Zephex_dev_info
Vetted production patterns for auth, databases, and security—so your agent stops inventing them.
Zephex is a hosted Model Context Protocol (MCP) server. **Zephex_dev_info** is its expert developer knowledge base (tool name on tools/list: `Zephex_dev_info`, capital Z). Curated entries include principles, SQL/TypeScript snippets, checklists, and common mistakes. Always **search** with a precise query, then **get** by the returned slug—two MCP calls, not URL scraping.
When to use
- Implementing auth (OAuth, JWT, Supabase Auth, session cookies, MFA).
- Database design: RLS, Stripe billing tables, chat schemas, connection pooling.
- Security hardening: CSP, HSTS, CORS, OWASP-style API checks.
- Payments and Stripe (webhooks, idempotency, Connect)—use category payments or databases.
- Frontend/backend deployment: Next.js App Router, Bun, Docker, Render, Railway.
- Mobile signing and store release (Android, iOS, Expo) when covered in the KB.
When not to use
- Reading **your repo**—use get_project_context, check_test, find_code, read_code.
- Auditing a **live deployed URL** headers/TLS—use audit_headers.
- Checking if an npm package exists or has CVEs—use check_package (task=check or task=upgrade).
- Mapping **your** codebase architecture—use explain_architecture.
- Scraping arbitrary documentation URLs—this tool only returns curated KB entries.
Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| operation | "search" | "get" | No (default: search) | search → best matching slug; get → full entry for that slug. |
| query | string | Yes for search only | Natural-language question. Omit on get. |
| slug | string | Yes for get only | Exact slug from search (e.g. stripe-webhook-events). |
| category | enum | No | databases | payments | security | frontend | backend | auth | mobile | android — narrows search. |
Limits: KB coverage is finite—rephrase if no match. Daily Zephex_dev_info caps per tier apply (see token note). Not legal/compliance advice. Search returns one best match, not a ranked list.
Try it — copy a prompt
Paste into Cursor, Claude Code, Windsurf, VS Code, or any editor with a hosted MCP connection.
Before you call it
- Zephex API key and hosted MCP in your editor.
- A specific question (e.g. “Supabase RLS multi-tenant SaaS”, not “tell me about databases”).
- Optional **category** when the domain is clear (auth, databases, payments, security, …).
- On zephex.dev the KB service is hosted for you; self-hosted proxies need KB_SERVICE_URL set.
Token and request cost
Search is compact (~100–300 tokens). Full **get** entries are capped around ~1,200 tokens in the KB service. Each MCP call counts as one monthly plan request. Zephex_dev_info also has a **daily** cap per user (rolling 24h): Free 100/day, Pro 500/day, Max 2000/day—in addition to your plan’s total monthly requests.
Example
MCP tools/call
{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "Zephex_dev_info", "arguments": { "operation": "search", "query": "Stripe webhook idempotency postgres deduplication", "category": "payments" } }}Search response
Response shape
{ "slug": "stripe-webhook-events", "title": "Stripe Webhook Event Deduplication Table", "category": "databases", "subcategory": "stripe", "summary": "Stripe retries failed webhook deliveries for up to 72 hours. Without a UNIQUE stripe_event_id ledger, retries can double-charge users.", "importance_score": 95, "related_slugs": ["supabase-rls-policies"]}Step 2 — get full entry
{ "jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": { "name": "Zephex_dev_info", "arguments": { "operation": "get", "slug": "stripe-webhook-events" } }}Get response
{ "slug": "stripe-webhook-events", "title": "Stripe Webhook Event Deduplication Table", "why_this_matters": "Stripe retries failed deliveries for up to 72 hours…", "key_principles": ["Verify signature with constructEvent first", "UNIQUE on stripe_event_id", "Process then insert"], "code_snippets": [{ "title": "PostgreSQL webhook_events table", "language": "sql", "code": "CREATE TABLE webhook_events (…)" }], "checklist": ["constructEvent before branching", "Index stripe_event_id"], "common_mistakes": ["Inserting before processing", "No UNIQUE constraint"], "related_slugs": ["supabase-rls-policies"], "updated_for": "Stripe API + retry behavior through 2026", "token_count": 680}Which Zephex tool when
| Task | Use this tool | Not this tool |
|---|---|---|
| Supabase RLS / auth schema | Zephex_dev_info | read_code alone |
| Read my handler code | read_code | Zephex_dev_info |
| Grade production URL headers | audit_headers | Zephex_dev_info |
| Map my app modules | explain_architecture | Zephex_dev_info |
| CVE on a package upgrade | check_package (task=upgrade) | Zephex_dev_info |
What it can do in your codebase
- Anti-hallucination layer for production auth, payments, and security.
- Search → get workflow: one best slug per search, then a dense article.
- Eight categories: databases, security, frontend, backend, auth, mobile, android, payments.
