devshield

AI-powered security and quality toolkit for your code editor. One MCP server, 17+ tools.

What It Does

devshield bundles five specialized development tools into a single MCP server:

| Module | What it does | Tools | |--------|-------------|-------| | codeguard | Code review — bugs, error handling, security patterns | 4 | | scanline | Security scanning — semgrep, SARIF parsing, finding triage | 5 | | migratoor | Migration safety — catch dangerous SQL before production | 3 | | docguard | API drift detection — compare OpenAPI spec vs actual code | 3 | | orchestr8 | Agent coordination — shared memory, routing, learning | 5+ |

Quick Start

Works with any MCP-compatible client — Claude Code, Claude Desktop, Cursor, Windsurf, VS Code (Copilot), Continue.dev, Zed, Cline, and more.

{
  "mcpServers": {
    "devshield": {
      "command": "npx",
      "args": ["-y", "devshield"]
    }
  }
}

That's it. One line. All tools available.

The Tools

Code Review (codeguard)

| Tool | Description | |------|-------------| | review_diff | Review a git diff for bugs, logic errors, security issues | | review_file | Deep review of a single file | | check_error_handling | Find silent failures and swallowed errors | | check_test_coverage | Analyze if tests cover critical paths |

Security Scanning (scanline)

| Tool | Description | |------|-------------| | scan_code | Run semgrep scan with auto language + framework detection | | detect_languages | Detect languages and frameworks, suggest rulesets | | parse_sarif | Parse SARIF output from any security scanner | | triage_finding | Classify finding as true or false positive | | diff_sarif | Compare baseline vs current scan results |

Migration Safety (migratoor)

| Tool | Description | |------|-------------| | check_migration | Analyze SQL for dangerous patterns with safe alternatives | | list_rules | List all 14 PostgreSQL safety rules | | explain_rule | Deep dive on why a pattern is dangerous |

API Drift Detection (docguard)

| Tool | Description | |------|-------------| | check_drift | Compare OpenAPI spec against code routes | | extract_routes | Extract API routes from Express, FastAPI, or Hono code | | validate_spec | Validate OpenAPI spec completeness |

Agent Coordination (orchestr8)

| Tool | Description | |------|-------------| | memory_store | Store data in shared agent memory | | memory_retrieve | Retrieve data from shared memory | | route_task | Route tasks to the best-suited agent | | score_agents | Score agent performance | | store_pattern | Store learned patterns for reuse |

How They Work Together

You write code
    |
    v
codeguard -----> Reviews for bugs, error handling, security patterns
    |
    v
scanline ------> Scans for vulnerabilities, triages findings
    |
    v
migratoor -----> Checks your database migrations are safe
    |
    v
docguard ------> Verifies your API docs match your code
    |
    v
orchestr8 -----> Coordinates multi-agent workflows, remembers patterns

Using Individual Packages

Each module is also available as a standalone package:

npx @mrzadexinho/codeguard    # Code review only
npx @mrzadexinho/scanline     # Security scanning only
npx @mrzadexinho/migratoor    # Migration safety only
npx @mrzadexinho/docguard     # API drift detection only
npx orchestr8-mcp             # Agent coordination only

As Library

import { codeguard, scanline, migratoor, docguard } from 'devshield';

// Use any module programmatically
const result = migratoor.analyzeMigration('ALTER TABLE users ADD COLUMN email TEXT NOT NULL');
console.log(migratoor.formatReport(result));

Stats

• 580+ tests across all modules
• 17+ MCP tools in one server
• 14 migration safety rules with safe alternatives
• 25 code review rules across 4 categories
• 7 security triage rules with input validation detection
• 3 framework extractors (Express, FastAPI, Hono)
• 11 framework detections for smart security scanning

Prerequisites

• Node.js >= 20.0.0
• Semgrep (optional, for scan_code): pip install semgrep

License

MIT

Individual Packages

| Package | npm | GitHub | |---------|-----|--------| | codeguard | @mrzadexinho/codeguard | mrzadexinho/codeguard | | scanline | @mrzadexinho/scanline | mrzadexinho/scanline | | migratoor | @mrzadexinho/migratoor | mrzadexinho/migratoor | | docguard | @mrzadexinho/docguard | mrzadexinho/docguard | | orchestr8 | orchestr8-mcp | mrzadexinho/orchestr8 |