Security & Testing

busymate.dev

Manages and monitors network devices and proxy configurations, including breakpoint events and PAC connection testing.

1 endpoint49 known toolsFirst detected July 25, 2026Last detected August 29, 2026

ENDPOINT 1

https://mcp.busymate.dev

No auth detected

MCP server metadata

Name: busymate-devtools
Version: 1.0.723

Capabilities

tools.listChangedresources.listChangedprompts

Server instructions

This server (busymate-devtools) exposes Busymate's full dashboard read/write surface AND its shared TEAM memory. Use the team memory actively, when relevant — not on every turn. RECALL: at the start of a task that involves Busymate or product/team knowledge, call `list_global_memories` (filter by `query`/`kind`, status approved) to recall relevant team facts before answering. Use `get_memory_stats` to gauge coverage. CONTRIBUTE: when you learn a durable, team-shareable project fact, call `propose_global_memory` with ONE third-person, subject-less statement (≤600 chars, NO names/emails/IPs/hostnames/secrets). It is held pending until an operator approves it; your contribution is attributed to your account. PERSONAL: `save_memory`/`list_memories`/`forget_memory` are caller-private facts (scoped to your account, not shared with the team). SAVE — a directive, not an option: when you learn a durable fact, preference, or correction about this user, call `save_memory` BEFORE finishing the task — one third-person statement, ≤600 chars. Saving a near-duplicate is safe — it dedup-merges into the existing memory, so save without hesitating. GATES: recall needs the `users:view` capability; propose needs `users:edit`. Destructive/mutating tools require `confirm:true`. Keep it balanced — recall/contribute when it helps, don't spam memory calls.

Known tools 49

list_breakpoint_events

List HELD (paused) breakpoint exchanges — the READ side of the breakpoint-continue flow (public.

Inferred read-only

get_device

Get one device row by uuid, name, OR its PAC PORT — the DIRECT resolver for a KNOWN device: when you already hold a device uuid/name (from traffic rows, audit events, another tool's result) or a per-device PAC/proxy endpoint, call this instead of browsing or paging list_devices.

Inferred read-only

list_devices

List devices, ONE PAGE at a time — YOUR OWN by default (owner-scoped to the calling account: the same reach the dashboard gives you), or the WHOLE fleet with `all:true` (devices:view operators only; re-verified server-side — for a non-operator `all` is rejected, never silently widened).

Inferred read-only

get_device_status

Get a device's live status: `online` is DERIVED truth (#776 — devices.

Inferred read-only

get_device_health

THE ONE QUERY (#1157/#1160): the latest capture-health projection for ONE device — one `device_health` row, no scan, no on-device access needed.

Inferred read-only

list_device_events

The MULTI-PRODUCER device TELEMETRY event stream (#1160/#1208) — every DECISION and STATE TRANSITION reported about the capture pipeline by the iOS app OR by the PAC/proxy server (public.

Inferred read-only

list_device_audit_modes

Every device with AUDIT-mode telemetry currently armed — device_uuid + name, enabled, expires_at + expires_in, level, categories, who armed it (set_by_label) and when (set_at).

Inferred read-only

test_pac_connection

PROVE whether PAC capture actually works for ONE device — the "is it really working?

Inferred read-only

list_screen_share_recordings

List saved screen-share RECORDINGS (#1916) — operator-captured mp4s of live share streams (the dashboard viewer's Record control), saved for later reference in public.

Inferred read-only

get_screen_share_recording

Fetch ONE saved screen-share recording (#1916) by id — the metadata row plus, with `with_url:true`, a SHORT-TTL (600s) signed playback URL + a download URL for the mp4 (H.

Inferred read-only

get_my_account

YOUR account at a glance — ONE self-scoped read returning the calling account's profile (name, display_name, email, role, sign-in providers, user_id, created_at), your per-user default connection type (own value + the global default + the effective fold), your linked Telegram accounts, the devices YOU own (uuid/name/model/last_seen_at — the uuids feed get_device / rename_device / …), your Stripe subscription status, and the API endpoints callable with this token.

Potential side effects

get_device_egress_status

Read a device's egress-IP set (#1432) — the device→proxy INGRESS / CONNECT-source ADMISSION IPs the proxy allowlists for it (the addresses it will ACCEPT this device's CONNECTs FROM), PLUS any manual dev overrides.

Inferred read-only

get_device_egress_fail_posture

Read a device's PAC egress FAIL POSTURE (#1657) — what the proxy does when the device is handed the #76 PAC DIRECT fallback (its PAC-fetch source IP is not yet in the CONNECT-source admission allowlist, routine on CGNAT).

Inferred read-only

get_entry_count

Count entries in a workspace (workspace_id or workspace_slug) with optional device/host/method/status/search filters.

Inferred read-only

search_entries

LOCATE captured entries by ANY keyword `q` — matched against the host/url/path AND the DECRYPTED request/response DATA: the request+response HEADERS and the request+response BODY text (#1577).

Inferred read-only

list_entries

LIST the newest captured traffic entries as SLIM feed rows (id, ts, device, kind, request_id, host, path, method, status, contentType, url — NO bodies/headers) — the dashboard main live feed's MCP-parity read (#778).

Inferred read-only

get_entry

Get ONE captured entry's FULL detail by the id you already hold — method, URL, host, path, status, timing (duration_ms) + sizes, the request AND response HEADERS, and the request AND response BODIES (size-capped, truncation stated explicitly).

