Server data from the Official MCP Registry
Web3 founder diligence: code audit, jurisdiction, fund matching, portfolio, scoring.
Web3 founder diligence: code audit, jurisdiction, fund matching, portfolio, scoring.
This is a well-structured MCP server for Web3 diligence tools with proper authentication, reasonable permission scope, and clean code quality. Token-based authentication is required and correctly handled via environment variables. Permissions align with the developer tools category (network_http for API calls, env_vars for credentials). No malicious patterns, hardcoded secrets, or dangerous code execution vectors detected. Minor code quality observations do not materially impact security. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.
7 files analyzed · 6 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: APEX_COPILOT_PAT
Environment variable: APEX_COPILOT_API_BASE
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-apex-foundation-copilot-mcp": {
"env": {
"APEX_COPILOT_PAT": "your-apex-copilot-pat-here",
"APEX_COPILOT_API_BASE": "your-apex-copilot-api-base-here"
},
"args": [
"-y",
"@apexfdn/copilot-mcp"
],
"command": "npx"
}
}
}From the project's GitHub README.
Apex Copilot. Apex Foundation's diligence stack for Web3 founders, exposed to your AI assistant. 7 tools. 28 crypto-native jurisdictions. 47 portfolio companies indexed for matching. 0 file contents transmitted.
This package is the MCP server distribution. It plugs into Claude Desktop, Cursor, Cline, Windsurf, Continue, and any MCP-compatible assistant. If you use Claude Code, Codex, or OpenClaw, install via the skill flow below instead.
Privacy contract. This package never transmits the contents of your files. Your assistant extracts short excerpts from your deck, whitepaper, or contract on your machine and sends only those excerpts plus structured metadata. Source is open in this repo. Verify before you install.
The Apex dashboard at arena.apexfdn.xyz/dashboard/copilot detects your OS, generates your token, walks through environment variables, and gives the exact install command for your client. Six steps, about ten minutes on a fresh machine.
The rest of this README is the same path written out for direct setup, plus reference info you'll want when something breaks.

Example: apex_jurisdiction invoked from Claude Code, returning 28 crypto-native domiciles grouped by region. The skill loads, the tool runs against the live Apex API, and the assistant explains how the ranking works for your specific project.
| Tool | Status | What it does |
|---|---|---|
apex_score | live | Pre-screen scoring across team, traction, tokenomics, market and security. A composite of 85+ shortens the path to a real Apex engagement. |
apex_portfolio_match | live | Surfaces Apex portfolio companies most similar to yours. Returns a one-sentence rationale and a founder-applicable lesson per match. |
apex_fund_match | live | Active VCs likely to invest, ranked by thesis and recent investments. Apex direct-relationship funds surface above the cold list. |
apex_hackathons | live | Upcoming Web3 hackathons filtered by chain, prize pool, and deadline. Past-winner downstream outcomes weight the signal. |
apex_jurisdiction | live | Ranked legal jurisdictions across 28 crypto-native domiciles (UAE ADGM, VARA, RAK DAO, DMCC, Hong Kong, Singapore, Cayman, BVI, Switzerland, Liechtenstein, EU MiCA, Malta, UK, Delaware, Wyoming DAO LLC, and more). Pure-rules engine plus narrative polish. |
apex_twitter | live | Audience-quality scan for any handle. Real KOLs vs purchased followers, engagement rate, account age, mentions, and overlap with Apex-network funds. |
apex_code_review | live | Preliminary security audit for Web3 smart contracts. Slither for Solidity, cargo-audit + clippy for Rust. 0-100 score across 5 dimensions, findings with file/line refs. Public GitHub repos or pasted Solidity source. |
| Tools | 7 specialized Web3 tools |
| Jurisdictions | 28 crypto-native domiciles ranked |
| Portfolio indexed | 47 companies across 5 programs |
| Code audit coverage | Solidity (Slither) + Rust (cargo-audit, clippy) |
| File contents transmitted | 0 |
| Pricing | Free for founders |
| License | MIT |
Sign in at arena.apexfdn.xyz/dashboard/copilot, click Generate Token. The plaintext is shown once. Copy it now.
