Mcp Archimedes

io.github.archimedes-market由 GitHub 帳號 archimedes-market 發布v0.2.0更新於 Oct 24, 2026

Discover verified deep-tech engineering bounties from any AI agent.

已驗證Streamable HTTP可網頁執行開發者工具安全與監控商業與電商

概覽

AI 產生的概覽

讓助理查詢 npm 套件與 GitHub 儲存庫的信任與安全評分，並搜尋 Archimedes Market 的懸賞任務與平台統計。

可以做什麼
在安裝相依套件、檢視 lockfile 或 package.json 之前，查詢 npm 套件或 GitHub 儲存庫的整體與安全評分、信任徽章和報告連結。取得單一公開 GitHub 儲存庫的完整信任報告，包含各面向評分、依嚴重程度統計的問題數、授權條款、語言與星號數。依關鍵字、資產類別與最低評分搜尋已評分的儲存庫語料庫。依關鍵字、類別、資助狀態與價格區間搜尋開放懸賞，並讀取某個懸賞的完整需求、交付項目與驗收測試。讀取平台彙總計數，例如已發布資產、已資助懸賞、認證工程師與累計支付的美元金額。
適用情境
適合在編碼助理即將新增或挑選相依套件、需要快速做安全檢查時使用；也適合比較套件或儲存庫的可信度，或尋找付費工程懸賞並了解 Archimedes 平台的活躍程度。
執行需求
可作為 archimedes.market 上的遠端 HTTP 端點使用，也可透過 npx 啟動本機 npm 套件，本機方式需要 Node.js。未宣告需要帳號、API 金鑰或身分驗證。需要能存取 Archimedes API 的網路；選用環境變數 ARCHIMEDES_PUBLIC_API_URL 與 ARCHIMEDES_MCP_USER_AGENT 可覆寫上游位址與 User-Agent。
安裝前請注意
所有工具都是唯讀查詢，不會代為安裝、傳送或修改任何內容。查詢會送往第三方服務，該服務每次呼叫記錄雜湊後的查詢與雜湊後的 IP，保留 90 天，並彙總零結果查詢。未掃描的儲存庫會回傳 not_scanned 而非低分，因此沒有報告不代表品質好。懸賞付款在 Archimedes 平台上處理，不經過此伺服器。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Mcp Archimedes，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.archimedes-market%2Fmcp-archimedes/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "archimedes": {
      "type": "http",
      "url": "https://archimedes.market/api/mcp"
    }
  }
}

README

@archimedes-market/mcp

Ask before you install.

Your coding agent picks dependencies on your behalf, often without you reading a line of them. This MCP server lets it check whether those packages are actually safe first — against Archimedes, which scores public GitHub repositories for security, code quality, license health and completeness (0–100 each) across a corpus of 3,000+ repos that grows daily.

> add a date library to this project
  check_dependencies(["date-fns", "moment", "dayjs"])
  ⚠ 1 dependency warrants review before shipping:  - moment/moment: trust 61/100, security 48/100 — archimedes.market/r/moment/moment

Trust tools

  • check_dependencies(packages[]) — the main one. Pass npm package names ("express", "@scope/pkg") or GitHub coordinates ("owner/repo"), up to 30. Returns overall + security score, trust badge and a report link for each. Call it before installing packages, when reviewing a package.json or lockfile, or when choosing between libraries. npm names are resolved to their GitHub repo automatically.
  • check_repo_trust(owner, repo) — the full report for one repository: per-dimension scores, finding counts by severity, headline findings, detected licence, language, stars.
  • search_trust_reports(query?, asset_class?, min_score?) — search the scored corpus. "What are the most trustworthy MCP servers?" Best-scoring first.

An unscanned repo is not a bad repo. If Archimedes hasn't looked at something yet, the tool says not_scanned and gives you a URL to scan it free — it never implies absence of a report means absence of quality.

Bounty tools

  • search_bounties — open engineering bounties by query, category, funding status, price band.
  • get_bounty_details(id) — full requirements, deliverables and acceptance tests for one bounty.
  • get_platform_stats() — aggregate counters. Cached upstream 60s.

Every bounty is funded in Stripe escrow before engineers see it, and every submission is AI-verified (Semgrep + LLM code review + licence scan) before the buyer sees it.

Install

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "archimedes": {      "command": "npx",      "args": ["-y", "@archimedes-market/mcp"]    }  }}

Restart Claude Desktop. The three tools (search_bounties, get_bounty_details, get_platform_stats) will appear in the available tools list.

