Mcp Archimedes

io.github.archimedes-marketPublished by GitHub account archimedes-marketv0.2.0Updated Oct 24, 2026

Discover verified deep-tech engineering bounties from any AI agent.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Lets an assistant check the trust and security scores of npm packages and GitHub repos, and search Archimedes Market bounties and platform statistics.

What you can do
Check trust and security scores for npm packages or GitHub repos, with badges and report links, before installing dependencies or reviewing lockfiles and package.json files. Fetch a full trust report for one public GitHub repository, including per-dimension scores, finding counts by severity, licence, language and stars. Search the scored repository corpus by keyword, asset class and minimum score. Search open bounties by query, category, funding status and price band, and read one bounty's full requirements, deliverables and acceptance tests. Read aggregate platform counters such as published assets, funded bounties, verified engineers and total USD paid out.
When to use it
Useful when a coding agent is about to add or choose dependencies and you want a quick safety check, when comparing libraries or repositories for trustworthiness, or when looking for paid engineering bounties and gauging how active the Archimedes platform is.
Requirements
Runs as a remote HTTP endpoint at archimedes.market or as a local npm package started with npx, so Node.js is needed for the local option. No account, API key or authentication is declared. Network access to the Archimedes API is required; optional environment variables ARCHIMEDES_PUBLIC_API_URL and ARCHIMEDES_MCP_USER_AGENT override the upstream URL and User-Agent.
Before you install
All tools are read-only lookups; nothing is installed, sent or changed on your behalf. Queries go to a third-party service, which logs a hashed query and hashed IP per call with 90-day retention and aggregates zero-result queries. An unscanned repository returns not_scanned rather than a poor score, so absence of a report is not evidence of quality. Bounty payouts are handled on the Archimedes platform, not through this server.

Installation

In SourceWeft

  1. Open Mcp Archimedes in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.archimedes-market%2Fmcp-archimedes/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "archimedes": {
      "type": "http",
      "url": "https://archimedes.market/api/mcp"
    }
  }
}

README

@archimedes-market/mcp

Ask before you install.

Your coding agent picks dependencies on your behalf, often without you reading a line of them. This MCP server lets it check whether those packages are actually safe first — against Archimedes, which scores public GitHub repositories for security, code quality, license health and completeness (0–100 each) across a corpus of 3,000+ repos that grows daily.

> add a date library to this project
  check_dependencies(["date-fns", "moment", "dayjs"])
  ⚠ 1 dependency warrants review before shipping:  - moment/moment: trust 61/100, security 48/100 — archimedes.market/r/moment/moment

Trust tools

  • check_dependencies(packages[]) — the main one. Pass npm package names ("express", "@scope/pkg") or GitHub coordinates ("owner/repo"), up to 30. Returns overall + security score, trust badge and a report link for each. Call it before installing packages, when reviewing a package.json or lockfile, or when choosing between libraries. npm names are resolved to their GitHub repo automatically.
  • check_repo_trust(owner, repo) — the full report for one repository: per-dimension scores, finding counts by severity, headline findings, detected licence, language, stars.
  • search_trust_reports(query?, asset_class?, min_score?) — search the scored corpus. "What are the most trustworthy MCP servers?" Best-scoring first.

An unscanned repo is not a bad repo. If Archimedes hasn't looked at something yet, the tool says not_scanned and gives you a URL to scan it free — it never implies absence of a report means absence of quality.

Bounty tools

  • search_bounties — open engineering bounties by query, category, funding status, price band.
  • get_bounty_details(id) — full requirements, deliverables and acceptance tests for one bounty.
  • get_platform_stats() — aggregate counters. Cached upstream 60s.

Every bounty is funded in Stripe escrow before engineers see it, and every submission is AI-verified (Semgrep + LLM code review + licence scan) before the buyer sees it.

Install

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "archimedes": {      "command": "npx",      "args": ["-y", "@archimedes-market/mcp"]    }  }}

Restart Claude Desktop. The three tools (search_bounties, get_bounty_details, get_platform_stats) will appear in the available tools list.

Cursor

Settings → MCP → Add server. Use the same config block as above.

