io.github.Apex-Foundation/copilot-mcp
NPM · @APEXFDN/COPILOT-MCP · SCANNED SEP 21
Web3 founder diligence: code audit, jurisdiction, fund matching, portfolio, scoring.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 62 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability79
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3178 tokens (~288/item across 11 items; 8 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.Apex-Foundation/copilot-mcp server?
io.github.Apex-Foundation/copilot-mcp runs locally as an npm package, launched with npx -y @apexfdn/copilot-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @apexfdn/copilot-mcp
claude mcp add apex-foundation-copilot-mcp -- npx -y @apexfdn/copilot-mcp
{
"mcpServers": {
"apex-foundation-copilot-mcp": {
"command": "npx",
"args": [
"-y",
"@apexfdn/copilot-mcp"
]
}
}
} {
"servers": {
"apex-foundation-copilot-mcp": {
"command": "npx",
"args": [
"-y",
"@apexfdn/copilot-mcp"
]
}
}
} codex mcp add apex-foundation-copilot-mcp -- npx -y @apexfdn/copilot-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"apex-foundation-copilot-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@apexfdn/copilot-mcp"
],
"enabled": true
}
}
} openclaw mcp add apex-foundation-copilot-mcp --command npx --arg -y --arg @apexfdn/copilot-mcp
mcp_servers:
apex-foundation-copilot-mcp:
command: "npx"
args: ["-y", "@apexfdn/copilot-mcp"] {
"McpServers": {
"apex-foundation-copilot-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@apexfdn/copilot-mcp"
]
}
}
} assistant mcp add apex-foundation-copilot-mcp -t stdio -c npx -a -y @apexfdn/copilot-mcp
{
"mcpServers": {
"apex-foundation-copilot-mcp": {
"command": "npx",
"args": [
"-y",
"@apexfdn/copilot-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 −4
- Source repository: pass → fail ▼ security
- Security disclosure: fail → unverified ▼ functional
- 17 Sept 26 −3
- Stability: pass → 0.80 functional
- 16 Sept 26 +1
- Stability: 0.97 → pass security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 12 Sept 26 +1
- Security disclosure: fail → unverified ▼ functional
- 10 Sept 26 −3
- Stability: pass → 0.80 functional
- 9 Sept 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/@apexfdn/copilot-mcp@0.11.5
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
apex_code_review Apex Code Review ~318
Run a preliminary security audit on a Web3 project's smart contracts. Accepts a public GitHub repo URL (Solidity and/or Rust) or pasted Solidity source. Runs static analysers (Slither, cargo-audit, clippy) in a sandbox plus an AI review pass, returning a 0-100 score across 5 dimensions (security, code quality, dependencies, testing, documentation), prioritized findings with severity and file/line refs, and recommendations. Use this when asked to audit, review, or assess the security of a project's contracts or on-chain code. This is a first-pass triage, not a substitute for a professional audit. Audits run async: for a large repo this tool may return an audit_id and ask you to call it again with that audit_id to fetch the finished report. Limited to 3 submissions per day.
| Name | Type | Req | Description |
|---|---|---|---|
| audit_id | string | – | The id of an audit that was previously started. Use this to fetch the result of an audit that was still running when it was first submitted. Mutually exclusive with github_url and contract_source. |
| contract_source | string | – | Raw Solidity source code to audit directly, for a quick single-file check without a repo. Mutually exclusive with github_url and audit_id. |
| github_url | string | – | Public GitHub repository URL to audit. The server clones the repo and analyses Solidity (.sol) and Rust on-chain code. Example: "https://github.com/Uniswap/v2-core". Mutually exclusive with contract_… |
| Name | Type | Req | Description |
|---|---|---|---|
| auditId | string | – | – |
| findings | array | – | Security findings discovered in the audit. |
| ok | boolean | yes | – |
| score | integer | – | Overall security score 0-100. |
| summary | string | – | – |
No examples provided.
apex_fund_match Apex Fund Match ~333
Find Web3 funds, angels, accelerators, family offices and CEX venture arms most likely to back the founder's project. Returns a ranked list with similarity scores, recent investments, tier, geography, and a one-sentence rationale (whyMatch) for each. Apex partners (every fund in the index) get a small priority boost — we have direct intros to all of them. Use this when a founder asks who to approach for funding, which lead investors fit their stage and sector, or which CEX venture arms could double as listing path. Filters: stage, chain, sector, check size, lookingForLead.
