Devici MCP Server
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Devici MCP Server show me the threat models in the 'Web App' collection"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Devici MCP Server
A Model Context Protocol (MCP) server for interacting with the Devici API. This server provides LLM tools to manage users, collections, threat models, components, threats, mitigations, teams, and dashboard data through the Devici platform.
Features
The Devici MCP Server provides tools for:
User Management
Get users with pagination
Get specific user by ID
Search users by field and text
Invite new users
Collections Management
Get collections with pagination
Get specific collection by ID
Create new collections
Threat Models Management
Get all threat models with pagination
Get threat models by collection
Get specific threat model by ID
Create new threat models
Components Management
Get components with pagination
Get specific component by ID
Get components by canvas
Create new components
Threats Management
Get threats with pagination
Get specific threat by ID
Get threats by component
Create new threats
Mitigations Management
Get mitigations with pagination
Get specific mitigation by ID
Get mitigations by threat
Create new mitigations
Teams Management
Get teams with pagination
Get specific team by ID
Get team users
Create new teams
Dashboard & Reports
Get dashboard data
Get report data
Get threat model statistics
Comments & Audit
Get comments with pagination
Get specific comment by ID
Get audit logs
Codex Integration
Get codex attributes
Get codex mitigations
Get codex threats
Related MCP server: TODO MCP Server
Quick Start
Using uvx (recommended)
Option 1: From GitHub (Current)
uvx git+https://github.com/geoffwhittington/devici-mcp.gitOption 2: From PyPI (Future - when published)
uvx devici-mcp-serverUsing uv
Install from GitHub
uv pip install git+https://github.com/geoffwhittington/devici-mcp.git
devici-mcp-serverInstall from PyPI (when available)
uv pip install devici-mcp-server
devici-mcp-serverUsing pip
Install from GitHub
pip install git+https://github.com/geoffwhittington/devici-mcp.git
devici-mcp-serverInstall from PyPI (when available)
pip install devici-mcp-server
devici-mcp-serverConfiguration
The server requires three environment variables:
DEVICI_API_BASE_URL: Your Devici instance URL (e.g.,https://api.devici.com/v1)DEVICI_CLIENT_ID: Your Devici client IDDEVICI_CLIENT_SECRET: Your Devici client secret
Setting Environment Variables
Option 1: Environment Variables
export DEVICI_API_BASE_URL="https://api.devici.com/v1"
export DEVICI_CLIENT_ID="your-client-id-here"
export DEVICI_CLIENT_SECRET="your-client-secret-here"Option 2: .env File
Create a .env file in your working directory:
DEVICI_API_BASE_URL=https://api.devici.com/v1
DEVICI_CLIENT_ID=your-client-id-here
DEVICI_CLIENT_SECRET=your-client-secret-hereGetting Your API Credentials
Log into your Devici instance
Go to Settings > API Access
Generate a new client ID and secret
Copy the values for use as
DEVICI_CLIENT_IDandDEVICI_CLIENT_SECRET
MCP Client Configuration
Claude Desktop
Add this to your Claude Desktop configuration file:
Option 1: From GitHub (Current)
{
"mcpServers": {
"devici": {
"command": "uvx",
"args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Option 2: From PyPI (Future)
{
"mcpServers": {
"devici": {
"command": "uvx",
"args": ["devici-mcp-server"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Cline
Add this to your Cline MCP settings:
From GitHub (Current)
{
"mcpServers": {
"devici": {
"command": "uvx",
"args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Continue
Add this to your Continue configuration:
From GitHub (Current)
{
"mcpServers": {
"devici": {
"command": "uvx",
"args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Cursor
Add this to your Cursor configuration file:
Option 1: From GitHub (Current)
{
"mcpServers": {
"devici": {
"command": "uvx",
"args": ["git+https://github.com/geoffwhittington/devici-mcp.git"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Option 2: Using local installation
If you have the package installed locally:
{
"mcpServers": {
"devici": {
"command": "devici-mcp-server",
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Option 3: Using Python module directly
{
"mcpServers": {
"devici": {
"command": "python",
"args": ["-m", "devici_mcp_server"],
"env": {
"DEVICI_API_BASE_URL": "https://api.devici.com/api/v1",
"DEVICI_CLIENT_ID": "your-client-id-here",
"DEVICI_CLIENT_SECRET": "your-client-secret-here"
}
}
}
}Development
Prerequisites
uv installed
Python 3.10 or higher
Setup
# Clone the repository
git clone <repository-url>
cd devici-mcp
# Create virtual environment and install dependencies
uv sync
# Run in development mode
uv run python -m devici_mcp_serverTesting
# Run the import test
uv run python test_basic.py
# Test with environment variables
DEVICI_API_BASE_URL=https://api.devici.com/api/v1 DEVICI_CLIENT_ID=test DEVICI_CLIENT_SECRET=test uv run python -m devici_mcp_serverBuilding
# Build the package
uv build
# Install locally for testing
uv pip install dist/*.whlFeatures
Full API Coverage: Supports all major Devici API endpoints
Authentication: Secure client ID/secret-based authentication
Error Handling: Comprehensive error handling and validation
Environment Configuration: Flexible configuration via environment variables
Modern Python: Built with modern Python packaging (uv, pyproject.toml)
MCP Compliant: Fully compatible with the Model Context Protocol
API Coverage
This server provides access to:
Users and Teams
Collections and Threat Models
Components and Threats
Mitigations and Comments
Dashboard Data and Reports
Audit Logs and Codex Integration
Search and Bulk Operations
License
This project is licensed under the MIT License - see the LICENSE file for details.