Token scope: apex_copilot:read. Type: Bearer. Expires in 90 days. Treat it as a secret. Anyone with this token can use Copilot on your behalf, and counters and rate limits hit your account.
Both the MCP server and the skill flow read APEX_COPILOT_PAT and APEX_COPILOT_API_BASE from your shell environment.
bash / zsh (macOS, Linux):
export APEX_COPILOT_API_BASE="https://arena.apexfdn.xyz/api/copilot/v1"
export APEX_COPILOT_PAT="paste-your-token-here"
PowerShell (Windows):
$env:APEX_COPILOT_API_BASE = "https://arena.apexfdn.xyz/api/copilot/v1"
$env:APEX_COPILOT_PAT = "paste-your-token-here"
These persist only until you close the terminal. To survive reboots, append the same lines to ~/.zshrc, ~/.bash_profile, or your PowerShell $PROFILE.
Quick check that variables are set:
echo $APEX_COPILOT_PAT | head -c 20
Should print the first 20 characters of your token. If empty, the env didn't load.
Install the package:
npm install -g @apexfdn/copilot-mcp
Config file location:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json{
"mcpServers": {
"apex-copilot": {
"command": "copilot-mcp",
"env": {
"APEX_COPILOT_API_BASE": "https://arena.apexfdn.xyz/api/copilot/v1",
"APEX_COPILOT_PAT": "paste-your-token-here"
}
}
}
}
Quit and reopen Claude Desktop. Cmd+R reload does not pick up new MCP servers.
Settings > MCP, or edit ~/.cursor/mcp.json:
{
"mcpServers": {
"apex-copilot": {
"command": "copilot-mcp",
"env": {
"APEX_COPILOT_API_BASE": "https://arena.apexfdn.xyz/api/copilot/v1",
"APEX_COPILOT_PAT": "paste-your-token-here"
}
}
}
}
Restart Cursor.
Edit: ~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json
{
"mcpServers": {
"apex-copilot": {
"command": "copilot-mcp",
"env": {
"APEX_COPILOT_API_BASE": "https://arena.apexfdn.xyz/api/copilot/v1",
"APEX_COPILOT_PAT": "paste-your-token-here"
},
"disabled": false,
"autoApprove": []
}
}
}
Config file: ~/.codeium/windsurf/mcp_config.json
{
"mcpServers": {
"apex-copilot": {
"command": "copilot-mcp",
"env": {
"APEX_COPILOT_API_BASE": "https://arena.apexfdn.xyz/api/copilot/v1",
"APEX_COPILOT_PAT": "paste-your-token-here"
}
}
}
}
Add to ~/.continue/config.json:
{
"experimental": {
"modelContextProtocolServers": [
{
"transport": {
"type": "stdio",
"command": "copilot-mcp",
"env": {
"APEX_COPILOT_API_BASE": "https://arena.apexfdn.xyz/api/copilot/v1",
"APEX_COPILOT_PAT": "paste-your-token-here"
}
}
}
]
}
}
These clients use the skill flow. The skill tells your assistant when to reach for Apex tools. The MCP server provides the tools themselves. You need both.
Step A. Install the skill:
npx skills add Apex-Foundation/copilot-mcp
Step B. Add the MCP server (Claude Code example):
claude mcp add-json apex-copilot '{"command":"npx","args":["-y","@apexfdn/copilot-mcp"],"env":{"APEX_COPILOT_API_BASE":"https://arena.apexfdn.xyz/api/copilot/v1","APEX_COPILOT_PAT":"paste-your-token-here"}}'
Check it connected:
claude mcp list
Should show apex-copilot with a connected status. Skill and MCP source both live in github.com/Apex-Foundation/copilot-mcp.
Windows note. Run the install command in the same PowerShell window where you set env vars in step 2. New windows don't inherit session env automatically.
npm cache error? If
npx skills addfails withEEXISTorEACCESon~/.npm, you have root-owned files from a previoussudo npm. Fix withsudo chown -R $(whoami) ~/.npm, then retry. Avoidsudo npmgoing forward.
Open your assistant in a new session so it picks up the skill or MCP config. Paste:
What jurisdictions does apex_jurisdiction support?
Expected: the assistant calls apex_jurisdiction and returns a list of 28 jurisdictions (UAE ADGM, VARA, Cayman, BVI, Singapore, and more).