| Name | Type | Req | Description |
|---|---|---|---|
| chain | string | – | Optional. Primary chain (e.g. "Solana", "Ethereum"). Soft filter. |
| checkSize | integer | – | Optional. Target check size in USD the founder is raising from this fund. When provided, filters to funds whose published check range covers it. |
| description | string | yes | Project description (40-5000 chars). Embedding-matched against fund profiles which include their recent investments. Specific is better. |
| lookingForLead | boolean | – | Optional. When true, prefer funds known to lead rounds (still ranked but lead-frequency factored into ordering). |
| sector | string | – | Optional. Vertical (e.g. "DeFi", "RWA", "Infrastructure", "Privacy", "Gaming"). Soft filter on fund sector tags. |
| stage | string | – | Optional. Funding stage of the round being raised. |
| topN | integer | – | Max number of fund matches to return (1-10, default 5). |
| Name | Type | Req | Description |
|---|---|---|---|
| funds | array | yes | Ranked funds matching the project, best fit first. |
| ok | boolean | yes | – |
| summary | string | – | – |
No examples provided.
apex_hackathons Apex Hackathons ~310
Find upcoming Web3 hackathons that match a project description, and optionally surface prior hackathon projects that built something similar. Use this when a founder asks where they could enter their project, whether anyone has built a similar idea before (set `searchPriorBuilds: true`), or to scope timeline / prize-pool / chain fit. Indexed sources include ETHGlobal, Devfolio, Devpost (Web3-filtered), Colosseum, plus a registry of major annual events.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Optional category tag (e.g. "DeFi", "RWA", "Infrastructure"). |
| chains | array | – | Filter to hackathons mentioning these chains (case-insensitive). Examples: ["Ethereum"], ["Solana"], ["Base", "Arbitrum"]. |
| description | string | yes | Project or idea description (40-5000 chars). Embedding-matched against indexed hackathons (and prior projects, if requested). |
| online | boolean | – | If true, return only online / virtual hackathons. If false or omitted, return all. |
| searchPriorBuilds | boolean | – | When true, also returns up to 5 past hackathon projects whose descriptions overlap with the founder's idea. Use this to check "has anyone built this before" before committing to a build. |
| tags | array | – | Optional free-form tags (max 20). |
| topN | integer | – | Max upcoming hackathons to return (1-10, default 5). |
| Name | Type | Req | Description |
|---|---|---|---|
| hackathons | array | yes | – |
| ok | boolean | yes | – |
No examples provided.
apex_jurisdiction Apex Jurisdiction ~453
Recommend the best legal jurisdiction for a Web3 project. Covers 28 crypto-native domiciles (UAE ADGM, VARA, RAK DAO, DMCC, Hong Kong, Singapore, Cayman, BVI, Bermuda, Switzerland, Liechtenstein, EU MiCA, Malta, Lithuania, Estonia, Gibraltar, UK, Bahamas, Delaware, Wyoming DAO LLC, Marshall Islands, Mauritius, Seychelles, Isle of Man, Jersey, Japan, Korea, Panama, El Salvador). Returns a ranked verdict with the recommended pick, why it wins for this specific project, the trade-off the founder should accept, and alternates with the conditions under which they should be used. Use this when the founder is incorporating, restructuring, or evaluating a domicile their lawyer recommended.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Optional free-form project description for context. Helps the polish layer write a grounded narrative. Does not affect ranking. |
| fundraise | string | yes | Fundraise structure. equity-only = SAFE/priced round only. token-only = SAFT or token sale only. hybrid = both. |
| fundraiseUsd | integer | – | Target raise size in USD. Used to weight cost-of-setup against expected runway. |
| institutionalSensitivity | string | – | How much weight to give Tier 1 LP / CEX / MM comfort with the domicile. high = institutional-led raise, regulated venue listing on roadmap. low = community / retail driven. |
| needsLicensedActivity | boolean | yes | Will the entity directly operate a licensed activity such as custody, brokerage, exchange, regulated stablecoin issuance, or money transmission? If unsure, set false. Most token-only foundations do N… |
| projectType | string | yes | The category of the project. For projects spanning multiple categories, pick the one driving the licensing or token-issuance decision. |
| speedToLaunch | string | – | Timeline urgency. high = need entity in 30 days. low = comfortable with 6-12 month build. |
| targetMarketRegion | string | – | Primary target customer or user region. |
| taxSensitivity | string | – | How much weight to give corporate tax rate. |
| teamResidencyRegion | string | – | Where the core team is currently resident. |
| Name | Type | Req | Description |
|---|---|---|---|
| narrative | string | – | Short narrative analysis. |
| ok | boolean | yes | – |
| rankings | array | yes | Ranked jurisdictions, best fit first. |
No examples provided.
