DevSpace exposes local coding capabilities over MCP. Treat it as remote access to your development machine.

The security model is simple:

• you choose a narrow filesystem allowlist
• the MCP endpoint requires OAuth approval with your Owner password
• Host headers are allowlisted from the configured public URL
• every coding action happens through explicit MCP tool calls

DevSpace only opens workspaces under configured roots.

Good examples:

~/work
~/personal/open-source

Avoid broad roots:

~
/
C:\

The narrower the root, the easier it is to reason about what the MCP client can reach.

devspace init generates an Owner password and stores it in:

~/.devspace/auth.json

When an MCP client connects, DevSpace shows an approval page. Enter the Owner password only when you intentionally want that client to access this server.

For env-driven deployments, set a long random value:

DEVSPACE_OAUTH_OWNER_TOKEN="$(openssl rand -base64 32)"

DevSpace needs DEVSPACE_PUBLIC_BASE_URL so MCP clients can discover OAuth metadata and connect to the correct resource.

The value should be the origin only:

https://your-tunnel-host.example.com

Do not include /mcp in DEVSPACE_PUBLIC_BASE_URL.

By default, DevSpace derives allowed Host headers from the local host and public URL. Use DEVSPACE_ALLOWED_HOSTS=* only for intentional local debugging.

DevSpace does not manage tunnels. Your tunnel or reverse proxy should point to:

http://127.0.0.1:7676

Prefer adding Cloudflare Access, Tailscale identity controls, or equivalent protection in front of public tunnels. DevSpace OAuth still protects the MCP endpoint, but the tunnel URL should not be treated as a secret.

The shell tool is powerful by design. It is meant for tests, builds, git, and package scripts.

Filesystem path containment applies to DevSpace file tools. Shell commands run as local commands and can do what your user account can do. This is why the MCP client must be trusted and the Owner password must stay private.

Managed worktrees reduce accidental edits to your active checkout, but they are not a security boundary. They are a workflow boundary for isolated coding sessions.

Native file download is an opt-in, one-shot transfer into an already-open workspace. download_artifact accepts the MCP host's native file value, the workspaceId returned by open_workspace, and an unused relative destination path. It returns only the workspace-relative path and does not create a persistent artifact service or reusable artifact ID.

DevSpace accepts only the documented native-file object and trusted OpenAI download hosts and redirects. Arbitrary URL strings, local source paths, credentials, malformed references, and unknown object fields are rejected.

Absolute paths, traversal, symlinked parents, and existing destinations also fail closed. Downloads stream under the configured per-file limit and are published without overwrite as owner-only files. DevSpace does not extract or execute transferred content.

By default, DevSpace logs requests and tool calls. Shell command previews are disabled unless DEVSPACE_LOG_SHELL_COMMANDS=1.

Do not enable shell command logging if commands may contain secrets.

Artifact tool logs contain bounded workspace ID, validated hostname, workspace-relative output path, byte count, hash, duration, and status metadata. download_artifact does not log the opaque file value. Raw content, connector references, native file IDs, bearer credentials, presigned URLs, host paths, temporary paths, and base64 chunks are never included in tool logs or tool results.