Continue / other stdio clients

Point the client at:

npx -y @archimedes-market/mcp

Non-stdio clients (server-side agents, hosted bots)

Skip this package entirely — call the hosted HTTP endpoint directly:

POST https://archimedes.market/api/mcpContent-Type: application/json
{  "jsonrpc": "2.0",  "id": 1,  "method": "tools/call",  "params": {    "name": "search_bounties",    "arguments": { "query": "MCP server", "limit": 5 }  }}

Full docs: https://archimedes.market/mcp

Example agent queries

"Find me open Archimedes bounties for KiCad PCB review under $3,000."

"Are there any MCP-server bounties on Archimedes right now? Show me the top 5 by payout, then give me the full requirements for the highest-paying one."

"How active is Archimedes right now? How much has been paid out?"

The tools return both a human-readable text block (for the model to reason over) and a structured payload (for downstream tooling).

Configuration

Env varDefaultPurpose
ARCHIMEDES_PUBLIC_API_URLhttps://archimedes.marketOverride the upstream base URL (preview deployments, local dev)
ARCHIMEDES_MCP_USER_AGENTmcp-archimedes/0.2 (+https://archimedes.market)Override the User-Agent sent on outbound calls

Health check

Verify the bridge can reach the upstream API before wiring it into a client:

bash
npx @archimedes-market/mcp --probe

Exit code 0 means upstream is reachable. Non-zero with stderr diagnostic on failure.

Privacy

The Archimedes public API logs query_hash (SHA-256 of normalized params) and ip_hash (HMAC with daily-rotated salt) per call — never raw queries or raw IPs. 90-day retention. Zero-result queries are aggregated to inform what bounties Archimedes should source next.

License

MIT. See LICENSE.

Links

Source: README.md at commit 89b2550

Tools

6

check_dependencies

Supply-chain trust check for a list of dependencies. Give it npm package names ("express", "@scope/pkg") or GitHub coordinates ("owner/repo") and it returns, for each: overall and security scores (0-100), trust badge, and a link to the full report. CALL THIS BEFORE INSTALLING PACKAGES, when reviewing a package.json or lockfile, or when recommending a library. A low security score or missing license is grounds to warn the user. Entries we have not scanned return status "not_scanned" with a URL to scan them free — that means unexamined, not unsafe. Max 30 entries per call.

Parameterspackagesrequired

check_repo_trust

Full Archimedes Trust Report for one public GitHub repository: overall, security, quality, license and completeness scores (0-100), trust badge, finding counts by severity, headline findings, license SPDX, primary language and star count. Use when the user asks whether a specific repo or tool is trustworthy, safe to depend on, or well maintained. Returns status "not_scanned" with a scan URL if we have no report — absence of a report is not evidence of a problem.

Parametersreporequiredownerrequired

search_trust_reports

Search the Archimedes corpus of scored public repositories. Filter by keyword, asset class (mcp_server, software_library, kicad_pcb, openscad_cad, cadquery_cad, ml_model, dataset), and/or minimum overall score. Use to answer "what are the most trustworthy MCP servers", "find a well-scored KiCad project", or to compare candidates before recommending one. Returns repo, scores, badge and report URL, best-scoring first.

Parameterslimitquerymin_scoreasset_class

search_bounties

Search open bounties on Archimedes Market. Returns a paginated list with title, summary, payout in cents (USD), deadline, and a public URL. Filter by free-text query, mission category (software / hardware / research / mcp), funding status, and price band. Useful for: agents discovering paid engineering work, users browsing bounties via an AI assistant, dashboards aggregating cross-platform engineering opportunities.

Parameterslimitqueryoffsetstatuscategorymax_price_centsmin_price_cents

get_bounty_details

Fetch the full record for a specific Archimedes Market bounty. Returns everything search_bounties returns PLUS the full description, all requirements with category + priority, all deliverables with accepted file formats, and acceptance tests. Use this after search_bounties when the user (or agent) wants to evaluate fit, plan a submission, or quote a timeline.

Parametersidrequired

get_platform_stats

Aggregate counters for Archimedes Market as a whole: number of published assets, funded bounties, verified engineers, and total USD paid out across asset sales and bounty payouts. Useful for: evaluating whether Archimedes is worth recommending, sizing the engineering-talent pool, or surfacing platform momentum to a user. Counters are cached upstream (60s).

Takes no parameters.

Version history

1
  1. v0.2.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts