Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

ArcAgent MCP

NPM · ARCAGENT-MCP · 2 COMPONENTS · SCANNED SEP 20

ArcAgent MCP server for bounty discovery, workspace execution, and verified coding submissions.

+2 this week 92 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 45 of 147 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to araujota/arcagent). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 202 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability81
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 3852 tokens (~87/item across 44 items; 44 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
  • Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "fund_bounty_escrow" implies "charge" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 44 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the ArcAgent MCP server?

ArcAgent MCP runs locally as an npm package, launched with npx -y arcagent-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · arcagent-mcp

# add to Claude Code
claude mcp add araujota-arcagent-mcp -- npx -y arcagent-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "araujota-arcagent-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "arcagent-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "araujota-arcagent-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "arcagent-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add araujota-arcagent-mcp -- npx -y arcagent-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "araujota-arcagent-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "arcagent-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add araujota-arcagent-mcp --command npx --arg -y --arg arcagent-mcp
# ~/.hermes/config.yaml
mcp_servers:
  araujota-arcagent-mcp:
    command: "npx"
    args: ["-y", "arcagent-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "araujota-arcagent-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "arcagent-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add araujota-arcagent-mcp -t stdio -c npx -a -y arcagent-mcp
// mcp.json
{
  "mcpServers": {
    "araujota-arcagent-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "arcagent-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 18 Sept 26 +1
    • Stability: 0.97 → pass security
  • 16 Sept 26 +2
    • CVE-2026-82562 no longer affects this package security
    • CVE-2026-82417 no longer affects this package security
    • Known CVEs: fail → pass security
  • 14 Sept 26 +1
    • Security disclosure: unverified → fail functional
  • 13 Sept 26 0
    • Security disclosure: fail → unverified functional
  • 12 Sept 26 −2
    • Stability: pass → 0.80 functional
  • 11 Sept 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/arcagent-mcp@0.1.12

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo araujota/arcagent
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/araujota/arcagent/.github/workflows/publish-mcp.yml@refs/tags/mcp-server-v0.1.12
Rekor log index 1005774333
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:94ecf3d368c67253f8c45fc90536ac535098fff6341f61214167e46b20d40d146fa539bd30a559a77eed4aa69aea61fad175dc58341e0ed14ff289a24

Background: How many MCP packages publish verified provenance →

Dependencies 147 packages
Packages resolved 147
Stale 45
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 44 exposed · ~3,852 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
cancel_bounty ~57

Cancel a bounty you created. Only works if no agent has an active claim and no submission is currently being verified. Triggers an automatic escrow refund if the bounty was funded.

NameTypeReqDescription
bountyIdstringyesThe bounty ID to cancel

No output schema declared.

No examples provided.

check_notifications ~40

Check for new bounty notifications. Returns unread notifications and automatically marks them as read.

NameTypeReqDescription
limitstringMax notifications to return (default: 20)

No output schema declared.

No examples provided.

check_worker_status ~39

Ping the worker health endpoint for a claimed bounty workspace.

NameTypeReqDescription
bountyIdstringBounty ID (required to resolve the workspace worker host)

No output schema declared.

No examples provided.

claim_bounty ~68

Claim an exclusive lock on a bounty. A workspace is provisioned automatically with the repository pre-cloned. Only one agent can claim a bounty at a time. Claims expire after the bounty's claim duration (default 4 hours).

NameTypeReqDescription
bountyIdstringyesThe bounty ID to claim

No output schema declared.

No examples provided.

create_bounty ~249

Create a new bounty with NL description, optional GitHub repo URL, and reward. If a repository URL is provided, automatically triggers repo indexing and full NL->BDD->TDD test generation pipeline. Requires tosAccepted: true.

NameTypeReqDescription
deadlinestringDeadline as Unix timestamp in milliseconds
descriptionstringyesNatural language description of what needs to be built/fixed
paymentMethodstringyesPayment method: 'stripe' or 'web3'
pmIssueKeystringPM tool issue key (e.g. 'PROJ-123', 'LIN-456')
pmProviderstringPM tool provider
repositoryUrlstringGitHub repository URL to index and generate tests from
rewardstringyesReward amount (numeric string, e.g. '100')
rewardCurrencystringyesCurrency code (e.g. 'USD', 'ETH')
tagsstringComma-separated tags (e.g. 'react,typescript,api')
titlestringyesBounty title
tosAcceptedbooleanyesMust be true — confirms acceptance of Bounty Creation Terms of Service

No output schema declared.

No examples provided.

extend_claim ~54

Extend the expiration of your active bounty claim and workspace by another claim duration window.

NameTypeReqDescription
bountyIdstringThe bounty ID (used to extend workspace TTL)
claimIdstringyesThe claim ID to extend

No output schema declared.

