Secure a Devin CLI Built App Before Launch

Before launching a Devin CLI built app, review what data entered the Cognition agent, protect its gitignored MCP config, verify dependencies the agent added, scan for committed secrets and collect independent launch evidence. Devin CLI is the command line agent from Cognition and is separate from Devin Desktop and Windsurf. It accelerates implementation but does not verify the runtime security of what it helped create.

The vibe coding security guide separates generated code from the controls that enforce what it may do. The same split applies here. A prompt such as do not deploy states intent. A missing production credential enforces it. This checklist walks through the app level review for a Devin CLI workflow without assuming the agent caused every defect.

Review area	Evidence to collect before launch
Data handling	Approved data classes, current Devin CLI settings and a record of any sensitive prompt or terminal output
Config and tools	Reviewed current .devin/mcp_config.local.json servers and mcp__name tool namespace
Secrets	Clean tree, scanned credentials, rotated keys and local config kept out of version control
Dependencies	Resolved lockfile, package identity, advisory result and install script decision
Application controls	Negative authorization, tenant boundary and input validation tests
Release evidence	Deployed surface checks, known limitations, owner and a fresh retest after fixes

1. Review what data entered Devin CLI

Devin CLI runs in the terminal and can read files, run commands and call connected tools. List the repositories, files, prompts, terminal output, database samples and logs that developers exposed to it. Classify each item using the same rules that govern other development services. The Devin CLI MCP configuration documentation documents server registration, authentication and tool naming for the CLI. Confirm the current settings before relying on any default.

That is a data handling review, not an application security result. Do not pipe production secrets, customer records, private keys or unrestricted database exports into a terminal merely because the agent runs locally. Keep live secrets outside the working tree. Use placeholders and synthetic fixtures for examples. If a credential may have entered any unapproved path, rotate it and check use logs. The OWASP secrets management guidance applies to any data that crosses a trust boundary, including a local terminal session.

2. Protect the gitignored MCP config and tool namespace

Devin CLI v3000.3 and newer stores local MCP configuration in .devin/mcp_config.local.json under mcpServers; .devin/mcp_config.json is the shared project scope and ~/.config/devin/mcp_config.json is the user scope. Older versions stored MCP entries in their main config files, which current Devin migrates on startup. Both local stdio and remote HTTP servers are documented, with devin mcp login for OAuth. Review the actual client version and each scope before adding another entry. Connected tools use the mcp__name namespace. The Devin CLI MCP documentation specifies these paths and transport rules.

Treat the config file as policy bearing, even though it is gitignored. Review which MCP servers are enabled, what tools each exposes and what credentials back them. The gitignore default protects local credentials but also means the team does not share the same server set automatically. If you need a shared definition, store the server entries in a separate committed file that references environment variables instead of literal secrets. Require a security owner for changes to agent configuration.

3. Keep secrets out of the generated tree

Devin CLI can produce code that embeds a real key, token or connection string into a committed file. Run a secret scan across the whole repository before launch. The CWE list of credential handling weaknesses covers hard coded passwords and the broader MITRE CWE database tracks related credential exposure patterns. Do not rely on the agent noticing its own mistake.

Keep live secrets outside the working tree using environment variables or a secrets manager. The .devin/mcp_config.local.json override is gitignored by default, but a secret can still land in source code the agent writes. Use placeholders and synthetic fixtures for examples the agent sees. Review the final diff for any new string that resembles a key, token or connection string. If a credential may have been committed, rotate it immediately and check access logs.

4. Verify the resolved dependencies

Devin CLI may add or upgrade packages while implementing a feature. Do not trust the import list at face value. Inspect the final manifest and lockfile, confirm package identity and publisher and review advisory results before installing in an environment with credentials. The OSV.dev database aggregates known vulnerability data across ecosystems and the npm package-lock documentation describes the resolved dependency tree for Node projects.

Review install scripts because a postinstall hook can run arbitrary code at install time. Inspect transitive changes because a new direct dependency can pull in dozens of unseen packages. Pin references to exact versions or hashes where practical. A dependency that passes an advisory check today can drift when a maintainer publishes a new version, so record the resolved versions and recheck before each release. If the agent added a package you do not recognize, read its documentation and source listing before trusting it with network or file access, because a popular name does not guarantee a safe implementation.

5. Test the application policy, not the generated shape

The generated app can have routes, forms and database queries that compile and render but still fail to enforce authorization. Test the policy directly. Verify a second user is denied access to the first user’s resources. Confirm tenant boundaries hold when two organizations share the same deployment. Check input validation on every endpoint that accepts user data. The OWASP Application Security Verification Standard defines structured requirements for authorization and session controls.

Run negative cases, not just the happy path. A test that confirms a feature works is weaker than a test that confirms an unauthorized request is blocked. Exercise error paths, edge cases and concurrent operations. Generated code often handles the expected flow well and the unexpected flow poorly. Record the negative test results as part of your release evidence so a reviewer can see what was checked, not just what passed. Keep a copy of the test commands, the input data and the observed response for each negative case so the check can be repeated after a fix without re-deriving the scenario from memory.

Why pair Devin CLI with LyraShield

Devin CLI accelerates implementation as a Cognition command line agent. LyraShield AI provides release assurance for AI built apps through a loop of target, review, evidence, fix, retest and report. The platform keeps detected candidates, retest outcomes and inconclusive results distinct. Each receipt is limited to its stated evidence and scope, and the assurance record preserves what was checked and the result. Approval gated fix proposals require review before a patch reaches a pull request, so a fix is never automatic.

LyraShield AI is in open beta with open registration. Its runner-local GitHub Action provides an advisory diff gate and SARIF output; it does not create hosted scan or retest evidence. A recorded scan keeps detected findings, retest outcomes and inconclusive results separate. Approval-gated fix proposals still require review and missing verification must remain visible in the release decision.

Use the Devin CLI integration guide for the current setup, then read the Devin CLI MCP workflow. Keep configuration instructions in that maintained guide rather than copying credentials between articles. Record the client version, enabled tools, selected workspace and observed connection result. A successful tool listing demonstrates connectivity, not permission to scan every target or execute every write.

Create an account to start a release review or use the free AI app security checklist first. The Codex security workflow covers a related terminal agent if your team uses multiple clients.