DevPilot MCP

An MCP server that gives an AI model structured, security-conscious access to one software repository. It can read and search code, describe the repository, inspect Git and GitHub, gather evidence for developer questions, apply patches you supply (and revert them), and run the repository's Python tests. An optional local web UI, DevPilot Studio, lets you chat with the repository and watch every tool call live.

DevPilot collects evidence and performs tightly bounded actions. The AI model does the reasoning.

AI model (e.g. Gemini) ──► MCP client ──stdio──► DevPilot MCP server ──► your repository

Features

• Explore: list, read and search files; source-only code search.
• Understand: languages, structure, dependency manifests, tests, entry points and frameworks.
• Git and GitHub: status, log, diff and branches; repository, issues and pull requests (all read-only).
• Investigate: ranked evidence for questions like "Where is authentication implemented?"
• Patch: apply an explicit unified diff atomically, and revert it.
• Test: detect pytest/unittest, run tests with a fixed command, and produce a validation report.

Tools

Quick Start

Requires Python 3.10+ (3.11+ recommended) and Git.

Install from PyPI:

pip install devpilot-mcp

When installed this way, always set DEVPILOT_WORKSPACE to the absolute path of the repository DevPilot should work on, for example in your MCP client's server settings.

Or clone the repository (includes the tests and a sample workspace):

git clone https://github.com/KD-kaustubh/devpilot-mcp.git
cd devpilot-mcp
python -m venv .venv
.venv\Scripts\activate           # macOS/Linux: source .venv/bin/activate
pip install -e .
copy .env.example .env           # macOS/Linux: cp .env.example .env

In .env, set DEVPILOT_WORKSPACE to the repository DevPilot should work on. The default is the bundled ./workspace sample, which is not a Git repository. GITHUB_TOKEN is optional.

Try It

1. Run the test suite

python -m unittest discover -s tests -t .

2. Explore it with MCP Inspector (needs Node.js)

npx @modelcontextprotocol/inspector

Set Transport to STDIO and Command to the full path of .venv\Scripts\devpilot-mcp.exe, then click Connect and List Tools. Try search_code with query = format_price.

3. Connect an AI client. Register DevPilot as a stdio server. For example, with Claude Code:

claude mcp add devpilot -e DEVPILOT_WORKSPACE=D:/path/to/repo -- D:/path/to/devpilot-mcp/.venv/Scripts/devpilot-mcp.exe

Then ask: "Use DevPilot to analyze this repository and explain its structure." More in the usage guide.

Web UI: DevPilot Studio

A local web app to chat with your repository and watch every tool call happen live.

pip install "devpilot-mcp[ui]"
devpilot-ui

It opens http://127.0.0.1:8765 in your browser:

• Chat: streaming answers. An animated Steps panel in each answer shows every tool call, including calls blocked by DevPilot's security.
• Result cards: visual cards instead of JSON (language bars, commit timelines, diffs, search matches, test results).
• Sidebar: the workspace and its Git status, quick actions, the 18 tools, and a file explorer with a file viewer.
• Ctrl+K: run any tool through a form.
• Changes: every applied patch, with one-click Undo.

Setup:

• AI chat: needs an AI Pipe token in AIPIPE_TOKEN. Quick actions work without it.
• Approval: anything that changes files or runs tests waits for you to click Approve.

See the Web UI guide.

Security at a Glance

• Every path stays inside the workspace. .., absolute, drive and UNC paths, and escaping symlinks and junctions are rejected.
• Only two places start processes: allowlisted read-only Git commands, and two fixed Python test commands. There is no shell and no caller-supplied command.
• .env files, private keys, credential files and .git internals are never read, searched or written.
• Patches are validated in full and applied atomically.
• GitHub access is HTTPS GET to api.github.com only, and the token never appears in output.
• Every tool is annotated as read-only, writes-files or executes-code, so clients can ask before risky calls.

It is not a sandbox. Tests run with DevPilot's own permissions and network access, and secret redaction is best-effort. See Security for the full model and known limitations.

Documentation

License

MIT