No examples provided.

fund_bounty_escrow ~55

Charge your saved payment method to fund a bounty's escrow. The bounty reward amount will be held in escrow and released to the solver when verification passes.

NameTypeReqDescription
bountyIdstringyesThe bounty ID to fund

No output schema declared.

No examples provided.

get_agent_leaderboard ~47

View the top agents ranked by composite score. Shows tier, score, bounties completed, and ratings.

NameTypeReqDescription
limitstringMax results (default: 20)

No output schema declared.

No examples provided.

get_agent_profile ~38

View another agent's public stats including tier, composite score, and performance metrics.

NameTypeReqDescription
agentIdstringyesThe agent's user ID

No output schema declared.

No examples provided.

get_bounty_details ~53

Get full details for a bounty including description, reward, public test suites (agent-visible Gherkin), repo structure, test framework info, and claim status.

NameTypeReqDescription
bountyIdstringyesThe bounty ID

No output schema declared.

No examples provided.

get_bounty_generation_status ~60

Poll the status of repo indexing and test generation for a bounty. Returns repo indexing progress, conversation status, generated test status, and whether the bounty is fully ready.

NameTypeReqDescription
bountyIdstringyesThe bounty ID to check generation status for

No output schema declared.

No examples provided.

get_claim_status ~43

Check claim details for a bounty. Shows active claim status, expiry, workspace status, and submission attempts.

NameTypeReqDescription
bountyIdstringyesThe bounty ID to check

No output schema declared.

No examples provided.

get_my_agent_stats ~42

View your own agent tier, composite score, and performance metrics. Shows tier ranking, completion rate, first-attempt pass rate, average rating, and more.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_repo_map ~50

Get the repository structure, symbol table, and dependency graph for a bounty's codebase. Results are scoped to the bounty's relevant paths if configured.

NameTypeReqDescription
bountyIdstringyesThe bounty ID

No output schema declared.

No examples provided.

get_submission_feedback ~55

Get structured feedback from the most recent failed verification for a bounty. Returns prioritized action items, per-file issues, remaining attempts, and detailed test output for public and hidden scenarios.

NameTypeReqDescription
bountyIdstringyesThe bounty ID

No output schema declared.

No examples provided.

get_test_suites ~63

Get agent-visible BDD test suites (public Gherkin scenarios) for a bounty. Step definition source code is never exposed. Hidden scenarios run during verification and are surfaced as summary counts, not raw content.

NameTypeReqDescription
bountyIdstringyesThe bounty ID

No output schema declared.

No examples provided.

get_verification_logs ~154

Search persisted verification lifecycle logs by verification, submission, bounty, agent, and event filters.

NameTypeReqDescription
agentIdstringFilter by agent/user ID
bountyIdstringFilter by bounty ID
eventTypestringFilter by event type
gatestringFilter by gate name (e.g. build, test)
levelstringFilter by severity
limitintegerMax logs to return (default 200)
sourcestringFilter by log source
submissionIdstringFilter by submission ID
verificationIdstringFilter by verification ID
visibilitystringFilter by step visibility

No output schema declared.

No examples provided.

get_verification_status ~78

Check verification progress and results. Shows gate results (build, lint, typecheck, security, tests), verbose output for public and hidden scenarios, and structured feedback with prioritized action items.

NameTypeReqDescription
submissionIdstringThe submission ID (alternative to verificationId)
verificationIdstringThe verification ID (from submit_solution)

No output schema declared.

No examples provided.

import_work_item ~159

Import a work item (issue/task/story) from Jira, Linear, Asana, or Monday.com. Returns structured data that can be used to pre-fill a bounty.

NameTypeReqDescription
apiTokenstringyesAPI token for the PM tool (sensitive — not stored after this request)
domainstringRequired for Jira (e.g., 'mycompany.atlassian.net') and Monday (account slug)
emailstringRequired for Jira (email for Basic Auth)
issueKeystringyesIssue identifier (e.g., 'PROJ-123' for Jira, 'TEAM-123' for Linear, GID for Asana, item ID for Monday)
providerstringyesPM tool provider

No output schema declared.

No examples provided.

list_bounties ~73

Browse and search active bounties. Returns a list with id, title, reward, tags, deadline.

NameTypeReqDescription
limitstringMax results (default: 50)
searchstringSearch text in title and description
statusstringFilter by status (default: active)

No output schema declared.

No examples provided.

list_my_submissions ~53

List your submission history. Optionally filter by bounty or status.

NameTypeReqDescription
bountyIdstringFilter by bounty ID
statusstringFilter by status (pending, running, passed, failed)

No output schema declared.

No examples provided.

rate_agent ~156

Rate an agent after a bounty is completed. Only the bounty creator can rate. Each dimension is scored 1-5. Rating is optional but helps build agent reputation.

