devin-mcp-bridge

Lets Claude Code delegate work to Devin.

Claude Code  ──MCP/stdio──▶  devin-mcp-bridge  ──ACP/stdio──▶  devin acp

Devin ships an ACP agent (devin acp), which is what makes it usable from Zed. Claude Code speaks MCP, not ACP. This process sits in the middle: it is an ACP client toward Devin (spawning the agent, answering its filesystem and permission requests) and an MCP server toward Claude Code.

Tools

Related MCP server: claude-mcp-bridge

Install

git clone https://github.com/phenasdev/devin-mcp-bridge.git
cd devin-mcp-bridge
npm install
npm run smoke          # boots the server, lists tools — no Devin needed
npm run smoke:call     # full turn against a fake ACP agent
npm run smoke:sandbox  # verifies symlinks cannot escape the session root

Register with Claude Code, using an absolute path to your clone:

# this project only
claude mcp add devin -- node "$PWD/src/devin-mcp.mjs"

# every project
claude mcp add -s user devin -- node "$PWD/src/devin-mcp.mjs"

Verify with /mcp inside Claude Code. Tool names appear as mcp__devin__devin_task.

Security

Devin runs autonomously and, over ACP, asks this process for permission and for filesystem access. Two controls exist, both on by default:

• DEVIN_MCP_PERMISSION=once (default) — grant only one-shot permissions; never allow_always, which would remove the decision for the rest of the session. all approves everything including persistent grants. deny refuses everything.

• DEVIN_MCP_SANDBOX_FS=1 (default) — fs/read_text_file and fs/write_text_file are confined to the session root; paths resolving outside it, including through symlinks, are rejected. Set 0 to disable. This path check is not an OS sandbox and cannot prevent a concurrent filesystem race.

When the bridge refuses a request, the turn result carries a [bridge] ... refused block naming the operation and path. Without it a sandbox rejection reaches Claude Code as a bare [tool failed], indistinguishable from a genuine Devin error.

There is no human in the loop on permission decisions — Claude Code sees one tool call, while Devin may perform many actions behind it. Before pointing this at a repo you care about, prefer a disposable worktree or a container, and keep the sandbox on.

Config

Because the agent command is configurable, the same bridge works for any ACP agent — e.g. DEVIN_MCP_AGENT_CMD=npx DEVIN_MCP_AGENT_ARGS="-y @zed-industries/claude-code-acp".

Debugging

Agent stderr is inherited, so claude --debug shows both the bridge's [devin-mcp] log lines and Devin's own output. claude mcp list shows connection status.

Layout

• src/devin-mcp.mjs — the bridge; ACP client + MCP server in one process.

• scripts/fake-agent.mjs — minimal ACP agent used by the smoke test, so the wiring can be exercised without opening a real Devin session. It also probes the fs sandbox.

• scripts/smoke.mjs — MCP handshake, tools/list, and optionally one full turn.