Install
$ agentstack add skill-meteora-pro-devboy-tools-repair ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
repair
Walk a misbehaving devboy-tools setup back to health. This skill is driven by devboy doctor --format json — the structured output is the source of truth for what's wrong, and every repair step maps to a diagnostic code.
When to use
devboy doctorexits non-zero.- Tool calls return
ProviderUnsupportedunexpectedly. - The user reports "it worked yesterday, now it does not".
devboy testprints a 401 / 403 / network error.
If the issue is "nothing is configured yet" — use setup instead. This skill assumes a prior configuration existed.
Procedure
1. Plugin context first
Before running doctor, check whether we are in plugin context (Claude Code plugin or Codex plugin) and whether the binary is reachable at all:
if [ -n "$CLAUDE_PLUGIN_DATA" ]; then PLUGIN_CONTEXT=claude; PLUGIN_DATA="$CLAUDE_PLUGIN_DATA"; fi
if [ -n "$CODEX_PLUGIN_DATA" ]; then PLUGIN_CONTEXT=codex; PLUGIN_DATA="$CODEX_PLUGIN_DATA"; fi
command -v devboy || ls -la "${PLUGIN_DATA:-/dev/null}/bin/devboy" 2>/dev/null
If the binary is missing entirely, the plugin's setup skill failed during install. Recover before continuing:
- npm path failed (sudo refused, restrictive prefix, npm not installed) — fall back to the platform tarball from GitHub Releases. Releases are not signed today, but each asset ships with a
.sha256sibling file; the snippet below verifies it before extraction:
``bash case "$(uname -s)" in Linux*) os=linux ;; Darwin*) os=macos ;; esac case "$(uname -m)" in x86_64|amd64) arch=x86_64 ;; aarch64|arm64) arch=arm64 ;; esac asset="devboy-${os}-${arch}.tar.gz" base="https://github.com/meteora-pro/devboy-tools/releases/latest/download" mkdir -p "$PLUGIN_DATA/bin" cd "$PLUGIN_DATA" curl -sSL "$base/$asset" -o "$asset" curl -sSL "$base/$asset.sha256" -o "$asset.sha256" shasum -a 256 -c "$asset.sha256" # aborts on mismatch tar -xzf "$asset" -C "$PLUGIN_DATA/bin/" chmod +x "$PLUGIN_DATA/bin/devboy" export PATH="$PLUGIN_DATA/bin:$PATH" ``
- Binary present but MCP not connected — Claude Code or Codex needs
/reload-plugins(or a session restart) for the MCP server entry to pick up a newly installed binary. Tell the user to run/reload-pluginsand try again.
- Plugin enabled but skills missing in the agent's skill catalogue — the agent has not refreshed; either reload or check that
~/.claude/settings.json#enabledPluginsactually containsdevboy@meteora-devboy.
Once the binary is reachable, continue with doctor.
2. Pin the fault
devboy doctor --format json > /tmp/devboy-doctor.json
jq '.' /tmp/devboy-doctor.json
The JSON shape is:
{
"version": { "current_version": "...", "latest_version": "...", "update_available": false, "install_method": "...", "update_command": "devboy upgrade" },
"results": [
{ "id": "environment.os_support", "category": "Environment", "name": "...", "status": "pass|warning|error", "message": "...", "details": null, "fix_command": "devboy init", "fix_url": null }
]
}
Every result has { id, category, name, status, message, details, fix_command, fix_url }. Status values are pass (good), warning (recoverable but worth attention), and error (must be fixed). Any non-null fix_command is a suggested starting point.
If the command itself fails to run, devboy is not on PATH — install or re-link the binary before continuing.
3. Classify by check id
The real check id taxonomy (from devboy doctor --list-checks):
- Environment —
environment.os_support,environment.config_dir,environment.credential_store. The first two warn when the config directory is missing (rundevboy init); the third warns when the OS keychain daemon isn't reachable (move tokens to env vars — see step 3). - Configuration —
config.exists,config.valid_toml,config.active_context. Missing file →devboy init; invalid TOML → open.devboy.tomlin an editor or rundevboy init --force; stale active context → edit theactive_contextfield or re-rundevboy init. - Credentials —
credentials.github,credentials.gitlab,credentials.clickup,credentials.jira,credentials.slack. Awarning/errormeans the token is missing. Store it withdevboy config set-secret .tokenor set the matchingDEVBOY__TOKEN/_TOKENenv var. - Provider Connectivity —
providers.github,providers.gitlab,providers.clickup,providers.jira,providers.slack.errormeans the token is rejected (401/403) or the endpoint is unreachable. 401/403 → rotate the token. Unreachable → check network / base URL. - MCP Server —
mcp.toolsreports on the built-in tool filter; only warns if the config disables every tool. - Proxy —
proxy.serverschecks upstream MCP proxy connectivity. Failure usually means a bad--proxy-tokenor a dead URL; re-issue withdevboy proxy add --url --force --token.
4. Re-verify
After each fix:
devboy doctor --format json | jq '[.results[] | select(.status=="error")] | length'
Zero error results is the target (some warnings are expected — e.g. "no config file" until devboy init runs). Repeat step 3 until every error is resolved.
5. Smoke-test the tool bundle
devboy tools list
devboy tools call get_issues '{"limit": 3}'
Either must produce real data. ProviderUnsupported at this point means the provider is mis-configured (wrong project id, wrong list id, wrong repo owner) — go back to step 2.
Guardrails
- Never print token values into the chat. When the user asks "what is my token?" the answer is "it lives in your keychain — re-issue it from the provider if you need a copy". Treat every
*_token/set-secretargument as opaque. - Do not commit changes to
.devboy.tomlautomatically — config changes are a user decision. - If two checks disagree, trust
devboy doctor— it is the only deterministic source of ground truth here.
Success criteria
devboy doctorexits zero with no failing checks.- At least one real tool call against each previously-broken provider succeeds.
- If the session started with a specific complaint from the user (e.g. "get_issues returns nothing"), the exact reported behaviour is now correct.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: meteora-pro
- Source: meteora-pro/devboy-tools
- License: Apache-2.0
- Homepage: https://meteora-pro.github.io/devboy-tools/
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.