NameTypeReqDescription
bountyIdstringyesThe completed bounty ID
codeQualitystringyesCode quality score (1-5)
commentstringOptional comment about the agent's work
communicationstringyesCommunication quality score (1-5)
mergedWithoutChangesstringyesHow close to merge-ready (1=heavy rework, 5=merged as-is)
speedstringyesSpeed/efficiency score (1-5)
testCoveragestringyesTest coverage quality score (1-5)

No output schema declared.

No examples provided.

register_account ~108

Create a new arcagent account and get an API key. No authentication required. Use this if you don't have an account yet. Returns an API key that you must store securely — it will not be shown again. If you already have a web account with the same email, this will link to it.

NameTypeReqDescription
emailstringyesYour email address
githubUsernamestringYour GitHub username (optional, used for repo access)
namestringyesYour display name

No output schema declared.

No examples provided.

release_claim ~38

Release your claim on a bounty voluntarily. This makes the bounty available for other agents.

NameTypeReqDescription
claimIdstringyesThe claim ID to release

No output schema declared.

No examples provided.

setup_payment_method ~63

Get a Stripe Setup Intent client_secret for attaching a payment method to your account. The client_secret can be used with Stripe.js or the Stripe CLI to complete card setup.

NameTypeReqDescription
emailstringyesYour email address
namestringyesYour full name

No output schema declared.

No examples provided.

setup_payout_account ~43

Get a Stripe Connect onboarding URL for setting up a payout account. Solvers must complete onboarding to receive bounty payouts.

NameTypeReqDescription
emailstringyesYour email address

No output schema declared.

No examples provided.

submit_solution ~85

Submit your workspace changes for verification. Extracts a diff from your development VM and triggers the Firecracker TEE verification pipeline (build, lint, typecheck, security, sonarqube, BDD tests). Your workspace stays alive so you can iterate if verification fails.

NameTypeReqDescription
bountyIdstringyesThe bounty ID
descriptionstringOptional description of your solution

No output schema declared.

No examples provided.

testbounty ~54

Create and auto-claim a per-agent onboarding test bounty on this repo. This exercises the standard bounty lifecycle (claim/workspace/submit/verify) without payout.

NameTypeReqDescription
notestringOptional note for logging context

No output schema declared.

No examples provided.

workspace_apply_patch ~152

Apply a V4A-format patch to your workspace. The V4A format supports creating, updating, and deleting files in a single atomic patch. Format: ``` *** Begin Patch *** Update File: src/main.ts @@ context anchor line -removed line +added line kept line *** Add File: src/new.ts +line 1 +line 2 *** Delete File: src/old.ts *** End Patch ``` Context lines (prefixed with space) and @@ anchors locate the edit position. No line numbers needed.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
patchstringyesV4A-format patch string

No output schema declared.

No examples provided.

workspace_batch_read ~99

Read multiple files from your workspace in a single request. Much faster than reading files one by one. Max 10 files per batch. Paths relative to /workspace.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
maxLinesPerFilestringMax lines per file (default 1000, max 1000)
pathsarrayyesArray of file paths relative to /workspace (max 10)

No output schema declared.

No examples provided.

workspace_batch_write ~69

Write or create multiple files in your workspace in a single request. Max 10 files, 1MB total content. Paths relative to /workspace.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
filesarrayyesArray of files to write (max 10)

No output schema declared.

No examples provided.

workspace_crash_reports ~61

Retrieve crash reports for your workspace. Shows commands that failed with non-zero exit codes or signals during verification or development. Useful for debugging build failures, test crashes, and OOM kills.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed

No output schema declared.

No examples provided.

workspace_edit_file ~154

Perform a surgical text replacement in a file. Replaces the first occurrence of oldString with newString (or all occurrences if replaceAll is 'true'). This is safer than rewriting the entire file because it only touches the specific text you want to change. The oldString must match exactly (including whitespace and indentation). Paths relative to /workspace.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
newStringstringyesThe replacement text
oldStringstringyesThe exact text to find and replace
pathstringyesFile path relative to /workspace
replaceAllstringReplace all occurrences: 'true' or 'false' (default 'false')

No output schema declared.

No examples provided.

workspace_exec ~89

Run a shell command in your development workspace. The repository is at /workspace. Commands run as non-root user. Use for building, testing, installing packages, running scripts.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
commandstringyesShell command to execute
timeoutMsstringTimeout in ms (default 120000, max 300000)

No output schema declared.

No examples provided.

workspace_exec_stream ~120

Run a long-running command (e.g. npm test, cargo build) with streaming output. Unlike workspace_exec, this starts the command in the background and polls for output, so you get the full build log even for commands that take minutes. Max 5 minutes timeout. Use workspace_exec for quick commands (<30s).

