client-id-here"
export DEVICI_CLIENT_SECRET="your-client-secret-here"

Option 2: .env File

Create a .env file in your working directory:

DEVICI_API_BASE_URL=https://api.devici.com/v1
DEVICI_CLIENT_ID=your-client-id-here
DEVICI_CLIENT_SECRET=your-client-secret-here

Getting Your API Credentials

  1. Log into your Devici instance

  2. Go to Settings > API Access

  3. Generate a new client ID and secret

  4. Copy the values for use as DEVICI_CLIENT_ID and DEVICI_CLIENT_SECRET

MCP Client Configuration

Claude Desktop

Add this to your Claude Desktop configuration file:

Option 1: From GitHub (Current)

{
  "mcpServers": {
    "devici": {
      "command": "uvx",
      "args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
      "env": {
        "DEVICI_API_BASE_URL": "https://api.devici.com/v1",
        "DEVICI_CLIENT_ID": "your-client-id-here",
        "DEVICI_CLIENT_SECRET": "your-client-secret-here"
      }
    }
  }
}

Option 2: From PyPI (Future)

{
  "mcpServers": {
    "devici": {
      "command": "uvx",
      "args": ["devici-mcp-server"],
      "env": {
        "DEVICI_API_BASE_URL": "https://api.devici.com/v1",
        "DEVICI_CLIENT_ID": "your-client-id-here",
        "DEVICI_CLIENT_SECRET": "your-client-secret-here"
      }
    }
  }
}

Cline

Add this to your Cline MCP settings:

From GitHub (Current)

{
  "mcpServers": {
    "devici": {
      "command": "uvx",
      "args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
      "env": {
        "DEVICI_API_BASE_URL": "https://api.devici.com/v1",
        "DEVICI_CLIENT_ID": "your-client-id-here",
        "DEVICI_CLIENT_SECRET": "your-client-secret-here"
      }
    }
  }
}

Continue

Add this to your Continue configuration:

From GitHub (Current)

{
  "mcpServers": {
    "devici": {
      "command": "uvx",
      "args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
      "env": {
        "DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
        "DEVICI_CLIENT_ID": "your-client-id-here",
        "DEVICI_CLIENT_SECRET": "your-client-secret-here"
      }
    }
  }
}

Cursor

Add this to your Cursor configuration file:

Option 1: From GitHub (Current)

{
  "mcpServers": {
    "devici": {
      "command": "uvx",
      "args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
      "env": {
        "DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
        "DEVICI_CLIENT_ID": "your-client-id-here",
        "DEVICI_CLIENT_SECRET": "your-client-secret-here"
      }
    }
  }
}

Option 2: Using local installation

If you have the package installed locally:

{
  "mcpServers": {
    "devici": {
      "command": "devici-mcp-server",
      "env": {
        "DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
        "DEVICI_CLIENT_ID": "your-client-id-here",
        "DEVICI_CLIENT_SECRET": "your-client-secret-here"
      }
    }
  }
}

Option 3: Using Python module directly

{
  "mcpServers": {
    "devici": {
      "command": "python",
      "args": ["-m", "devici_mcp_server"],
      "env": {
        "DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
        "DEVICI_CLIENT_ID": "your-client-id-here",
        "DEVICI_CLIENT_SECRET": "your-client-secret-here"
      }
    }
  }
}

Development

Prerequisites

  • uv installed

  • Python 3.10 or higher

Setup

# Clone the repository
git clone <repository-url>
cd devici-mcp

# Create virtual environment and install dependencies
uv sync

# Run in development mode
uv run python -m devici_mcp_server

Testing

# Run the import test
uv run python test_basic.py

# Test with environment variables
DEVICI_API_BASE_URL=https://api.devici.com/api/v1 DEVICI_CLIENT_ID=test DEVICI_CLIENT_SECRET=test uv run python -m devici_mcp_server

Building

# Build the package
uv build

# Install locally for testing
uv pip install dist/*.whl

Features

  • Full API Coverage: Supports all major Devici API endpoints

  • Authentication: Secure client ID/secret-based authentication

  • Error Handling: Comprehensive error handling and validation

  • Environment Configuration: Flexible configuration via environment variables

  • Modern Python: Built with modern Python packaging (uv, pyproject.toml)

  • MCP Compliant: Fully compatible with the Model Context Protocol

API Coverage

This server provides access to:

  • Users and Teams

  • Collections and Threat Models

  • Components and Threats

  • Mitigations and Comments

  • Dashboard Data and Reports

  • Audit Logs and Codex Integration

  • Search and Bulk Operations

License

This project is licensed under the MIT License - see the LICENSE file for details.

