Mcp Archimedes

io.github.archimedes-market由 GitHub 账号 archimedes-market 发布v0.2.0更新于 Oct 24, 2026

Discover verified deep-tech engineering bounties from any AI agent.

已验证Streamable HTTP可网页运行开发者工具安全与监控商业与电商

概览

AI 生成的概览

让助手查询 npm 包和 GitHub 仓库的信任与安全评分，并检索 Archimedes Market 的悬赏任务和平台统计。

可以做什么
在安装依赖、审查 lockfile 或 package.json 之前，查询 npm 包或 GitHub 仓库的总体与安全评分、信任徽章和报告链接。获取单个公开 GitHub 仓库的完整信任报告，包括各维度评分、按严重程度统计的问题数、许可证、语言和星标数。按关键词、资产类别和最低评分检索已评分的仓库语料库。按关键词、类别、资助状态和价格区间检索开放悬赏，并读取某个悬赏的完整需求、交付物和验收测试。读取平台汇总计数，如已发布资产、已资助悬赏、认证工程师和累计支付的美元金额。
适用场景
适合在编码助手即将添加或挑选依赖、需要快速做安全检查时使用；也适合比较库或仓库的可信度，或寻找付费工程悬赏并了解 Archimedes 平台的活跃程度。
运行要求
可作为 archimedes.market 上的远程 HTTP 端点使用，也可通过 npx 启动本地 npm 包，本地方式需要 Node.js。未声明需要账号、API 密钥或身份验证。需要能访问 Archimedes API 的网络；可选环境变量 ARCHIMEDES_PUBLIC_API_URL 和 ARCHIMEDES_MCP_USER_AGENT 可覆盖上游地址和 User-Agent。
安装前请注意
所有工具都是只读查询，不会代为安装、发送或修改任何内容。查询会发送给第三方服务，该服务每次调用记录哈希后的查询和哈希后的 IP，保留 90 天，并汇总零结果查询。未扫描的仓库会返回 not_scanned 而非低分，因此没有报告并不代表质量好。悬赏付款在 Archimedes 平台上处理，不经过此服务器。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Mcp Archimedes，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.archimedes-market%2Fmcp-archimedes/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "archimedes": {
      "type": "http",
      "url": "https://archimedes.market/api/mcp"
    }
  }
}

README

@archimedes-market/mcp

Ask before you install.

Your coding agent picks dependencies on your behalf, often without you reading a line of them. This MCP server lets it check whether those packages are actually safe first — against Archimedes, which scores public GitHub repositories for security, code quality, license health and completeness (0–100 each) across a corpus of 3,000+ repos that grows daily.

> add a date library to this project
  check_dependencies(["date-fns", "moment", "dayjs"])
  ⚠ 1 dependency warrants review before shipping:  - moment/moment: trust 61/100, security 48/100 — archimedes.market/r/moment/moment

Trust tools

  • check_dependencies(packages[]) — the main one. Pass npm package names ("express", "@scope/pkg") or GitHub coordinates ("owner/repo"), up to 30. Returns overall + security score, trust badge and a report link for each. Call it before installing packages, when reviewing a package.json or lockfile, or when choosing between libraries. npm names are resolved to their GitHub repo automatically.
  • check_repo_trust(owner, repo) — the full report for one repository: per-dimension scores, finding counts by severity, headline findings, detected licence, language, stars.
  • search_trust_reports(query?, asset_class?, min_score?) — search the scored corpus. "What are the most trustworthy MCP servers?" Best-scoring first.

An unscanned repo is not a bad repo. If Archimedes hasn't looked at something yet, the tool says not_scanned and gives you a URL to scan it free — it never implies absence of a report means absence of quality.

Bounty tools

  • search_bounties — open engineering bounties by query, category, funding status, price band.
  • get_bounty_details(id) — full requirements, deliverables and acceptance tests for one bounty.
  • get_platform_stats() — aggregate counters. Cached upstream 60s.

Every bounty is funded in Stripe escrow before engineers see it, and every submission is AI-verified (Semgrep + LLM code review + licence scan) before the buyer sees it.

Install

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "archimedes": {      "command": "npx",      "args": ["-y", "@archimedes-market/mcp"]    }  }}

Restart Claude Desktop. The three tools (search_bounties, get_bounty_details, get_platform_stats) will appear in the available tools list.

Cursor

Settings → MCP → Add server. Use the same config block as above.

