Skip to content
Scalekit Docs
Talk to an Engineer Dashboard

Connect AI agents to the Devin MCP server

Vendor MCP
Open markdown

The Devin MCP connector routes your AI agent's tool calls to Devin's own MCP server through Scalekit. Each user connects their own Devin access token once, and Scalekit sends it with every call, so your agent never handles credentials. It comes with 25 tools.

Tools
25
What they doRead · write · destructive
1 · 24 · 01 read24 write0 destructive
Users sign in with

Setup

  1. Install the SDK

    Terminal window
    npm install @scalekit-sdk/node dotenv

  2. Set your credentials

    Add your Scalekit credentials to your .env file. Find values in app.scalekit.com > Developers > API Credentials.

    .env
    SCALEKIT_ENVIRONMENT_URL=<your-environment-url>
    SCALEKIT_CLIENT_ID=<your-client-id>
    SCALEKIT_CLIENT_SECRET=<your-client-secret>

  3. Create the Devin MCP connection

    In AgentKit > Connections, create a Devin MCP connection. The name you give it is the connection_name your code passes. See Configure connections.

    Console steps with screenshots

    Register your Devin API key with Scalekit so it stores it securely and injects it into every request. Devin uses API key authentication.

    1. Get your Devin API key

      • Sign in to Devin and go to Settings → Devin API.
      • Click the API keys (legacy) tab.
      • Under Personal API key, click View key to reveal your key, or expand the dropdown to regenerate it.

      Devin Settings → Devin API page showing the Personal API key with a View key button

    2. Create a connection in Scalekit

      • In Scalekit dashboard, go to AgentKit → Connections → Create Connection. Find Devin MCP and click Create.
      • Note the Connection name — you will use this as connection_name in your code (e.g., devinmcp).
      • Click Save.

    3. Add a connected account

      Connected accounts link a specific user identifier in your system to their Devin API key. Add one in the dashboard to test. In production, each user adds their own through the authorization link: they enter their credentials on the page it opens.

      In the dashboard, to test

      • Open the connection you created and click the Connected Accounts tab → Add account.
      • Fill in:
        • Your User’s ID — a unique identifier for this user in your system (e.g., user_123)
        • API Key — the Devin API key from step 1
      • Click Create Account.

      From your backend, if your app already has the credentials

      For example, when users enter them on a settings page in your app:

      import { Scalekit, ConnectorStatus } from '@scalekit-sdk/node';
      

      const scalekit = new Scalekit(
        process.env.SCALEKIT_ENVIRONMENT_URL,
        process.env.SCALEKIT_CLIENT_ID,
        process.env.SCALEKIT_CLIENT_SECRET,
      );
      

      // Never hard-code credentials — read from secure storage or user input
      const devinApiKey = getUserDevinApiKey(); // retrieve from your secure store
      

      const authorizationDetails = {
        details: {
          case: 'staticAuth',
          value: {
            details: {
              token: devinApiKey,
            },
          },
        },
      };
      

      let { connectedAccount } = await scalekit.actions.upsertConnectedAccount({
        connectionName: 'devinmcp',
        identifier: 'user_123',
        authorizationDetails,
      });
      

      // Make sure the account is ACTIVE before the first tool call.
      if (connectedAccount?.status !== ConnectorStatus.ACTIVE) {
        ({ connectedAccount } = await scalekit.actions.upsertConnectedAccount({
          connectionName: 'devinmcp',
          identifier: 'user_123',
          authorizationDetails,
        }));
      }

  4. Authorize a user and make your first call

    quickstart.mts
    import { ScalekitClient } from '@scalekit-sdk/node'
    import 'dotenv/config'
    import { createInterface } from 'node:readline/promises'
    

    const scalekit = new ScalekitClient(
      process.env.SCALEKIT_ENVIRONMENT_URL,
      process.env.SCALEKIT_CLIENT_ID,
      process.env.SCALEKIT_CLIENT_SECRET,
    )
    const actions = scalekit.actions
    

    const connector = 'devinmcp'
    const identifier = 'user_123'
    

    // Generate an authorization link for the user
    const { link } = await actions.getAuthorizationLink({ connectionName: connector, identifier })
    console.log('Authorize Devin MCP:', link)
    const rl = createInterface({ input: process.stdin, output: process.stdout })
    await rl.question('Press Enter after authorizing...')
    rl.close()
    

    // Make your first call
    const result = await actions.executeTool({
      connector,
      identifier,
      toolName: 'devinmcp_list_wiki_repos',
      toolInput: {},
    })
    console.log(result)
    Terminal window
    npx tsx quickstart.mts

    Each user opens the link once and enters their Devin MCP server credentials there. If your app already has a user's credentials, add the account from your backend instead, as the console steps above show. See Authorize a user for the full flow and statuses.