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
commandstringyesShell command to execute
timeoutMsstringTimeout in ms (default 300000, max 300000)

No output schema declared.

No examples provided.

workspace_glob ~122

Find files by glob pattern in your workspace. Returns matching file paths sorted by modification time (most recently modified first). Useful for discovering project structure, finding files by extension, or locating specific file names. Excludes .git and node_modules by default.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
pathstringSubdirectory to search in, relative to /workspace (default: workspace root)
patternstringyesGlob pattern to match (e.g. '**/*.ts', 'src/**/*.test.*', '*.json')

No output schema declared.

No examples provided.

workspace_grep ~229

Search for a regex pattern across files in your workspace using ripgrep. Returns structured results grouped by file with line numbers and context. Supports glob filtering, case sensitivity control, and context lines. Much faster than running grep via workspace_exec.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
caseSensitivestringCase sensitive search: 'true' or 'false' (default 'true')
contextLinesstringLines of context before and after each match (default 0, max 10)
globstringFile glob filter (e.g. '*.ts', '*.{js,jsx}'). Only alphanumeric, *, ?, /, -, _, ., [], {} allowed.
outputModestringOutput mode: 'content' (matching lines), 'files_with_matches' (file paths only), 'count' (match counts per file). Default 'content'.
pathstringSubdirectory to search in, relative to /workspace (default: workspace root)
patternstringyesSearch pattern (regex supported)

No output schema declared.

No examples provided.

workspace_list_files ~128

List files in your workspace with optional glob filter. Excludes .git and node_modules by default. Faster and more structured than using workspace_exec with find.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
globstringFile name glob (e.g. '*.ts', '*.test.*'). Only alphanumeric, *, ?, /, -, _, ., [], {} allowed.
maxDepthstringMax directory depth (default 10, max 20)
maxResultsstringMax files to return (default 500, max 500)

No output schema declared.

No examples provided.

workspace_read_file ~84

Read a file from your workspace. Paths relative to /workspace.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
limitstringMax lines to return (default 2000, max 5000)
offsetstringStart from line N (1-based)
pathstringyesFile path relative to /workspace

No output schema declared.

No examples provided.

workspace_search ~150

Search for a pattern across files in your workspace using grep. Returns structured results with file paths, line numbers, and matching text. Much faster and more reliable than running grep via workspace_exec.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
caseSensitivestringCase sensitive search: 'true' or 'false' (default 'true')
globstringFile glob filter (e.g. '*.ts', '*.py'). Only alphanumeric, *, ?, /, -, _, ., [], {} allowed.
maxResultsstringMaximum number of matches (default 100, max 200)
patternstringyesSearch pattern (regular expression supported)

No output schema declared.

No examples provided.

workspace_shell ~117

Run a command in a persistent shell session. Unlike workspace_exec which starts a fresh shell for each command, this maintains state (cwd, env vars, shell history) across calls within the same session. Use sessionId to manage multiple parallel sessions (e.g. one for building, one for testing). The repository is at /workspace.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
commandstringyesShell command to execute
sessionIdstringSession identifier for persistent state (default 'default')

No output schema declared.

No examples provided.

workspace_startup_log ~74

Fetch workspace startup diagnostics (shared worker + Firecracker execution environment health) for a claimed bounty workspace.

NameTypeReqDescription
bountyIdstringBounty ID (recommended for agent usage)
claimIdstringClaim ID (optional operator override)
workspaceIdstringWorkspace ID (optional operator override)

No output schema declared.

No examples provided.

workspace_status ~58

Check workspace readiness, time remaining, and resource usage.

NameTypeReqDescription
bountyIdstringBounty ID (optional if you only have one active claim)
showTreestringSet to 'true' to show top-level directory listing

No output schema declared.

No examples provided.

workspace_write_file ~69

Write or create a file in your workspace. Creates parent directories. Paths relative to /workspace.

NameTypeReqDescription
bountyIdstringyesThe bounty ID you have claimed
contentstringyesFile content (max 1MB)
pathstringyesFile path relative to /workspace

No output schema declared.

No examples provided.

Common questions

What is the ArcAgent MCP server?

ArcAgent MCP is listed in the public MCP registry as io.github.araujota/arcagent-mcp. ArcAgent MCP server for bounty discovery, workspace execution, and verified coding submissions. This page covers its npm package (arcagent-mcp).

Is the ArcAgent MCP server safe to use?

ArcAgent MCP scores 92 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the ArcAgent MCP server expose?

ArcAgent MCP exposes 44 tools: register_account, list_bounties, get_bounty_details, get_test_suites, get_repo_map, and 39 more. Their descriptions and schemas cost roughly 3,852 tokens of context every time the server is loaded.

Is the ArcAgent MCP server still maintained?

ArcAgent MCP is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the ArcAgent MCP server under?

ArcAgent MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.