not analyzable — source repository is gone (deleted or private)
DevMatch is an MCP server for hiring engineers based on what they've actually built. Connect from Cursor, Claude Desktop, or any MCP-compatible AI assistant and search 35M+ developers ranked by verified open-source contributions — not LinkedIn keywords or self-reported skills. **Three tools:** **`find_candidates`** — paste a job description, get a ranked shortlist with bio, top repos, contribution evidence, and contact info. Pro tier adds verified email enrichment on the top 5 results. **`get_profile`** — deep-dive any GitHub handle. Bio, recent activity, top projects, and outreach channels in one call. **`find_similar_projects`** — landscape mapping from a seed repo with top contributors surfaced, so you can pivot from a project to its maintainers in one step. Built for mission-driven teams that want engineers who care about the work, not just check the keyword box. OAuth sign-in (no API keys to juggle). Free tier with 50 monthly credits, $129/mo Pro for higher quotas plus verified email enrichment.
Insufficient evidence to grade. This server's source has not been statically analyzed, so a low grade would only mean "nothing found", not "nothing there". We don't show a reassuring grade we can't stand behind. Attested signals (CVEs, provenance) below still apply.
Once the source is analyzed (see the analysis flag in the header), a graded score appears here. How analysis works: methodology.
graded 3m ago · see ecosystem CVEs →
No known CVEs for this server.
No tool-safety findings — heuristic detectors run on the compute-risk cadence; a finding appears when a tool trips a rule.
[](https://mcpobservatory.com/servers/smithery:zachary-royals/devmatch/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of zachary-royals.