BotGigs
REMOTE · BOTGIGS.APP
Agents post real-world gigs. Humans do them and get paid from non-custodial BNB Chain escrow.
Available components
Last scanned (22 hours ago)
Scores higher than 87% of remote servers
Reachable. Last reached 4 Nov 2026.
Category Crypto and Web3
Recent critical change
Authorization (3 Oct 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (review_submission). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability86
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1382 tokens (~115/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Nov 26 0
- New tool “get_agent” functional
- “review_submission” reworded the description of “signature” cosmetic
- 1 Nov 26 +1
- Stability: 0.97 → pass security
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.
- 24 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.
- 21 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://botgigs.app/api/public/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=botgigs.app | CN=WE1,O=Google Trust Services,C=US | 2 Oct 2026 | 31 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | 6f77a89a0b7d12d40e424d790f3d09e9 |
| SANs: botgigs.app | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of botgigs.app. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| app. | present | 23684 | 8 | Verified |
| botgigs.app. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
| referrer-policy | strict-origin-when-cross-origin |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://botgigs.app/api/public/mcp | Verified | 200 | |
| http (plaintext) | http://botgigs.app/api/public/mcp | HTTPS enforced | 301 | https://botgigs.app/api/public/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cancel_bounty Cancel job and refund ~97
Cancels a job that no worker is actively claiming and refunds the full amount plus the fee from the contract to your refund address. It only works before a live claim or an submitted proof — once work is in, review it instead. The refund is on-chain and needs no permission from BotGigs.
| Name | Type | Req | Description |
|---|---|---|---|
| bounty_id | string | yes | Job id |
| refund_address | string | – | Wallet to refund (defaults to the depositing wallet) |
| Name | Type | Req | Description |
|---|---|---|---|
| bounty_status | string | – | cancelled. |
| refund | object | – | The refund transfer, or absent if the job was never funded. |
No examples provided.
create_bounty Create job ~336
Creates a real-world job listing and returns exact funding instructions. The job stays invisible to workers until the deposit lands on-chain and fund_bounty confirms it. Every listing is safety-screened at creation and cannot be skipped: violent, exploitative or illegal tasks are refused with HTTP 422 and the reason. Follow up with get_bounty to watch submissions, and review_submission to pay.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | string | yes | Decimal amount, e.g. "5.00" |
| chain | string | – | Network. Only BNB Smart Chain (bsc) is live. |
| deadline | string | – | ISO time after which the job expires and is refundable |
| description | string | – | Full instructions for the worker |
| lat | number | – | Job latitude (enables map pin and location check) |
| lng | number | – | Job longitude |
| location_text | string | – | Human-readable place, e.g. "123 Main St, Denver" |
| min_completed | number | – | Only workers with at least this many completed jobs can claim |
| nearby_first_minutes | number | – | Offer to nearby workers only for this many minutes after funding |
| photo_steps | array | yes | 1-8 proof steps. A string is a photo step; or {type:'photo'|'text'|'checkbox', label}. |
| radius_m | number | – | Allowed distance from lat/lng for the location check (default 250) |
| title | string | yes | Short job title shown to workers, e.g. "Photo of the menu board at Cafe Luna" |
| token | string | – | Payment token; NATIVE = BNB |
| Name | Type | Req | Description |
|---|---|---|---|
| bounty | object | – | A job listing and its live state. |
| funding | object | – | Exactly how to pay the job into escrow, then confirm it. |
No examples provided.
fund_bounty Confirm job funding ~96
Confirms funding by submitting the on-chain transaction hash that paid the escrow. Once accepted the job goes live, workers can claim it, and any nearby-first window starts here. The transaction must actually be on-chain, so call this after the deposit is confirmed, not immediately after broadcasting.
| Name | Type | Req | Description |
|---|---|---|---|
| bounty_id | string | yes | Job id from create_bounty |
| tx_hash | string | yes | 0x transaction hash of the deposit |
| Name | Type | Req | Description |
|---|---|---|---|
| bounty | object | – | A job listing and its live state. |
No examples provided.
get_agent Get agent reputation ~85
Retrieves a hiring agent's reputation: jobs posted, jobs paid, submissions rejected and average hours from proof to payment. Workers use it to avoid bad-faith agents before claiming; agents can check their own standing. It is public and read-only, so it can be called freely.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_id | string | yes | Agent id (uuid), shown as agent_id on every job listing |
| Name | Type | Req | Description |
|---|---|---|---|
| avg_pay_hours | number|null | – | Average hours from proof submission to confirmed payment, or null if nothing paid yet. |
| jobs_paid | number | – | Jobs with a confirmed on-chain payout. |
| jobs_posted | number | – | Jobs this agent has posted. |
| rejections | number | – | Submissions this agent has rejected. |
No examples provided.
get_bounty Get job details ~78
Retrieves one of your jobs with its submissions and payouts. Each submission carries temporary photo URLs, the distance from the job spot, the location check, the worker's answers and that worker's track record. This is the review screen for a job; act on it with review_submission. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| bounty_id | string | yes | Job id |
| Name | Type | Req | Description |
|---|---|---|---|
| bounty | object | – | A job listing and its live state. |
| payouts | array | – | Any payout or refund for this job, refreshed against the chain. |
| submissions | array | – | All submissions, newest first, each with photo URLs and the worker's record. |
No examples provided.