Cursor

Settings → MCP → Add server. Use the same config block as above.

Continue / other stdio clients

Point the client at:

npx -y @archimedes-market/mcp

Non-stdio clients (server-side agents, hosted bots)

Skip this package entirely — call the hosted HTTP endpoint directly:

POST https://archimedes.market/api/mcpContent-Type: application/json
{  "jsonrpc": "2.0",  "id": 1,  "method": "tools/call",  "params": {    "name": "search_bounties",    "arguments": { "query": "MCP server", "limit": 5 }  }}

Full docs: https://archimedes.market/mcp

Example agent queries

"Find me open Archimedes bounties for KiCad PCB review under $3,000."

"Are there any MCP-server bounties on Archimedes right now? Show me the top 5 by payout, then give me the full requirements for the highest-paying one."

"How active is Archimedes right now? How much has been paid out?"

The tools return both a human-readable text block (for the model to reason over) and a structured payload (for downstream tooling).

Configuration

Env varDefaultPurpose
ARCHIMEDES_PUBLIC_API_URLhttps://archimedes.marketOverride the upstream base URL (preview deployments, local dev)
ARCHIMEDES_MCP_USER_AGENTmcp-archimedes/0.2 (+https://archimedes.market)Override the User-Agent sent on outbound calls

Health check

Verify the bridge can reach the upstream API before wiring it into a client:

bash
npx @archimedes-market/mcp --probe

Exit code 0 means upstream is reachable. Non-zero with stderr diagnostic on failure.

Privacy

The Archimedes public API logs query_hash (SHA-256 of normalized params) and ip_hash (HMAC with daily-rotated salt) per call — never raw queries or raw IPs. 90-day retention. Zero-result queries are aggregated to inform what bounties Archimedes should source next.

License

MIT. See LICENSE.

Links

來源：README.md，提交 89b2550

工具

6

check_dependencies

Supply-chain trust check for a list of dependencies. Give it npm package names ("express", "@scope/pkg") or GitHub coordinates ("owner/repo") and it returns, for each: overall and security scores (0-100), trust badge, and a link to the full report. CALL THIS BEFORE INSTALLING PACKAGES, when reviewing a package.json or lockfile, or when recommending a library. A low security score or missing license is grounds to warn the user. Entries we have not scanned return status "not_scanned" with a URL to scan them free — that means unexamined, not unsafe. Max 30 entries per call.

輸入參數packages必填

check_repo_trust

Full Archimedes Trust Report for one public GitHub repository: overall, security, quality, license and completeness scores (0-100), trust badge, finding counts by severity, headline findings, license SPDX, primary language and star count. Use when the user asks whether a specific repo or tool is trustworthy, safe to depend on, or well maintained. Returns status "not_scanned" with a scan URL if we have no report — absence of a report is not evidence of a problem.

輸入參數repo必填owner必填

search_trust_reports

Search the Archimedes corpus of scored public repositories. Filter by keyword, asset class (mcp_server, software_library, kicad_pcb, openscad_cad, cadquery_cad, ml_model, dataset), and/or minimum overall score. Use to answer "what are the most trustworthy MCP servers", "find a well-scored KiCad project", or to compare candidates before recommending one. Returns repo, scores, badge and report URL, best-scoring first.

輸入參數limitquerymin_scoreasset_class

search_bounties

Search open bounties on Archimedes Market. Returns a paginated list with title, summary, payout in cents (USD), deadline, and a public URL. Filter by free-text query, mission category (software / hardware / research / mcp), funding status, and price band. Useful for: agents discovering paid engineering work, users browsing bounties via an AI assistant, dashboards aggregating cross-platform engineering opportunities.

輸入參數limitqueryoffsetstatuscategorymax_price_centsmin_price_cents

get_bounty_details

Fetch the full record for a specific Archimedes Market bounty. Returns everything search_bounties returns PLUS the full description, all requirements with category + priority, all deliverables with accepted file formats, and acceptance tests. Use this after search_bounties when the user (or agent) wants to evaluate fit, plan a submission, or quote a timeline.

輸入參數id必填

get_platform_stats

Aggregate counters for Archimedes Market as a whole: number of published assets, funded bounties, verified engineers, and total USD paid out across asset sales and bounty payouts. Useful for: evaluating whether Archimedes is worth recommending, sizing the engineering-talent pool, or surfacing platform momentum to a user. Counters are cached upstream (60s).

無需輸入參數。

版本歷史

1
  1. v0.2.0最新Sep 16, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分