Bountyverdict MCP Server

BountyVerdict Agent Decision APIs

Seven paid, bounded decision APIs for autonomous coding agents. Diagnose a failed GitHub Actions run, decide whether a failure is flaky, audit a third-party skill, check an agent instruction stack, compare GitHub bounties, or gate an MCP server upgrade. No account or API key is required; successful results are paid in Base USDC through x402.

Install the router that selects the narrowest check and applies its payment safeguards:

npx skills add Mimirs402/bountyverdict --skill route-github-agent-checks -y

GitHub Copilot CLI can install the repository as a plugin without a separate marketplace setup:

copilot plugin install Mimirs402/bountyverdict

That plugin exposes the five task-specific public GitHub, CI, and MCP workflow skills. SkillVerdict and the broad router remain separate least-privilege installs.

Then ask, for example:

• “Why did this public GitHub Actions workflow fail, and what should I do next?”
• “Will this MCP tools/list schema change break my agent after the server upgrade?”

Task-specific skills are the least-privilege path. Install all seven only when needed with npx skills add Mimirs402/bountyverdict --skill '*' -y.

For the six-tool remote MCP surface, install the task-first marketplace adapter directly from its public repository while directory indexing is pending:

npx skills add Mimirs402/bountyverdict-mcp-skill --skill route-github-agent-decisions

That adapter routes GitHub bounty, repository-readiness, GitHub Actions, flaky-retry, and MCP schema-drift requests to one exact tool, keeps SkillVerdict excluded, and uses a coarse source marker without storing prompts, tool arguments, or caller identities. A valid unsigned call is only a free payment preview; an x402-aware client must separately authorize the exact Base USDC amount before receiving a verdict.

MCP-compatible agents can instead connect to the production Streamable HTTP server at https://bountyverdict-agent-production.mimirslab.workers.dev/mcp. It exposes six real paid tools matching the independently distributed products; SkillVerdict remains excluded from this channel. tools/list publishes task-selection boundaries, canonical input patterns, and compact machine-readable success contracts covering each verdict or action and its reuse rule. Invalid input is rejected before payment, while a valid selected tool returns an exact x402 USDC requirement. The canonical official Registry contract is server.json under io.github.Mimirs402/bountyverdict; source, support, and new installs are owned by Mimir's Lab. The payment challenge temporarily also publishes the former handoff-extension key so already-installed clients continue to work during migration.

Use the client-specific llms-install.md guide for Codex, Claude, Gemini, VS Code, Cursor, Cline, and Kilo, or open the HTTPS one-click Cursor MCP installer. A remote MCP connection does not itself provide a wallet: direct automatic settlement requires an x402-aware MCP client, while standard hosts can use the versioned exact-HTTP handoff included in every valid unpaid tool response with a separately authorized x402 wallet.

Agentic Resource Discovery crawlers can ingest the origin-owned ai-catalog.json. It advertises the existing MCP server with six unbranded representative buyer queries for semantic retrieval; catalog fetches are measured separately from tool calls, payments, and purchases.

For the broad CI use case, the crawlable GitHub Actions Failure Diagnosis MCP Server guide compares the root-cause and flaky-retry tools, leads with the source-marked routing-adapter install, and publishes exact prices, free samples, typed outputs, and the mutation boundary.

Inspect before paying

Every product has a free sample, a machine-readable OpenAPI contract, a declared price, and a successful-result service_reuse rule. Invalid inputs and upstream failures are not settled. Start with the agent page, agent-manifest.json, the production openapi.json, or the remote MCP server above.

The bounty samples are captured from real public issues rather than invented fixtures: the single-check sample rejects an assigned, withdrawn, and maintainer-rejected TypeORM bounty, while the portfolio sample refuses to recommend either it or an open but already-assigned Tenstorrent $1,500 bounty. Use the $0.05 single check for one candidate; the fixed $0.40 portfolio is economical for 8–10 candidates or when one ranked, partial-failure-aware response materially simplifies the workflow.