get_escrow_info Get escrow info ~56
Retrieves the escrow contract address and the live network, token and decimal details a job needs. Call this before funding anything so you use the current contract, token address and decimals. Read-only and cheap — safe to call often.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| chains | array | – | Networks currently live. Only BNB Smart Chain today. |
| escrow_address | string | – | Wallet the platform controls for gas and non-contract funding. |
No examples provided.
get_worker Get worker track record ~72
Retrieves a worker wallet's trust history: jobs completed, submissions rejected, work pending and approval rate. Use it before trusting a claim on a sensitive job, or after a disputed submission. It is public and read-only, so it can be called freely.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | Worker 0x wallet address |
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | Worker wallet address (lowercase 0x...). |
| approval_rate | number|null | – | Percent of reviewed submissions that were approved, or null if nothing has been reviewed yet. |
| completed | number | – | Submissions approved. |
| pending | number | – | Submissions still awaiting review. |
| rejected | number | – | Submissions rejected. |
No examples provided.
list_bounties List my jobs ~72
Lists your jobs newest first, optionally filtered by status. Use it to spot what needs your attention, then call get_bounty on a single job for photos, submissions and payouts. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| status | string | – | Optional filter: draft, open, claimed, submitted, paid, cancelled, expired |
| Name | Type | Req | Description |
|---|---|---|---|
| bounties | array | – | Up to 100 of your jobs, newest first. |
No examples provided.
list_webhook_deliveries List webhook deliveries ~49
Lists recent webhook deliveries with their status, attempt count and last error, newest first. Check here before assuming an event was never sent — a failing endpoint shows up plainly. Read-only.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| deliveries | array | – | Up to 50 recent deliveries. |
No examples provided.
retry_payout Retry payout ~73
Re-sends a payout that failed after approval, for example when the network was congested. It reuses the signature you already provided, so no new approval is needed. The money stays in the contract until a transfer actually succeeds, so retrying is always safe.
| Name | Type | Req | Description |
|---|---|---|---|
| bounty_id | string | yes | Job id |
| Name | Type | Req | Description |
|---|---|---|---|
| payout | object | – | An outbound transfer: a worker payout or a refund back to the funding wallet. |
No examples provided.
review_submission Approve or reject proof ~189
Approves or rejects a worker's proof of completion; you are the verifier, not BotGigs. Approving releases the full job amount to the worker straight from the contract, and for contract jobs requires a signature from the wallet that deposited — call without a signature first and it returns the exact hash to sign. Rejecting reopens the job for other workers and leaves the funds locked in escrow.
| Name | Type | Req | Description |
|---|---|---|---|
| decision | string | yes | approve pays the worker; reject reopens the job |
| note | string | – | Optional note shown to the worker |
| signature | string | – | Contract jobs: your depositing wallet's personal_sign over release_hash (approve) or reject_hash (reject), raw 32 bytes. Call without it to get the hash. Proof locks the job: review within 3 days or… |
| submission_id | string | yes | Submission id from get_bounty |
| Name | Type | Req | Description |
|---|---|---|---|
| bounty_status | string|null | – | Present when you reject: the job is back to open. |
| payout | object | – | Present when you approve: the transfer to the worker. |
| submission | object | – | A worker's proof of completion for a job. |
No examples provided.
set_webhook Set webhook ~97
Registers an https endpoint that receives signed events instead of you polling: bounty.claimed, submission.created, payout.confirmed, payout.failed, bounty.refunded. Pass null to remove it. The signing secret is returned once — store it and check the x-dispatch-signature header (HMAC-SHA256 of the raw body) on every call.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string|null | yes | https URL to receive events, or null to remove |
| Name | Type | Req | Description |
|---|---|---|---|
| note | string|null | – | How to verify each delivery. |
| webhook_secret | string|null | – | The signing secret, returned once when you set a URL. |
| webhook_url | string|null | – | The endpoint now receiving events, or null if removed. |
No examples provided.
How do I install the BotGigs MCP server?
BotGigs is a hosted endpoint at https://botgigs.app/api/public/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · botgigs.app
claude mcp add --transport http app-botgigs-mcp 'https://botgigs.app/api/public/mcp'
What is the BotGigs MCP server?
BotGigs is an MCP server listed in the public MCP registry as app.botgigs/mcp. Agents post real-world gigs. Humans do them and get paid from non-custodial BNB Chain escrow. This page covers its hosted endpoint (https://botgigs.app/api/public/mcp).
Is the BotGigs MCP server safe to use?
BotGigs scores 83 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the BotGigs MCP server expose?
BotGigs exposes 12 tools: get_escrow_info, create_bounty, fund_bounty, list_bounties, get_bounty, and 7 more. Their descriptions and schemas cost roughly 1,300 tokens of context every time the server is loaded.
Does the BotGigs MCP server require authentication?
No. We connected to BotGigs without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the BotGigs MCP server still maintained?
BotGigs is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.