Devin Desktop module

[github-actions[bot]]

A discussion dedicated to the Devin Desktop module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 25	20 / 20	N/A	8 / 10	74 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage, opening in a specific directory, and configuring MCP servers. Each example is complete and demonstrates sensible defaults.
Coder-context framing	8	1	README states "Add a button to open any workspace with a single click in Devin Desktop" and mentions the Coder Remote VS Code Extension, but does not explain what the module adds on top of Coder or show where Coder fits in the flow. Minimal context provided.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference in frontmatter.

IDE Integration — 18 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module wraps vscode-desktop-core which creates a coder_app resource. Tests verify slug, display_name, and proper URL construction. Full coder_app support confirmed.
Managed configuration	6	6	Documented MCP configuration via the mcp input variable. README example shows how to configure MCP servers, and the module writes to ~/.config/devin/mcp_config.json via coder_script.
Configurable folder or workdir	6	5	The folder variable is documented and tested. However, the README example shows usage but doesn't explicitly explain the purpose or behavior of opening in a specific directory beyond the variable name itself. Under-documented.
Pre-installed extensions	6	0	N/A for desktop IDE; this criterion applies only to web IDEs. Scoring 0 as per rubric (not excluded).

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The MCP example uses data.coder_external_auth.github.access_token which is a reference, not an inline secret. No sensitive inputs are defined in the module itself (it passes through to vscode-desktop-core). No inline secrets in examples.
Non-hardcoded auth path	4	4	README demonstrates OAuth via coder_external_auth resource for GitHub authentication in the MCP example, avoiding raw API keys.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only creates coder_app and coder_script resources that write config. No artifacts to mirror.
Bring-your-own binary	5	N/A	Module installs nothing; Devin Desktop is a client application launched via protocol handler.
Egress transparency	3	N/A	Module makes no network calls itself; it configures a client app and writes local config.
Runs without sudo	2	N/A	The coder_script writes to $HOME/.config/devin/mcp_config.json using standard shell commands (mkdir, echo, base64, chmod). No sudo invoked. However, since this is the only script and it verifiably never uses sudo, this would score 2/2 if applicable. Marking N/A per calibration anchor: goes N/A only for modules with no scripts at all. Actually, the module does have a script, so this should be scored. Changing to 2.

Restricted-Environment Readiness — 2 / 2

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only creates coder_app and coder_script resources that write config. No artifacts to mirror.
Bring-your-own binary	5	N/A	Module installs nothing; Devin Desktop is a client application launched via protocol handler.
Egress transparency	3	N/A	Module makes no network calls itself; it configures a client app and writes local config.
Runs without sudo	2	2	The coder_script in main.tf uses only standard shell commands (mkdir, echo, base64, chmod) operating on $HOME. No sudo invoked anywhere. Full credit from code inspection.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions. Defaults are sensible (empty string for folder/mcp, false for open_recent, null for order/group). No validation blocks, but the inputs are simple strings/bools where validation would add little value.
Test coverage	4	2	TypeScript tests in main.test.ts cover URL construction, folder/open_recent behavior, slug/display_name overrides, and MCP config file writing. However, no .tftest.hcl file present for Terraform-native testing. Tests cover end-to-end behavior but lack the Terraform test layer. Half credit.

Overall — 74 / 100

Raw 59 / 80 → round(59 / 80 × 100) = 74

---

Scored against SCORECARD.md on 2026-08-19 with claude-sonnet-4-5.