The seven contracts are continuously checked in production. Coinbase Bazaar currently merchant-indexes six resources. Six existing non-SkillVerdict products are also available through exact-schema the402 listings, either per call or through a $1.05 monthly bundle of up to 20 combined requests. Owner-funded proofs are excluded from customer revenue.

For the strongest current buyer-intent fit, inspect the free SkillVerdict sample and the task-specific preflight-agent-skills workflow. It audits the entire commit-pinned public skill directory without executing it; the paid verdict costs $0.06.

HarnessVerdict pins the repository default branch to an immutable commit and audits recognized AGENTS.md, CLAUDE.md, GEMINI.md, Copilot, Cursor, and SKILL.md surfaces without cloning or executing repository code. It reports evidence-linked path, scope, portability, context-budget, skill-frontmatter, and secret-like-material findings.

SkillVerdict pins and statically scans a requested public skill directory without executing it. It combines high-confidence dangerous-pattern checks with repository context, capability disclosure, external-domain inventory, secret redaction, and explicit coverage to reduce both missed supply-chain hazards and naive false positives.

RunVerdict reads exact-attempt job metadata and bounded failed-job logs without executing or rerunning code. It separates primary failures from aggregate-result jobs, redacts secret-like excerpts, classifies root-cause families, and recommends whether to fix, investigate, wait, or retry.

FlakeVerdict compares a completed public GitHub Actions failure with other attempts of the same run, same-commit outcomes, and up to 12 earlier comparable workflow runs. It scans at most 8 selected failed-job logs and 4 MiB of log data, never executes repository code, and never triggers, reruns, cancels, approves, or otherwise mutates CI. Its six typed outcomes are CONFIRMED_FLAKE, LIKELY_FLAKE, RECURRING_FAILURE, NEW_FAILURE, INCONCLUSIVE, and NOT_FAILED; only a current CONFIRMED_FLAKE can recommend one retry.

Agents can inspect the free FlakeVerdict sample and use the guarded classify-github-flakes skill. Every successful result carries this reuse rule: call FlakeVerdict for every completed public GitHub Actions failure before spending a retry; reuse the result only for its exact run ID and attempt, and call again after a new attempt appears.

MCPDriftVerdict accepts two complete inline MCP 2025-11-25 tools/list snapshots, canonicalizes and hashes them, proves only a conservative JSON Schema 2020-12 compatibility subset, reverses variance for outputs, and flags tool removals, model-facing metadata changes, task-mode breaks, and declared safety-hint regressions. It validates and computes the whole verdict before x402 settlement and never connects to an MCP server, fetches catalog URLs, invokes tools, or follows catalog instructions. Agents can inspect the free sample and guarded check-mcp-tool-drift skill.

See agent/README.md for the protocol, local verification, and deployment configuration.

The launch prices and differentiation are grounded in a live Bazaar comparison documented in docs/MARKET_VALIDATION.md. Agents and crawlers can read llms.txt before deciding whether a product is relevant.

Review the public security policy and privacy/data-handling disclosure before submitting data or authorizing payment. Vulnerabilities can be reported privately through GitHub without opening a public issue.

Free human bounty checker

Visit BountyVerdict and paste a public GitHub issue URL. The browser makes read-only requests directly to GitHub's public API without an account, backend, analytics, or data storage. It checks canonical/transferred issue state, assignments, explicit soft locks, trusted Algora status, reward provenance, rewarded labels, competing pull requests, failed-attempt swarms, maintainer rejection, and reward-withdrawal language. Every important result links to public evidence; no result guarantees a reward, acceptance, merge, or payment.

Run locally

npm run serve

Open http://localhost:4174.

Test

npm test

Method and limits

The score is deliberately conservative and deterministic. BountyVerdict reads the first comment page plus up to two newest comment pages, and up to four bounded timeline pages. It reports total/scanned counts and truncation, and truncated evidence can never produce a VIABLE verdict. Anonymous GitHub API rate limits apply.

Treat a VIABLE verdict as permission to investigate further—not permission to start coding. Reproduce the issue, read contribution and AI-use policies, confirm reward terms and payout eligibility, and establish acceptance criteria first.

License

MIT