- common_mistakes lists real shipped failures (webhook insert order, localStorage JWTs, …).
- related_slugs link adjacent topics without extra searches.
- Read-only: never modifies your repository.
Common response fields
Why teams use it
Search then get (required)
Search returns slug + summary only. Get with that slug returns the full entry. Never guess slugs.
Production snippets
SQL and TypeScript tied to documented footguns—not generic blog advice.
Correct MCP name
Call Zephex_dev_info on tools/list. Do not use retired aliases (inspect_url, inspect-url).
Pairs with codebase tools
KB for how to build; check_test + read_code for what your repo actually contains.
What it looks at vs skips
- Curated KB JSON across auth, databases, security, frontend, backend, mobile, payments
- Keyword scoring on search_keywords, titles, summaries, tags
- Structured get: principles, snippets, checklist, mistakes, updated_for
- Your local git tree
- Live URL fetch / browser render
- Package CVE registry scans
- Invented slugs without a prior search
Query mode examples
category: auth
JWT refresh token rotation Next.js
OAuth, sessions, Supabase Auth.
category: payments
stripe webhook idempotency table
Stripe billing + dedup patterns.
category: security
stripe.js CSP frame-src hooks.stripe.com
CSP / payment UI hardening.
Categories (optional search filter)
| Field | Meaning |
|---|---|
| databases | Postgres, Supabase schemas, RLS, pooling, realtime. |
| payments | Stripe webhooks, billing tables, idempotency, Connect. |
| auth | OAuth, JWT, sessions, Supabase Auth, MFA, Auth.js. |
| security | CSP, CORS, OWASP API risks, header hardening. |
| frontend | Next.js App Router, React 19, Tailwind, RSC. |
| backend | Bun, Express, Docker, AWS, Render, Railway. |
| mobile / android | Expo, iOS/Android signing and release. |
How it fits your workflow
- Narrow the question (stack + risk).
- Zephex_dev_info operation=search + query (+ category if obvious).
- Zephex_dev_info operation=get + slug from search (no query needed on get).
- check_test → read_code to apply patterns in your repo.
- audit_headers on deployed URLs when headers/TLS matter.
Troubleshooting
- No search match → rephrase; drop category; use concrete names (Stripe, Supabase, Next.js).
- KB_SERVICE_URL not configured → only on misconfigured self-hosted proxy; zephex.dev should work out of the box.
- 429 rate limited → daily Zephex_dev_info cap (100/500/2000 per 24h by tier); wait for reset or upgrade.
- get 404 → slug must match search exactly; never invent slugs.
- Agent only called once → require search then get (two tool calls minimum).
How to verify it works
- tools/list shows **Zephex_dev_info** (exact name, capital Z).
- search returns a slug, title, and summary (not a full article yet).
- get with that slug returns key_principles, code_snippets, and checklist arrays.
- Response is JSON from the KB service, not HTML from a scraped page.
Common questions
Billing and plan limits: FAQ, usage limits.
What is the MCP tool name—Zephex_dev_info or something else?
Use **Zephex_dev_info** exactly as returned by tools/list (capital Z). Older docs or configs may say inspect_url—that tool was removed. The docs URL is /docs/tools/zephex-dev-info.
How do I stop my agent from hallucinating Supabase or Stripe patterns?
Require search → get before writing auth or payment code. Have the agent quote checklist and common_mistakes from the get response, then read_code your real files.
Do I pass query on the get call?
No. get only needs operation: "get" and slug from search. Passing a query on get is unnecessary.
Can this tool read a documentation URL?
No. Use audit_headers for public URL TLS/header grades. Use read_code for your codebase. Zephex_dev_info only returns KB entries.
What if I see KB_SERVICE_URL not configured?
That message appears when the proxy cannot reach the KB microservice—common on DIY/self-hosted installs. Production zephex.dev should have this configured; check your API key and retry, or contact support.
How is the Zephex_dev_info rate limit different from my monthly 555 requests?
Monthly plan requests (555 on Free) count every tools/call. Zephex_dev_info also has a rolling 24-hour cap: 100/day on Free, 500 on Pro, 2000 on Max—for this tool only.
Shipping to production? audit_headers grades your live URL; Zephex_dev_info supplies the patterns to fix what audit_headers finds.
Billing: Each tool call counts as one request on your Zephex plan (Free includes 555 requests/month). See usage limits for tier details. Usage limits.
Data: Do not put API keys or secrets in search queries. KB text is curated, not your source code. Data use.
audit_headers grades live HTTP; Zephex_dev_info teaches the patterns to fix findings. For your code, read_code.
For AI agents (JSON)
{"tool":"Zephex_dev_info","steps":["search{query,category?}","get{slug}"],"mcp_name":"Zephex_dev_info","pair":["read_code","audit_headers"]}