Tools

Pass the exact name to execute_tool
Try in PlaygroundRequest a tool
  • devinmcp_list_wiki_reposList the repositories that have a DeepWiki index, i.e.Read-only

    List Wiki Repos

    List the repositories that have a DeepWiki index, i.e. the ones that ask_wiki_question and read_wiki_* can answer about. This is not the set of repositories you have access to: repositories without a generated wiki are omitted.

    Inputs

    This tool takes no inputs.

  • devinmcp_ask_wiki_questionAsk any question about a GitHub repository's codebase and get an AI-powered answer grounded in its DeepWiki.Write

    Ask Wiki Question

    Ask any question about a GitHub repository's codebase and get an AI-powered answer grounded in its DeepWiki.

    Inputs

    questionstringrequired
    The question to ask about the repository.
    repoNamestringrequired
    GitHub repository or list of repositories (max 10) in owner/repo format.
  • devinmcp_devin_automation_manageManage Devin automations that run Devin in response to events (GitHub, Slack, Linear, schedules, webhooks) — list, get, create, update, delete, or run them.Write

    Devin Automation Manage

    Manage Devin automations that run Devin in response to events (GitHub, Slack, Linear, schedules, webhooks) — list, get, create, update, delete, or run them.

    Inputs

    actionstringrequired
    'templates' lists the built-in templates whose template_id 'create' accepts. 'run' fires an enabled automation now and bypasses its trigger conditions. 'validate_create' and 'validate_update' dry-run the payload without approval. Preflight actions (only when 'schemas' reports it available): 'preflight_get' (saved script and settings), 'preflight_samples' (canned sample events to test against before any real event exists; with sample_event_type, that sample's $EVENT_FILE), 'preflight_events' (an automation's recent matched events), 'preflight_event' (one event's $EVENT_FILE), 'preflight_test' (run a script, saved or not, on a real VM against a sample or a recent event; starts no actions; without automation_id it is a draft run for an automation that does not exist yet), 'preflight_run' (poll a test run's outcome and logs). Save the script through the 'preflight' parameter of create/update.one of listgetschemastemplatescreatevalidate_createupdatevalidate_updatedeleterunpreflight_getpreflight_samplespreflight_eventspreflight_eventpreflight_testpreflight_run
    actionsstring
    What the automation does. Required for 'create'. Replaces all existing actions on 'update'. On a draft 'preflight_test' (no automation_id) pass the actions you will create with, so the draft applies the same default network policy as 'create'. Most automations use one start_session action. Code scans use start_code_scan or scan_new_commits instead. Long prompts render as BEGIN/END PROMPT <label> blocks: extract only the text between those two lines into a local file, edit it, and update with the full actions array and 'prompt': 'file:///absolute/path' (Devin's client resolves file URIs; other MCP clients must pass the text inline). Never retype a long prompt.
    afterstring
    Opaque cursor for 'list'/'preflight_events' pagination (from a previous response's end_cursor).
    agent_typesstring
    Filter 'list' results by agent type; multiple values match automations containing at least one action of any given type (OR). Values: 'new_session' (start_session), 'long_running' (message_session), 'triage_session' (auto-triage), 'auto_triage' (legacy monitor_session), 'code_scan' (start_code_scan / scan_new_commits), 'remediate_finding', 'incident_session'.
    automation_idstring
    The automation ID. Required for 'get', 'update', 'validate_update', 'delete', 'run', 'preflight_get', 'preflight_events', and 'preflight_event'. Optional for 'preflight_test'/'preflight_run': omit it to test a script for an automation that does not exist yet (a draft run against a sample event), then pass the same 'preflight' group to 'create'. IDs are `auto-<uuid>`; a bare UUID (e.g. from a webapp `/automations/<uuid>` URL) is accepted and normalized.
    concurrencystring
    Caps on simultaneous runs and the queue of events waiting to run.
    creator_idstring
    Filter 'list' results to automations created by this user id.
    descriptionstring
    For 'create' only: one plain sentence of at most 70 characters saying what the automation does and where the result goes, starting with a verb (e.g. 'Summarizes new support tickets and posts top issues to #support-leads.'). The card already shows the schedule or trigger, so leave out when it runs. Shown on the approval and created cards in this chat; it is not saved on the automation.
    enabledstring
    Enable or disable the automation on 'create'/'update'; on 'list', filter to automations in that enabled state.
    event_datastring
    For 'run' only: structured stand-in for the event data the real source would have sent. Mutually exclusive with prompt.
    event_typestring
    Filter 'list' results to automations with a trigger of this event type, e.g. 'slack:message'.
    firststring
    Page size for 'list' (default 100) and 'preflight_events' (default 20) pagination; max 200.
