Devin

Product MCP gives Devin Intertrace tools (findings, assets, traces) at https://platform.intertrace.ai/mcp. Sign in with Clerk; Intertrace issues itm_… tokens. Full tool list: Product MCP.

Gateway MCP puts Intertrace in front of your MCP servers. Devin authenticates with a runtime key. Put the registered server_key in the URL — Devin’s custom HTTP form often only sends one Auth Header.

1. 1

   Add a custom MCP in Devin

   Settings → Connections → MCP servers → Add a custom MCP. Transport: HTTP. Server URL https://platform.intertrace.ai/mcp. Authentication: OAuth.

2. 2

   Allow Devin’s callback if asked

   Redirect URI https://api.devin.ai/mcp/oauth/callback is already accepted. Sign in in the Devin popup; you should land on Allow access, not the dashboard. Do not paste a Clerk JWT. If the popup says the window expired after you are already signed in, close it and click Test listing tools in Devin again.

3. 3

   CLI

   devin mcp add intertrace https://platform.intertrace.ai/mcp then devin mcp login intertrace.

{
  "mcpServers": {
    "intertrace": {
      "url": "https://platform.intertrace.ai/mcp",
      "transport": "http"
    }
  }
}

Mint itr_rt_* in Settings → Runtime API keys. Keep upstream secrets in the Provider vault — clients should not need vendor sk- keys.

Register the server on MCP → Servers first. Then add a custom HTTP MCP in Devin with Auth Header Authorization: Bearer itr_rt_….

{
  "transport": "HTTP",
  "url": "https://intertrace.fly.dev/mcp?server=YOUR_SERVER_KEY",
  "auth_method": "auth_header",
  "headers": {
    "Authorization": "Bearer itr_rt_YOUR_RUNTIME_KEY"
  }
}

If the form allows extra headers, you can keep https://intertrace.fly.dev/mcp and set X-Intertrace-MCP-Server instead. Same wire as MCP servers.

Bind the calling asset on its Runtime card. Monitor still executes allowed tools (ping, tools/list) and flags them; Enforce blocks policy violations. Switching org MCP Rules to Enforce does not replace the asset-level control, but it does deny unknowns and untrusted servers. Devin cannot send its proprietary coding-model traffic to a custom OpenAI base URL — MCP tool governance is the supported path.