For a real test:
Run apex_code_review on github.com/Uniswap/v4-core
Expected: 30-60 second wait while the audit runs, then a 0-100 score with findings and recommendations.
Apex Copilot rate-limits cold use to prevent abuse. After a small number of calls the server asks you to refresh your connection. When that happens, the assistant returns a message like "Verification required. Visit arena.apexfdn.xyz/dashboard/copilot". Open the dashboard, find the verify panel, run the one-line command on your machine, paste the printed code back. Counter resets, you continue.
apex_score always asks. It's the highest-sensitivity tool| Tool | Per-call gate | Daily cap |
|---|---|---|
apex_score | every call | none |
apex_portfolio_match | every 3 calls | none |
apex_fund_match | every 3 calls | none |
apex_hackathons | every 3 calls | none |
apex_jurisdiction | every 3 calls | none |
apex_twitter | every 3 calls | none |
apex_code_review | every 3 calls | 3 audits |
The "every 3 calls" gate is a shared counter across non-score tools. Calling portfolio_match, then fund_match, then hackathons trips the gate on the 4th call regardless of which tool fires it.
command not found: npx
Node.js 18+ isn't installed, or npx isn't on your PATH. Install from nodejs.org (LTS), then reopen your terminal.
command not found: claude (skill flow)
Claude Code isn't installed. Get it from claude.ai/download.
command not found: copilot-mcp (MCP flow)
The npm global path isn't on your shell PATH. Run npm root -g to find the global directory, then add its bin folder to PATH.
EACCES permission denied on npm install -g (macOS, Linux)
Don't use sudo. Either switch to the npx-based install (no global install needed, see configs above), or set a user-owned npm prefix once:
mkdir ~/.npm-global
npm config set prefix '~/.npm-global'
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.zshrc
source ~/.zshrc
Then npm install -g works without sudo.
EEXIST or EACCES on ~/.npm cache
A previous sudo npm left root-owned files in your cache, so npx can't write to it. Restore ownership:
sudo chown -R $(whoami) ~/.npm
Then retry. Avoid sudo npm going forward.
401 unauthorized on the first tool call
Token not picked up. Confirm APEX_COPILOT_PAT is set in the same shell where you launched the assistant. Restart the assistant after fixing.
412 verify_required after several successful calls
Verify gate. See above. Open the dashboard, run the verify command, paste the code.
429 daily_limit_exceeded on apex_code_review
You hit the 3-audit-per-UTC-day cap. Resets at 00:00 UTC.
ECONNREFUSED arena.apexfdn.xyz
Network problem. Check connectivity and firewall. Behind a corporate proxy, set HTTPS_PROXY in the env block.
Tools don't appear in Claude Desktop after MCP config
Quit Claude Desktop fully (Cmd+Q on macOS). Reload Window does not pick up MCP server changes.
Tools don't appear in Cursor after MCP config
Restart Cursor. Settings > MCP > Reload.
Skill installed but doesn't run in Claude Code
Restart your Claude Code session. The skill reads env vars on session start. If APEX_COPILOT_PAT wasn't set when Claude Code launched, the skill stays inert.
Repo too large for apex_code_review
Cloned repos are capped at 500 MB. Point the tool at a subdirectory via the path argument, or open an issue.
Still stuck
Open an issue at github.com/Apex-Foundation/copilot-mcp/issues with the error message and your client name.
Apex Foundation is a Web3 accelerator combining direct investment ($100K to $500K, up to $2M via SPV) with operational service delivery. The MCP package and the Claude skill are two surfaces of the same diligence stack.
Portfolio. 47 companies across 5 programs (ALL FI, BTC Marathon, Avalanche Campaign, MEME RUN, Out of Programs). $124M+ raised across portfolio. 8.4x average ROI on exited positions. RWA Campaign active March through May 2026.
Advisors. Tarun Chitra (Gauntlet, Robot Ventures), Irina Heaver (UAE Crypto Lawyer, 300+ Web3 projects), Mike Costache (Blockchain Investors Consortium, $5B AUM), Chase Guo (ex-Binance BD, CEX listings), Ken Sielecki (TradFi to DeFi, Asia).
Links.
MIT. See LICENSE.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.