    limitsstring
    Resource limits for the automation and the sessions it spawns.
    metadatastring
    Org-visible string key/value labels (max 16 pairs; keys <= 32 chars, values <= 128). Update behavior follows the org's update semantics from action="schemas". On 'list', filters to automations whose metadata matches every given pair (null values are invalid there).
    namestring
    Human-readable name for the automation (1-500 characters). Required for 'create' and 'validate_create'.
    notificationsstring
    Email/Slack pings about the automation's dispatch outcomes.
    preflightstring
    For 'create'/'update' and their validate_ dry-runs: the Preflight check, a script that runs before the actions and decides per trigger event whether to proceed, skip, or fan out. For 'preflight_test': the script to run (saved or not). Pass the source as 'file:///absolute/path'. On update the whole group replaces the stored one; omitted keeps it. Preflight actions: 'preflight_get' (saved script), 'preflight_events' (recent matched trigger events), 'preflight_event' (one event's full $EVENT_FILE document), 'preflight_test' (run a script against a recent event on a real VM; starts no actions), 'preflight_run' (poll a test run's outcome and logs). Available only when action='schemas' reports it.
    promptstring
    For 'run' only: free-text stand-in for the triggering event, included in the event payload as additional context (max 10000 chars). Mutually exclusive with event_data.
    queued_event_idstring
    For 'preflight_event' (required) and 'preflight_test' (optional; default = the most recent matched event that is not a manual run): a queued_event_id from 'preflight_events'. Mutually exclusive with sample_event_type.
    reasonstring
    For 'update' and 'delete': one plain sentence of at most 100 characters saying why you are making the change. Shown on the approval card in this chat; it is not saved on the automation.
    report_required_permissionsboolean
    For 'validate_create'/'validate_update' only: append the organization permissions a save of this payload is judged on (set by the pre-approval hook to declare them on the approval request; not needed when validating by hand).default false
    run_asstring
    Identity the triggered sessions run under. REQUIRED for 'create', no default. Choose it together with tools.mcp_servers. On 'update', omitted means unchanged.
    run_idstring
    For 'preflight_run': the run_id returned by 'preflight_test'.
    sample_event_typestring
    For 'preflight_samples' (optional: show that sample's full $EVENT_FILE document) and 'preflight_test' (test against the canned sample for this trigger event type, e.g. 'github:pull_request'; required when automation_id is omitted). Mutually exclusive with queued_event_id.
    sample_webhook_bodystring
    For 'preflight_test' with sample_event_type 'webhook:incoming' only: the JSON body the user's system will POST to the webhook, used in place of the canned body (webhook payloads are user-defined; every other source's shape is fixed and the canned sample is authoritative). Ask the user for a real example. At most 64KB.
    searchstring
    Filter 'list' results by name substring.
    security_profilestring
    Security-profile binding: {'profile_id': '...'} pins that profile, {'profile_id': null} records an explicit opt-out, omitted inherits the org/enterprise default. Writing it requires the security-profile management permission and is rejected from a Devin session: there, omit it and tell the user to pick the profile in the automation's editor in the webapp and, when that profile has a network policy, to turn off the automation's Network policy there so sessions use the profile's allowlist. An opt-out cannot escape a mandatory profile. Reads return {'selection': 'inherit'|'none'|'profile', 'profile_id', 'warnings': [...]}. Warnings are non-blocking configuration conflicts; show them to the user.
    session_settingsstring
    Settings applied to every session the automation spawns.
    template_idstring
    Create-only provenance marker from the automation templates endpoint.
    toolsstring
    Tool grants for the sessions the automation spawns (slack_dm_scope and teams_dm_scope go inside this group, never as top-level arguments).
    triggersstring
    Events that dispatch the automation. Required for 'create'. Replaces all existing triggers on 'update'. Schedule triggers use an RFC 5545 RRULE condition with the 'recurrence' operator, e.g. {'event_type': 'schedule:recurring', 'conditions': {'any': [{'all': [{'field': 'rrule', 'operator': 'recurrence', 'value': 'DTSTART;TZID=America/Los_Angeles:19700101T000000\nRRULE:FREQ=DAILY;BYHOUR=6;BYMINUTE=0'}]}]}}. Read the full RRULE rules and examples from action='schemas'.
  • devinmcp_devin_billing_tag_manageManage Devin billing tags (groupings of Devin sessions for usage tracking) with a single action-based tool: list/get/create tags, assign sessions one at a time or in bulk (up to 500 per call, sent in sequential batches of 100), and read the billing tags of up to 100 sessions at once ('get_session_tags').Write

    Devin Billing Tag Manage

    Manage Devin billing tags (groupings of Devin sessions for usage tracking) with a single action-based tool: list/get/create tags, assign sessions one at a time or in bulk (up to 500 per call, sent in sequential batches of 100), and read the billing tags of up to 100 sessions at once ('get_session_tags'). Only available in private mode (via devin.ai endpoints).

    Inputs

    actionstringrequired
    Operation to perform: 'list', 'get', 'create', 'assign_session', 'assign_sessions', or 'get_session_tags'.one of listgetcreateassign_sessionassign_sessionsget_session_tags
    afterstring
    Opaque cursor for 'list' pagination (from a previous response's end_cursor).
    assignmentsstring
    Map of Devin session ID -> billing tag ID (1-500 entries). Required for 'assign_sessions'. A null value marks the session as miscellaneous (no billing tag). Assignments are sent to the API in sequential batches of 100. Partial success: sessions or tags not found in the organization, or sessions you can't write, are reported per entry.
    billing_tag_idstring
    Billing tag id. Required for 'get'. For 'assign_session', the tag to assign; omit it to mark the session as miscellaneous (no tag).
    descriptionstring
    Free-form description of what work the tag covers. Optional for 'create'.
    devin_idstring
    ID of the Devin session to assign. Required for 'assign_session'. Assigning replaces the session's current billing tag.
    firststring
    Page size for 'list' pagination (default 100, max 200).
    namestring
    Billing tag display name. Required for 'create'.
    session_idsstring
    Session ids to look up billing tags for, at most 100. Required for 'get_session_tags'. Both 'devin-abc123' and 'abc123' are accepted. Each session comes back with its billing tag, as having no billing tag when it was categorized as Miscellaneous or its tag was deleted, as never categorized, or as not found.
  • devinmcp_devin_blueprint_testTest a candidate blueprint YAML in an authoring VM: start → run initialize → fix → run initialize again (clean VM) → run maintenance → then persist with update_environment_config.Write

    Devin Blueprint Test

    Test a candidate blueprint YAML in an authoring VM: start → run initialize → fix → run initialize again (clean VM) → run maintenance → then persist with update_environment_config.

    Inputs

    actionstringrequired
    Operation: start, run, get, cancel, or close.one of startrungetcancelclose
    afterinteger
    Log cursor for get.default 0
    author_session_idstring
    Author session ID for run, get, cancel, and close.
    namestring
    Knowledge command name, when target is knowledge.
    platformstring
    Authoring VM platform label.default default
    platformsstring
    Platform labels matching YAML "runs-on" values; use "default" for the default platform. Defaults to [platform].
    poll_interval_secondsinteger
    Seconds between run polls; capped so keepalives keep flowing.default 5
    repo_namestring
    Repository name used to create or set the session working directory.
    run_idstring
    Run ID for get and cancel.
    scopestring
    Optional repository scope for the run working directory.
    targetstring
    Blueprint target: initialize, maintenance, or knowledge.
    wait_timeout_secondsinteger
    Maximum time to wait for a run. Capped below the 15-minute approval window; use `get` to keep following a longer run.default 600
    yamlstring
    Candidate blueprint YAML for a run.
  • devinmcp_devin_campaign_manageRead and publish a bot's campaign: its plan, its append-only readings and its status.Write

    Devin Campaign Manage

    Read and publish a bot's campaign: its plan, its append-only readings and its status. Access follows the bot: a personal bot's owner and the bot's own sessions, or any org member for a multiplayer bot; org admins may read a personal bot's campaign. A Devin session may publish drafts, readings and status, but never approve the plan: send plan.approved exactly as stored (a person approves in the campaign panel). 'running' requires an approved plan. The first update creates the campaign.

    Inputs

    actionstringrequired
    'get' reads the campaign; 'update' publishes the given fields; 'validate' runs every check 'update' makes without saving.one of getupdatevalidate
    automation_idstring
    The bot's root automation (auto-<id>), resolved to its bot. A campaign Devin passes its own session automation id here. Pass this or bot_id.
    bot_idstring
    The bot (bot-<id>) whose campaign to read or publish. Pass this or automation_id.
    campaignstring
    For update/validate: the complete plan and/or complete latest_readings document, plus an optional status. Omitted fields stay unchanged. Parse local YAML into JSON first.
  • devinmcp_devin_code_scan_manageManage Devin code scans and scan profiles — list scans and findings, manage profiles, create scans, or remediate findings.Write

    Devin Code Scan Manage

    Manage Devin code scans and scan profiles — list scans and findings, manage profiles, create scans, or remediate findings.

    Inputs

    actionstringrequired
    The operation to perform: 'list_scans', 'get_scan', 'list_findings', 'list_scan_types', 'list_profiles', 'get_profile', 'create_profile', 'update_profile', 'create_scan', 'update_scan', 'scan_new_commits', 'get_session', 'remediate_finding', or 'remediate_findings'. 'list_scan_types' returns the scan types enabled for this org — only ever use those types (when general scans are disabled, only 'security'). Pick the type from the user's request yourself rather than presenting the types as a menu; use 'general' for anything no standard type covers. 'create_scan' launches the scan: only call it after the user has explicitly confirmed the setup by submitting code_scan_setup_form, or confirming a text summary when the form cannot be used. Preserve approved repositories, objective, effort, and notifications. 'scan_new_commits' re-runs an existing, completed scan against only the commits landed since it last ran — use it (not 'create_scan') whenever the user wants an existing scan brought up to date, e.g. "scan for new commits" or "rescan"; findings accumulate on the same scan. 'update_scan' changes the profile an existing scan applies to its future incremental runs (manual scan_new_commits and scan_new_commits automations alike) — use it (not a new scan) when the user wants an existing scan moved onto a different or revised profile. 'get_scan' reads one scan by scan_id, including the URLs of files attached to it. 'get_session' retrieves the latest run's orchestrating session link for a scan.one of list_scansget_scanlist_findingslist_scan_typeslist_profilesget_profilecreate_profileupdate_profilecreate_scanupdate_scanscan_new_commitsget_sessionremediate_findingremediate_findings
    afterstring
    Opaque cursor for list pagination (from a previous response's end_cursor).
    commit_shastring
    Optional Git commit SHA to check out for the initial scan ('create_scan' only, single repository). Accepts 7-64 hexadecimal characters; omit to scan the default branch. Later 'scan_new_commits' runs scan new commits rather than reusing this pin.
    communication_guidancestring
    Guidance for the communication phase: what happens when the scan finishes, e.g. Slack the requester a summary, or ping the code owners of each finding with it and its fix ('create_profile' and 'update_profile'). Always ask the user about this for non-security discover profiles. Security and ingest scans do not run this phase.
    descriptionstring
    Description of the profile ('create_profile' and 'update_profile').
    effortstring
    Scan effort ('create_scan' only): 'normal' (default) uses lower model reasoning effort and larger investigation batches — faster; 'deep' runs the full pipeline, tracing each finding further and validating findings one at a time — most thorough, slower. Only security scans offer the choice; every other scan type uses 'normal'. Explain the trade-off in terms of time and thoroughness only (never cost or usage).
    exclude_globsstring
    Glob patterns of files to exclude from scans ('create_profile' and 'update_profile').
    finding_idstring
    The finding ID. Required for 'remediate_finding'.
    finding_idsstring
    Findings of scan_id to fix together ('remediate_findings'; at least one). One session plans and groups them, then opens one pull request per group.
    firststring
    Page size for list actions (default 100, max 200).
    hoststring
    Git host of the repository/repositories ('create_scan' only).
    include_globsstring
    Glob patterns of files to include in scans ('create_profile' and 'update_profile').
    ingestion_source_guidancestring
    Guidance describing the ingestion source ('create_profile' and 'update_profile').
    interactivestring
    Interactive mode ('create_scan', security scans only): true pauses the scan once it has drafted its threat model and opens a session where the user reviews and adjusts it before investigation starts; false (default) runs end to end unattended. For security scans explain the difference, then ask. Never offer or set it for any other scan type — those always run unattended.
    investigation_guidancestring
    Guidance for the investigation phase ('create_profile' and 'update_profile').