Contributing
Fork the repository
Create a feature branch (
git checkout -b feature/amazing-feature)Commit your changes (
git commit -m 'Add some amazing feature')Push to the branch (
git push origin feature/amazing-feature)Open a Pull Request
Support
For issues and questions:
Check the Issues page
Review the Devici API documentation
Ensure your API credentials have proper permissions
Note: This is an unofficial MCP server for Devici. For official Devici support, please contact the Devici team.
Available Tools
25 toolscreate_collectionD
Create a new collection
Inputs: name (required), other_properties (required), description. Returns: result
create_threat_modelC
Create a new threat model
Inputs: name (required), collection_id (required), other_properties (required), description. Returns: result
get_collectionB
Get a specific collection by ID
Inputs: collection_id (required). Returns: result
get_collectionsB
Get collections from Devici with pagination
Inputs: limit, page. Returns: result
get_componentB
Get a specific component by ID
Inputs: component_id (required). Returns: result
get_componentsC
Get components from Devici with pagination
Inputs: limit, page. Returns: result
get_components_by_canvasC
Get components for a specific canvas
Inputs: canvas_id (required). Returns: result
get_dashboard_dataC
Get dashboard data for a specific chart type
Inputs: chart_type (required), limit, page, start, +2 more. Returns: result
get_dashboard_typesB
Get available dashboard chart types
Inputs: no named parameters. Returns: result
get_mitigationC
Get a specific mitigation by ID
Inputs: mitigation_id (required). Returns: result
get_mitigationsC
Get mitigations from Devici with pagination
Inputs: limit, page. Returns: result
get_mitigations_by_threatB
Get mitigations for a specific threat
Inputs: threat_id (required). Returns: result
get_teamB
Get a specific team by ID
Inputs: team_id (required). Returns: result
get_teamsC
Get teams from Devici with pagination
Inputs: limit, page. Returns: result
get_threatB
Get a specific threat by ID
Inputs: threat_id (required). Returns: result
get_threat_modelB
Get a specific threat model by ID
Inputs: threat_model_id (required). Returns: result
get_threat_modelsB
Get threat models from Devici with pagination
Inputs: limit, page. Returns: result
get_threat_models_by_collectionC
Get threat models for a specific collection
Inputs: collection_id (required), limit, page. Returns: result
get_threat_models_reportD
Get threat models report data
Inputs: start, end. Returns: result
get_threatsC
Get threats from Devici with pagination
Inputs: limit, page. Returns: result
get_threats_by_componentC
Get threats for a specific component
Inputs: component_id (required). Returns: result
get_userB
Get a specific user by ID
Inputs: user_id (required). Returns: result
get_usersB
Get users from Devici with pagination
Inputs: limit, page. Returns: result
invite_userB
Invite a new user to Devici
Inputs: email (required), first_name (required), last_name (required), role (required). Returns: result
search_usersC
Search users by field and text
Inputs: field (required), text (required). Returns: result
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 25 tools
Every tool has a clearly distinct purpose with no ambiguity. Tools are organized around specific resources (collections, threat models, components, mitigations, teams, threats, users) and actions (create, get, invite, search), with clear boundaries between them. For example, get_threat and get_threat_model target different entities, and paginated list tools are distinguished from single-item retrieval tools.
Tool names follow a highly consistent verb_noun pattern throughout. All tools use snake_case with clear verbs like 'create', 'get', 'invite', or 'search' followed by a noun or noun phrase (e.g., 'create_collection', 'get_components_by_canvas'). There are no deviations in naming conventions, making the set predictable and readable.
With 25 tools, the count feels heavy and borderline excessive for the apparent scope of a threat modeling and security management server. While the tools cover many resources, the high number suggests potential over-fragmentation, such as having separate tools for paginated lists and single-item retrieval for each resource, which could overwhelm agents or lead to unnecessary complexity in tool selection.
The tool surface is largely complete for the domain of threat modeling and security management, covering CRUD operations for key resources like collections, threat models, components, mitigations, teams, threats, and users. Minor gaps exist, such as missing update or delete operations for most resources (only create and get are present), but agents can likely work around this with existing tools for core workflows.
Related MCP Connectors
AI-callable tools for API mocking, testing, monitoring, security, and automation.
Every Canopy public API operation as a tool, run as you after a browser sign-in or on an API key.
Access Pollinations models and API capabilities through agent tools.
Point Gecko at an OpenAPI spec; get first-call-correct, auth-hidden agent tools.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceProvides broad, typed access to the ftrack Studio production-tracking API for LLM agents via 28 tools, including generic CRUD and convenience operations for projects, tasks, notes, and more.MIT
- FlicenseNot gradedqualityDmaintenanceExposes tools to create and list tasks by wrapping a REST API, enabling LLMs to manage a TODO list via natural language.-
- FlicenseNot gradedqualityDmaintenanceEnables LLM clients to interact with ThreatConnect v3 for case management and threat intelligence, providing typed tools for creating/updating cases, indicators, and artifacts while handling HMAC authentication and API quirks.-
- AlicenseAqualityDmaintenanceExposes the Tenable Identity Exposure (TIE) REST API as tools for LLM clients, enabling queries on security profiles, activity timelines, AD objects, and more.155MIT