Inferred read-only

export_har

Export captured entries as a HAR 1.

Inferred read-only

inspect_requests

Deep-inspect FULL captured request/response detail for ONE host — method, URL, request + response HEADERS, and request + response BODIES (size-capped).

Inferred read-only

summarize_device_traffic

BOUNDED traffic aggregation for ONE device — the FIRST tool to call to report what a device is doing, find the busy/flooding host, or pick a host to clean up.

Inferred read-only

list_service_groups

List every service group (full rows incl.

Inferred read-only

get_service_group

Get one service group by id or name.

Inferred read-only

list_tags

List every tag (id, name, color, patterns).

Inferred read-only

get_device_settings

Read settings_device for one device (device_uuid or deviceName).

Inferred read-only

list_store_apps

List apps in the bmai App Store (busymate.

Inferred read-only

get_store_app

Get ONE bmai App Store app by slug plus its versions, gallery media, pricing plans, locales, and recent published reviews.

Inferred read-only

list_store_categories

List the bmai App Store category taxonomy.

Inferred read-only

get_subscription

Return the caller's OWN Stripe subscription(s) — status/price/product/quantity/period/trial/cancel-at-period-end (from stripe_subscriptions, owner-scoped to the caller's OAuth sub).

Inferred read-only

list_invoices

List the caller's OWN Stripe invoices — status/amounts (minor units)/currency/hosted_invoice_url/period (from stripe_invoices, owner-scoped to the caller's OAuth sub), newest first.

Inferred read-only

get_usage

Return the caller's OWN metered usage rollup (metric `captured_entries` = count of captured entries per device per period; from stripe_usage_events, owner-scoped to the caller's OAuth sub) aggregated by period over a window.

Inferred read-only

get_block_rules_device

Read what ONE device ENFORCES — the EFFECTIVE 4-tier block-rule union (global ++ service ++ user ++ device, de-duped by id, device wins then user then service then global) plus the SERVICE list (the applied service groups' rules, flattened in service-group name order), the device owner's USER list, and that device's per-device list.

Inferred read-only

list_todos

List YOUR to-dos from the /todo app (public.

Inferred read-only

get_todo

Get ONE of YOUR to-dos by id — its full row.

Inferred read-only

list_advisor_findings

Browse the ADVISOR CENTER findings (public.

Inferred read-only

get_advisor_finding

Get ONE advisor finding in FULL by its `fingerprint` (from list_advisor_findings) — with its up-to-20 resolved (already-redacted) audit EVENTS, the SCOPED /audit deep link, and the /advisor permalink, so you can act with zero re-investigation.

Inferred read-only

share_advisor_finding

Build a SHAREABLE package for ONE advisor finding — the max-context markdown + flat LLM prose + the permalink, so it can be dropped into a doc/chat/issue with full context (Finding · Analysis · Evidence · Deep links · Repro · Meta).

Inferred read-only

list_issue_reports

List issue reports from the one-tap reporter (public.

Inferred read-only

list_workspaces

List workspaces.

Inferred read-only

get_workspace

Get one workspace by id or slug.

Inferred read-only

list_tabs

List a workspace's tabs (workspace_id or workspace_slug).

Inferred read-only

list_snapshots

List snapshot files in the snapshots storage bucket.

Inferred read-only

download_snapshot

Get a 5-minute signed download URL for a snapshot file (name from list_snapshots).

Inferred read-only

list_push_tokens

List registered device push tokens (masked), PLATFORM-ROUTED (#1542): each `device_push_tokens` row carries a `platform` discriminator — `ios` = an APNs device token (push-notify's APNs leg), `android` = an FCM registration token (push-notify's FCM HTTP v1 leg).

Potential side effects

get_push_response

Read back a device's answer to an actionable push (#75) by the correlation_id returned from send_push.

Inferred read-only

get_stats

Return the live stats snapshot (get_stats RPC).

Inferred read-only

get_status

Return the latest infra status snapshot (service_status) MERGED with the Edge tier's self-reported deployed build.

Inferred read-only

list_audit_events

Read the platform AUDIT TRAIL (public.

Inferred read-only

get_audit_event

Get ONE audit-trail row in FULL by its `id` (from list_audit_events) — including the fields the list omits: the REDACTED `detail` (old→new diffs for allowlisted keys, redacted at write time — never raw args/secrets) and `statement_excerpt` (the left-400-char SQL for a direct-PG write).

Potential side effects

list_device_service_groups

List the device↔service-group membership edges (public.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.busymate-devtools]
url = "https://mcp.busymate.dev"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "busymate-devtools": {
      "type": "http",
      "url": "https://mcp.busymate.dev"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: busymate-devtools
Remote MCP URL: https://mcp.busymate.dev

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "busymate-devtools": {
      "url": "https://mcp.busymate.dev"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "busymate-devtools": {
      "type": "http",
      "url": "https://mcp.busymate.dev"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "busymate-devtools",
  "transport": "streamable-http",
  "url": "https://mcp.busymate.dev"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Trust Data Available

BuiltWith Trust API v2 evidence for busymate.dev was fetched 2026-07-26T01:48:24.280Z and is being refreshed.

Trust status Neutral

busymate.dev is assessed as Neutral: No suspicious signals found, but no strong positive signal either

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.