    localestring
    BCP-47 language tag of the language the user is conversing in, e.g. 'ja' or 'pt-BR' ('create_scan' only). The scan writes its findings and report in this language. Always pass it when the user is not writing in English; omit it for English.
    modestring
    Profile mode: 'discover' (default) or 'ingest' ('create_profile' only; the mode is fixed at creation).
    post_ingestion_guidancestring
    Guidance for the post-ingestion phase ('create_profile' and 'update_profile').
    profile_idstring
    The profile ID. Required for 'get_profile', 'update_profile' and 'update_scan' (the profile future incremental runs use; must match the scan's type and mode); optional for 'create_scan'.
    profile_namestring
    Name of the profile. Required for 'create_profile'; optional new name for 'update_profile'.
    remediation_guidancestring
    Guidance for the remediation phase ('create_profile' and 'update_profile').
    repo_namestring
    Filter to this repository ('list_scans' and 'list_findings'), or the full repository name to scan ('create_scan'; provide exactly one of repo_name or repos).
    report_guidancestring
    Guidance for the report phase ('create_profile' and 'update_profile').
    reposstring
    Full names of the repositories to scan together as one scan ('create_scan'; provide exactly one of repo_name or repos). The first entry is the scan's primary repo. Use this whenever the user wants more than one repository covered.
    scan_idstring
    The scan to read ('get_scan'), or filter findings to this scan ('list_findings'), or the scan ID containing the finding(s) ('remediate_finding', 'remediate_findings'), or the scan to re-run ('scan_new_commits'), or the scan to reconfigure ('update_scan'), or the scan whose orchestrating session to retrieve ('get_session').
    scan_pathsstring
    Repository-relative paths to restrict scans to ('create_profile' and 'update_profile'). Include globs do not widen an existing restriction; pass [] with 'update_profile' to lift it.
    scan_typestring
    Type of scan, e.g. 'security' or 'general' ('create_scan', 'create_profile', 'list_profiles'). For 'list_profiles': only return profiles for this scan type — always pass the chosen type so profiles for other types are never shown or considered. For 'create_scan': must match the chosen profile's scan type; defaults to the profile's type, or 'security' when neither a profile nor a type is given. Every non-security scan type requires a profile_id — the profile defines the scan's objective. For 'create_profile': the type of scan the profile configures (defaults to 'security'). For 'update_profile': the new scan type of the profile.
    severitystring
    Filter findings to these severities: 'critical', 'high', 'medium', 'low' ('list_findings' only).
    statusstring
    Filter findings to these statuses: 'open', 'dismissed', 'resolved' ('list_findings' only).
    summarystring
    One-sentence, user-facing description of the proposed change, shown on the approval card when 'update_profile' targets a 'security' profile.
    threat_model_guidancestring
    Guidance describing the threat model ('create_profile' and 'update_profile').
    time_afterstring
    Unix seconds lower bound. Optional creation-time filter ('list_scans' only).
    time_beforestring
    Unix seconds upper bound. Optional creation-time filter ('list_scans' only).
    triage_guidancestring
    Guidance for the triage phase ('create_profile' and 'update_profile').
    type_configstring
    Configuration specific to the profile's scan type ('create_profile' and 'update_profile'). Only 'compliance' profiles define one: {'system': {'slug', 'name', 'repos', 'path_globs', 'guidance'}, 'framework': {'slug', 'name'}, 'criteria': [{'id', 'text', ...}]}. 'system' is the one authorization boundary the catalog assesses and 'framework' the standard its criteria come from; catalogs sharing a system slug roll up together on the Compliance page. 'system.guidance' is the user's guidance for every scan of the system: copy it unchanged whenever you pass 'system', and never write it unless asked. 'update_profile' keeps the stored top-level keys you do not pass, so send only the ones you are changing ('system', 'framework' or 'criteria', each replaced whole); pass {} to clear the object. Omit for every other scan type.
    validation_guidancestring
    Guidance for the validation phase ('create_profile' and 'update_profile').
    validation_severitiesstring
    Finding severities runtime validation covers, from 'critical', 'high', 'medium', 'low' ('create_profile' and 'update_profile'; security profiles only). Omit for the default (critical, high, medium); pass [] with 'update_profile' to restore it.
  • devinmcp_devin_find_settingFind a Devin webapp setting and get a deep-link URL to it.Write

    Devin Find Setting

    Find a Devin webapp setting and get a deep-link URL to it. Use for "where do I change X?". The output includes everything needed to build the final URL.

    Inputs

    querystring
    Feature keywords (e.g. "queue messages", "fast mode"). Omit for the full settings catalog.
All 125 in Developer Tools