Continue / other stdio clients

Point the client at:

npx -y @archimedes-market/mcp

Non-stdio clients (server-side agents, hosted bots)

Skip this package entirely — call the hosted HTTP endpoint directly:

POST https://archimedes.market/api/mcpContent-Type: application/json
{  "jsonrpc": "2.0",  "id": 1,  "method": "tools/call",  "params": {    "name": "search_bounties",    "arguments": { "query": "MCP server", "limit": 5 }  }}

Full docs: https://archimedes.market/mcp

Example agent queries

"Find me open Archimedes bounties for KiCad PCB review under $3,000."

"Are there any MCP-server bounties on Archimedes right now? Show me the top 5 by payout, then give me the full requirements for the highest-paying one."

"How active is Archimedes right now? How much has been paid out?"

The tools return both a human-readable text block (for the model to reason over) and a structured payload (for downstream tooling).

Configuration

Env varDefaultPurpose
ARCHIMEDES_PUBLIC_API_URLhttps://archimedes.marketOverride the upstream base URL (preview deployments, local dev)
ARCHIMEDES_MCP_USER_AGENTmcp-archimedes/0.2 (+https://archimedes.market)Override the User-Agent sent on outbound calls

Health check

Verify the bridge can reach the upstream API before wiring it into a client:

bash
npx @archimedes-market/mcp --probe

Exit code 0 means upstream is reachable. Non-zero with stderr diagnostic on failure.

Privacy

The Archimedes public API logs query_hash (SHA-256 of normalized params) and ip_hash (HMAC with daily-rotated salt) per call — never raw queries or raw IPs. 90-day retention. Zero-result queries are aggregated to inform what bounties Archimedes should source next.

License

MIT. See LICENSE.

Links

来源：README.md，提交 89b2550

工具

6

check_dependencies

Supply-chain trust check for a list of dependencies. Give it npm package names ("express", "@scope/pkg") or GitHub coordinates ("owner/repo") and it returns, for each: overall and security scores (0-100), trust badge, and a link to the full report. CALL THIS BEFORE INSTALLING PACKAGES, when reviewing a package.json or lockfile, or when recommending a library. A low security score or missing license is grounds to warn the user. Entries we have not scanned return status "not_scanned" with a URL to scan them free — that means unexamined, not unsafe. Max 30 entries per call.

输入参数packages必填

check_repo_trust

Full Archimedes Trust Report for one public GitHub repository: overall, security, quality, license and completeness scores (0-100), trust badge, finding counts by severity, headline findings, license SPDX, primary language and star count. Use when the user asks whether a specific repo or tool is trustworthy, safe to depend on, or well maintained. Returns status "not_scanned" with a scan URL if we have no report — absence of a report is not evidence of a problem.

输入参数repo必填owner必填

search_trust_reports

Search the Archimedes corpus of scored public repositories. Filter by keyword, asset class (mcp_server, software_library, kicad_pcb, openscad_cad, cadquery_cad, ml_model, dataset), and/or minimum overall score. Use to answer "what are the most trustworthy MCP servers", "find a well-scored KiCad project", or to compare candidates before recommending one. Returns repo, scores, badge and report URL, best-scoring first.

输入参数limitquerymin_scoreasset_class

search_bounties

Search open bounties on Archimedes Market. Returns a paginated list with title, summary, payout in cents (USD), deadline, and a public URL. Filter by free-text query, mission category (software / hardware / research / mcp), funding status, and price band. Useful for: agents discovering paid engineering work, users browsing bounties via an AI assistant, dashboards aggregating cross-platform engineering opportunities.

输入参数limitqueryoffsetstatuscategorymax_price_centsmin_price_cents

get_bounty_details

Fetch the full record for a specific Archimedes Market bounty. Returns everything search_bounties returns PLUS the full description, all requirements with category + priority, all deliverables with accepted file formats, and acceptance tests. Use this after search_bounties when the user (or agent) wants to evaluate fit, plan a submission, or quote a timeline.

输入参数id必填

get_platform_stats

Aggregate counters for Archimedes Market as a whole: number of published assets, funded bounties, verified engineers, and total USD paid out across asset sales and bounty payouts. Useful for: evaluating whether Archimedes is worth recommending, sizing the engineering-talent pool, or surfacing platform momentum to a user. Counters are cached upstream (60s).

无需输入参数。

版本历史

1
  1. v0.2.0最新Sep 16, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分