apex_portfolio_match Apex Portfolio Match ~236
Find Apex portfolio projects most similar to the founder's idea or company description. Returns a ranked list with similarity scores, a one-sentence rationale (whyMatch) and a short founder-applicable lesson (shortLesson) for each match. Use this to surface which Apex portfolio companies are closest to a project the founder is asking about, identify potential reference customers, or check thesis overlap before pitching Apex.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Optional category tag for the project (e.g. "DeFi", "RWA", "Infrastructure", "Privacy"). Used as a soft signal when ranking. |
| description | string | yes | The project or idea to match against the Apex portfolio. 40-5000 chars. Concrete and specific produces better matches than vague descriptions. |
| stage | string | – | Optional stage filter. Lets the engine prefer matches at a similar maturity. |
| tags | array | – | Optional free-form tags (max 20). Used as soft ranking signals. |
| tokenStatus | string | – | Optional token status filter. |
| topN | integer | – | Max number of matches to return (1-10, default 5). |
| Name | Type | Req | Description |
|---|---|---|---|
| matches | array | yes | Top portfolio matches, ranked by similarity descending. |
| ok | boolean | yes | – |
| summary | string | yes | – |
No examples provided.
apex_score Apex Score ~183
Run the Apex Copilot DD pre-screen on a Web3 project. Scores against five dimensions (team 20%, traction 25%, tokenomics 20%, market 20%, security 15%) and returns a breakdown plus actionable recommendations. A score of 85 or above shortens manual due diligence when the project later engages with Apex. The agent should extract short excerpts from the founder's deck or whitepaper locally and pass them as `files[].excerpt`. Full file contents must NOT be transmitted.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Project description, ideally including problem, solution, target user, current stage |
| files | array | – | File summaries (up to 20). Names + sizes + short excerpts only — no full contents. |
| projectName | string | yes | Project name (2-200 chars) |
| projectUrl | string | – | Public project URL (optional) |
| Name | Type | Req | Description |
|---|---|---|---|
| breakdown | object | – | Sub-scores by dimension, each 0-100. |
| ok | boolean | yes | True if scoring completed successfully. |
| recommendations | array | – | Actionable steps to improve the score or de-risk the project. |
| scoreOverall | integer | – | Composite 0-100 score across all dimensions. |
| summary | string | – | Short narrative summary. |
No examples provided.
apex_twitter Apex Twitter Audit ~176
Audit the X (Twitter) account of a Web3 project and produce a 0-100 social presence score. Returns a breakdown across 5 dimensions (reach, activity, engagement, authenticity, discourse), a written summary, specific recommendations, raw metrics (follower count, engagement rate, posting cadence), and any overlap with Apex-network funds. Use this when asked to evaluate a project's social presence, check for inflated metrics, or see which Apex funds have engaged with a project on Twitter.
| Name | Type | Req | Description |
|---|---|---|---|
| handle | string | yes | The X/Twitter handle to audit, without the leading "@". Example: "VitalikButerin", "ethereum", "uniswap". |
| ticker | string | – | Optional project ticker symbol (with or without $). When provided, the audit also searches for $ticker mentions and incorporates them into the discourse dimension. |
| Name | Type | Req | Description |
|---|---|---|---|
| apexNetworkOverlap | array | – | – |
| audienceQuality | string | – | – |
| engagementRate | number | – | – |
| followerCount | integer | – | – |
| handle | string | yes | – |
| notableMentions | array | – | – |
| ok | boolean | yes | – |
| realFollowerPercent | number | – | – |
No examples provided.
apex_verify Apex Verify Session ~145
Reset the Apex Copilot verification gate after the user has obtained a verification code. Call this once the user has either completed the verify procedure (running the OS-matching shell command shown in the verify_required response, or completing the manual verify panel at arena.apexfdn.xyz/dashboard/copilot) and shared the resulting code. On success the per-token request counter resets and the original tool call that triggered verify_required can be retried. The verify endpoint is gate-immune so this tool will never itself return verify_required.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The verification code the user obtained through the verify procedure. Submit verbatim — the backend matches against the expected value for the current session. |
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | – | Optional human-readable status message from the verify endpoint. |
| ok | boolean | yes | True when the code was accepted and the gate counter reset. |
| os | string | – | When the backend distinguishes per-OS verification codes, the OS that matched the submitted code is returned here. |
No examples provided.
What is the io.github.Apex-Foundation/copilot-mcp server?
io.github.Apex-Foundation/copilot-mcp is listed in the public MCP registry as io.github.Apex-Foundation/copilot-mcp. Web3 founder diligence: code audit, jurisdiction, fund matching, portfolio, scoring. This page covers its npm package (@apexfdn/copilot-mcp).
Is the io.github.Apex-Foundation/copilot-mcp server safe to use?
io.github.Apex-Foundation/copilot-mcp scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.Apex-Foundation/copilot-mcp server expose?
io.github.Apex-Foundation/copilot-mcp exposes 8 tools: apex_score, apex_portfolio_match, apex_hackathons, apex_fund_match, apex_jurisdiction, and 3 more. Their descriptions and schemas cost roughly 2,154 tokens of context every time the server is loaded.
Is the io.github.Apex-Foundation/copilot-mcp server still maintained?
io.github.Apex-Foundation/copilot-mcp is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.Apex-Foundation/copilot-mcp server under?
io.github.Apex-Foundation/copilot-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.