# dev.bigapi/mcp (npm · @bigapi/mcp)

The output layer for AI agents: turn what an agent produced into a finished file.

- Trust score: 69/100 (medium)
- Change this week: +11
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-26

## Components

- npm · `@bigapi/mcp`: 69/100 (this document), [markdown](https://verifymcp.io/servers/dev-bigapi-mcp/bigapi-mcp.md), [page](https://verifymcp.io/servers/dev-bigapi-mcp/bigapi-mcp)

## Channel facts

- Registry: `npm`
- Package: `@bigapi/mcp`
- Version: `0.8.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-26.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 95 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 6 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1340 tokens (~268/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 2/100
  - Stability check failed: the tool surface changed between 0.3.3 and 0.8.2: 15 tool removals, 0 breaking changes, 3 additions.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the dev.bigapi/mcp server?

dev.bigapi/mcp runs locally as an npm package, launched with npx -y @bigapi/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add dev-bigapi-mcp -- npx -y @bigapi/mcp
```

### Cursor

```json
{
  "mcpServers": {
    "dev-bigapi-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@bigapi/mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "dev-bigapi-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@bigapi/mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add dev-bigapi-mcp -- npx -y @bigapi/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-bigapi-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@bigapi/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dev-bigapi-mcp --command npx --arg -y --arg @bigapi/mcp
```

### Hermes

```yaml
mcp_servers:
  dev-bigapi-mcp:
    command: "npx"
    args: ["-y", "@bigapi/mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "dev-bigapi-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@bigapi/mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add dev-bigapi-mcp -t stdio -c npx -a -y @bigapi/mcp
```

### Other

```json
{
  "mcpServers": {
    "dev-bigapi-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@bigapi/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-26 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 0 to 2.

### 2026-09-25 (score 68, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-20 (score 68, +10)

- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → 0.85

### 2026-09-19 (score 58, +4)

- [security regression] Stability: fail → unverified
- [security regression] Known CVEs: pass → unverified
- [security regression] Tool safety: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [functional regression] Schema quality: 201 → 268
- [functional regression] Schema quality: 201 → 264
- [functional regression] Capabilities: pass → unverified
- [functional regression] Dependency health: 0.85 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.8.0 → 0.8.2
- [functional] Package version: 0.8.0 → 0.8.1

### 2026-09-18 (score 54, −19)

- [security regression] Malware scan: pass → unverified
- [security regression] Stability: 0.60 → fail
- [functional regression] Schema quality: 106 → 201
- [functional improvement] Tool coverage: 16% → 100%
- [functional] Schema quality: good → excellent
- [functional] Destructive annotations: 0 → pass
- [functional] Package version: 0.7.0 → 0.8.0

### 2026-09-17 (score 73, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-16 (score 58, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-15 (score 57, +1)

- [security improvement] Malware scan: unverified → pass
- [functional regression] Schema quality: pass → fail
- [functional] Package version: 0.5.0 → 0.7.0
- [functional] Package version: 0.5.0 → 0.6.0

## MCP tools (5)

### `find_tool` (~191 tokens)

Find the right bigapi operation for a task. Describe what you need in plain words, English or German – "convert a png to webp", "remove customer names from a contract", "extract the ZUGFeRD invoice XML" – and get the matching operations with their parameters, a ready-to-run example, the price and a guide link. It recommends only: it never touches your files and never spends credit; run what it names with run_operation. Free and no API key needed, so it is also the cheapest way to see what bigapi covers. Start here whenever you are unsure which operation fits, and skip it when you already know the operation name. If nothing fits, the answer says so plainly instead of guessing.

Input parameters:

- `limit` (integer): How many candidates to return
- `query` (string, required): The task in plain words, e.g. "convert a png to webp"

### `run_operation` (~288 tokens)

Run any bigapi operation on real files: merge or redact a PDF, OCR a scan, convert an image, chunk text for embeddings, read a ZUGFeRD invoice, sign an image as AI-generated. Take the operation name from find_tool (e.g. "pdf/merge", "ocr", "text/chunk"). Uploads are local file paths. A file result is written to output_path, or to a temporary file when you omit it, and the path comes back with size and content type; a data result comes back as JSON. $0.01 per operation flat, no subscription, and failed calls cost nothing. This one executor covers every operation, including ones added after your client started – enable_tools only adds convenience wrappers around it. Files are processed in Germany, deleted right after delivery, and every operation ships with a published proof that it does what it promises.

