# DevOpser

> DevOpser (https://app.devopser.io) is a secure AI app hosting and development platform. Its software catalog scores every connected application on six dimensions (security, observability, accessibility, privacy, data governance, production readiness) and fixes findings as pull requests.

## MCP server (use this from Claude Code, Claude Desktop or claude.ai)

The MCP server for app.devopser.io is NOT at app.devopser.io/mcp. That host is the web app, and every path on it returns the app's HTML page. The MCP server is:

    https://appbackend.devopser.io/mcp

- Transport: streamable HTTP (JSON-RPC 2.0, stateless).
- Auth: OAuth 2.1 with dynamic client registration and PKCE. There is no API key to paste. The client registers itself, then opens the browser so the user can sign in to DevOpser and approve access for one organization.
- Discovery: https://appbackend.devopser.io/.well-known/oauth-protected-resource and https://appbackend.devopser.io/.well-known/oauth-authorization-server
- Scopes: mcp:read (catalog, scorecards, findings), mcp:write (register apps, run evaluations, open remediation pull requests).

Connect from Claude Code:

    claude mcp add --transport http devopser https://appbackend.devopser.io/mcp

Then run /mcp inside Claude Code, pick "devopser" and sign in when the browser opens.

Connect from Claude Desktop or claude.ai: Settings, Connectors, Add custom connector, paste https://appbackend.devopser.io/mcp, save, then sign in when prompted.

The same URL and the list of connected clients are shown in the app under the "Connect Claude" card.

## Raising application scores to 100 with the MCP tools

1. fleet_summary: every application with its scores, to see which ones are below 100.
2. get_scorecard (application_id) and list_findings (application_id, severity, kind): what is failing and why.
3. remediate (application_id): the application's coding agent opens one pull request that fixes its findings, worst first. It spends credits; the result reports insufficient_credits if the balance is too low. Poll get_remediation_result (session_id).
4. A human reviews and merges the pull request. The platform only proposes changes.
5. run_evaluation: rescore after the merge, then repeat from step 1 until every dimension reads 100.

Writes need an administrator role (site-manager or user-manager) in the organization and are recorded in the audit log.

## Links

- App: https://app.devopser.io
- Docs: https://devopser.io/docs.html
- Pricing: https://devopser.io/pricing.html