Contributing

  1. Fork the repository

  2. Create a feature branch (git checkout -b feature/amazing-feature)

  3. Commit your changes (git commit -m 'Add some amazing feature')

  4. Push to the branch (git push origin feature/amazing-feature)

  5. Open a Pull Request

Support

For issues and questions:

  • Check the Issues page

  • Review the Devici API documentation

  • Ensure your API credentials have proper permissions


Note: This is an unofficial MCP server for Devici. For official Devici support, please contact the Devici team.

Available Tools

25 tools
create_collectionD

Create a new collection

Inputs: name (required), other_properties (required), description. Returns: result

create_threat_modelC

Create a new threat model

Inputs: name (required), collection_id (required), other_properties (required), description. Returns: result

get_collectionB

Get a specific collection by ID

Inputs: collection_id (required). Returns: result

get_collectionsB

Get collections from Devici with pagination

Inputs: limit, page. Returns: result

get_componentB

Get a specific component by ID

Inputs: component_id (required). Returns: result

get_componentsC

Get components from Devici with pagination

Inputs: limit, page. Returns: result

get_components_by_canvasC

Get components for a specific canvas

Inputs: canvas_id (required). Returns: result

get_dashboard_dataC

Get dashboard data for a specific chart type

Inputs: chart_type (required), limit, page, start, +2 more. Returns: result

get_dashboard_typesB

Get available dashboard chart types

Inputs: no named parameters. Returns: result

get_mitigationC

Get a specific mitigation by ID

Inputs: mitigation_id (required). Returns: result

get_mitigationsC

Get mitigations from Devici with pagination

Inputs: limit, page. Returns: result

get_mitigations_by_threatB

Get mitigations for a specific threat

Inputs: threat_id (required). Returns: result

get_teamB

Get a specific team by ID

Inputs: team_id (required). Returns: result

get_teamsC

Get teams from Devici with pagination

Inputs: limit, page. Returns: result

get_threatB

Get a specific threat by ID

Inputs: threat_id (required). Returns: result

get_threat_modelB

Get a specific threat model by ID

Inputs: threat_model_id (required). Returns: result

get_threat_modelsB

Get threat models from Devici with pagination

Inputs: limit, page. Returns: result

get_threat_models_by_collectionC

Get threat models for a specific collection

Inputs: collection_id (required), limit, page. Returns: result

get_threat_models_reportD

Get threat models report data

Inputs: start, end. Returns: result

get_threatsC

Get threats from Devici with pagination

Inputs: limit, page. Returns: result

get_threats_by_componentC

Get threats for a specific component

Inputs: component_id (required). Returns: result

get_userB

Get a specific user by ID

Inputs: user_id (required). Returns: result

get_usersB

Get users from Devici with pagination

Inputs: limit, page. Returns: result

invite_userB

Invite a new user to Devici

Inputs: email (required), first_name (required), last_name (required), role (required). Returns: result

search_usersC

Search users by field and text

Inputs: field (required), text (required). Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    C2.9/5.0

    Scored across 25 tools

    Disambiguation5/5

    Every tool has a clearly distinct purpose with no ambiguity. Tools are organized around specific resources (collections, threat models, components, mitigations, teams, threats, users) and actions (create, get, invite, search), with clear boundaries between them. For example, get_threat and get_threat_model target different entities, and paginated list tools are distinguished from single-item retrieval tools.

    Naming Consistency5/5

    Tool names follow a highly consistent verb_noun pattern throughout. All tools use snake_case with clear verbs like 'create', 'get', 'invite', or 'search' followed by a noun or noun phrase (e.g., 'create_collection', 'get_components_by_canvas'). There are no deviations in naming conventions, making the set predictable and readable.

    Tool Count2/5

    With 25 tools, the count feels heavy and borderline excessive for the apparent scope of a threat modeling and security management server. While the tools cover many resources, the high number suggests potential over-fragmentation, such as having separate tools for paginated lists and single-item retrieval for each resource, which could overwhelm agents or lead to unnecessary complexity in tool selection.

    Completeness4/5

    The tool surface is largely complete for the domain of threat modeling and security management, covering CRUD operations for key resources like collections, threat models, components, mitigations, teams, threats, and users. Minor gaps exist, such as missing update or delete operations for most resources (only create and get are present), but agents can likely work around this with existing tools for core workflows.

    Related MCP Connectors

    Related MCP Servers

    • A
      license
      Not graded
      quality
      D
      maintenance
      Provides broad, typed access to the ftrack Studio production-tracking API for LLM agents via 28 tools, including generic CRUD and convenience operations for projects, tasks, notes, and more.
      MIT
    • F
      license
      Not graded
      quality
      D
      maintenance
      Enables LLM clients to interact with ThreatConnect v3 for case management and threat intelligence, providing typed tools for creating/updating cases, indicators, and artifacts while handling HMAC authentication and API quirks.
      -
    • A
      license
      A
      quality
      D
      maintenance
      Exposes the Tenable Identity Exposure (TIE) REST API as tools for LLM clients, enabling queries on security profiles, activity timelines, AD objects, and more.
      15
      5
      MIT