Input parameters:

- `file_field` (string): Form field for the uploads; defaults to "files[]" for pdf/merge and "file" otherwise
- `files` (array): Local file paths to upload, in order
- `op` (string, required): Operation name or path, e.g. "pdf/merge" or "/v1/pdf/merge"
- `output_path` (string): Where to write the result
- `params` (object): Parameters of the operation, exactly as described by find_tool

### `enable_tools` (~182 tokens)

Add the dedicated tools for specific operations to this session, e.g. ["pdf_redact","ocr"], or ["all"] for every operation. bigapi starts lean – only find_tool, run_operation, get_access and get_balance are listed – so your context stays free. You rarely need this: every operation already runs through run_operation. Reach for it when you will call the same operation many times and want its parameters spelled out in your tool list. Names come from find_tool; unknown names are reported back and skipped while the rest are still enabled. The effect lasts for this session, adds to what is already enabled, and cannot be undone from here – restart the server for the lean list again.

Input parameters:

- `names` (array, required): Tool names as find_tool reports them, e.g. ["pdf_redact","ocr"], or ["all"] for the full list

### `get_access` (~162 tokens)

Get a bigapi API key for this machine. Call this once when no key is configured; other bigapi tools fail with "no API key" until you do. Creates a NEW free key (no signup, no credit card) and stores it in the local config file, where every bigapi tool picks it up. Calling it again creates an additional key rather than returning the existing one – use get_balance to check the key you already have. The new key includes 100 free operations, then $0.01 per operation from a prepaid balance; neither expires. Needs network access to api.bigapi.dev.

Input parameters:

- `name` (string): Label stored with the key so you can tell keys apart later, e.g. "claude-desktop". Cosmetic only.

### `get_balance` (~93 tokens)

Check the bigapi key that is currently configured: remaining credit, free operations left, monthly cap and spend so far this month. Read-only, free, and a snapshot of this moment – the numbers move as operations run. Use it to confirm a key works, before a large batch, or when an operation reports a low balance. It does not create keys (that is get_access) and does not list past operations.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/dev-bigapi-mcp/bigapi-mcp#diagnostics

## Score history

- 2026-09-26: 69
- 2026-09-25: 68
- 2026-09-24: 68
- 2026-09-23: 68
- 2026-09-22: 68
- 2026-09-21: 68
- 2026-09-20: 68
- 2026-09-19: 58
- 2026-09-18: 54
- 2026-09-17: 73
- 2026-09-16: 58
- 2026-09-15: 57
- 2026-09-14: 56
- 2026-09-13: 72
- 2026-09-12: 57
- 2026-09-11: 72
- 2026-09-10: 72
- 2026-09-09: 71
- 2026-09-08: 71
- 2026-09-07: 70
- 2026-09-06: 66
- 2026-09-05: 66
- 2026-09-04: 66
- 2026-09-03: 66
- 2026-09-02: 66
- 2026-09-01: 66
- 2026-08-31: 66
- 2026-08-30: 41

## Common questions

### What is the dev.bigapi/mcp server?

dev.bigapi/mcp is listed in the public MCP registry as dev.bigapi/mcp. The output layer for AI agents: turn what an agent produced into a finished file. This page covers its npm package (@bigapi/mcp).

### Is the dev.bigapi/mcp server safe to use?

dev.bigapi/mcp scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 26 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the dev.bigapi/mcp server expose?

dev.bigapi/mcp exposes 5 tools: find_tool, run_operation, enable_tools, get_access, get_balance. Their descriptions and schemas cost roughly 916 tokens of context every time the server is loaded.

### Is the dev.bigapi/mcp server still maintained?

dev.bigapi/mcp is still listed as active in the MCP registry. We last reached this channel on 26 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the dev.bigapi/mcp server under?

dev.bigapi/mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@bigapi/mcp
- Socket report: https://socket.dev/npm/package/@bigapi/mcp
- Repository: https://github.com/BiGapi-2026/bigapi-mcp
- Changelog RSS feed: https://verifymcp.io/servers/dev-bigapi-mcp/bigapi-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/dev-bigapi-mcp/bigapi-mcp.json
- HTML version of this page: https://verifymcp.io/servers/dev-bigapi-mcp/bigapi-mcp