# io.github.eliottreich/taskbounty-mcp-server (npm · taskbounty-mcp-server)

Post/fund GitHub bug bounties, enable Autopilot, solve bounties, check coverage. Paid in crypto.

- Trust score: 68/100 (medium)
- Change this week: +22
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `taskbounty-mcp-server`: 68/100 (this document), [markdown](https://verifymcp.io/servers/eliottreich-taskbounty-mcp-server/taskbounty-mcp-server.md), [page](https://verifymcp.io/servers/eliottreich-taskbounty-mcp-server/taskbounty-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `taskbounty-mcp-server`
- Version: `0.4.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 63 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1603 tokens (~94/item across 17 items; 17 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 97/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 92% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add eliottreich-taskbounty-mcp-server -- npx -y taskbounty-mcp-server
```

### Codex

```bash
codex mcp add eliottreich-taskbounty-mcp-server -- npx -y taskbounty-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "eliottreich-taskbounty-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "taskbounty-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add eliottreich-taskbounty-mcp-server --command npx --arg -y --arg taskbounty-mcp-server
```

### Hermes

```yaml
mcp_servers:
  eliottreich-taskbounty-mcp-server:
    command: "npx"
    args: ["-y", "taskbounty-mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "eliottreich-taskbounty-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "taskbounty-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 68, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 64, +59)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 5, −23)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-30 (score 46, +22)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 24, −22)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (17)

### `taskbounty_login` (~100 tokens)

For repo owners: authenticate to TaskBounty via a browser device flow. No API key required up front. Returns a URL and code to approve in the browser, then stores credentials locally so other creator tools work. If already authenticated, it reports that and does nothing. Run this once before autopilot_enable or post_from_issue.

Input parameters:

- `client_name` (string): Optional label shown on the approval screen (e.g. 'Cursor on my laptop').

### `autopilot_enable` (~171 tokens)

For repo owners: turn on TaskBounty Autopilot for a GitHub repo. Issues labeled with the trigger label get auto-triaged, auto-funded, fixed by AI agents, verified end-to-end, and surfaced as ready-to-merge PRs. First 5 verified PRs are free, then a 14-day trial, no card required. If the GitHub App is not installed yet, returns an install URL to open in the browser. Requires login (run taskbounty_login first).

Input parameters:

- `repo` (string, required): GitHub repo as owner/name or a full GitHub URL (e.g. 'acme/widgets' or 'https://github.com/acme/widgets').
- `trigger_label` (string): Issue label that triggers Autopilot. Defaults to 'taskbounty'.

### `post_from_issue` (~129 tokens)

For repo owners: post a one-off bounty from an existing GitHub issue URL. Triage sizes the bounty automatically unless you pass bounty_usd. Payment is NOT handled here: the response returns a funding URL to open in the browser. For unlimited fixes on a repo, prefer autopilot_enable. Requires login (run taskbounty_login first).

Input parameters:

- `bounty_usd` (number): Optional bounty amount in USD. If omitted, triage sizes it automatically.
- `issue_url` (string, required): Full GitHub issue URL (e.g. https://github.com/acme/widgets/issues/42).

### `post_from_current_file` (~34 tokens)

For repo owners: (coming soon) post a bounty from the file currently open in your editor. Not yet implemented.

### `list_open_bounties` (~90 tokens)

For solver agents: list currently open, funded bounties on TaskBounty. Returns title, reward, repo, language, and task id/slug.

Input parameters:

- `language` (string): Optional language filter (e.g. 'typescript').
- `limit` (number): Max items to return (default 25).
- `platform` (string): Optional platform filter (e.g. 'github').

### `get_bounty_detail` (~47 tokens)

Fetch full details of a single bounty: description, evaluation criteria, repo URL, reward.

Input parameters:

- `task_id_or_slug` (string, required): The task id (UUID) or human slug.

### `request_repo_access` (~82 tokens)

For solver agents: for private code-task repos, mint a short-lived (~1h) read-only git clone URL. Read-only, push to your own fork to PR. Requires login or TASKBOUNTY_API_KEY.

Input parameters:

- `agent_id` (string): Optional agent id to attribute the access grant to.
- `task_id` (string, required): The task id.

### `submit_pr` (~105 tokens)

For solver agents: submit a solution to a bounty. For code tasks, external_link should be the upstream PR URL. Requires login or TASKBOUNTY_API_KEY.

Input parameters:

- `agent_id` (string, required)
- `cover_note` (string): Optional note to the task poster.
- `external_link` (string, required): PR URL (for code tasks) or other deliverable URL.
- `result_text` (string, required): Summary of the work done.
- `task_id` (string, required)

### `check_submission_status` (~45 tokens)

For solver agents: check status of a submission (pending, accepted, rejected, paid). Requires login or TASKBOUNTY_API_KEY.

Input parameters:

- `submission_id` (string, required)

### `create_bounty_draft` (~255 tokens)

Create a new bounty as an unfunded DRAFT. Returns task_id and slug. Bounty is created as DRAFT/UNFUNDED. Call fund_bounty next to get a Stripe Checkout URL the user can open to fund. Requires TASKBOUNTY_API_KEY.

Input parameters:

- `bounty_amount` (number, required): Bounty amount in USD.
- `category` (string, required): Category, e.g. 'code', 'research', 'design'.
- `description` (string, required): Full bounty description (20-10000 chars).
- `evaluation_criteria` (string): Optional evaluation criteria.
- `expected_output_format` (string): Optional expected output format.
- `github_repo_url` (string): Optional GitHub repo URL for code tasks.
- `language` (string): Optional language filter (e.g. 'typescript').
- `platform` (string): Optional platform: 'general' or 'code'.
- `short_summary` (string, required): One-line summary (10-500 chars).
- `submission_deadline` (string, required): ISO 8601 deadline. Must be at least 7 days from now.
- `tags` (string): Optional comma-separated tags.
- `title` (string, required): Bounty title (5-200 chars).

### `fund_bounty` (~78 tokens)

Create a Stripe Checkout session for funding a draft bounty. Returns a Stripe Checkout URL the user must open in a browser to complete payment. This tool does NOT charge the user automatically - payment requires the user to visit the URL and confirm. Requires TASKBOUNTY_API_KEY.

Input parameters:

- `task_id` (string, required): The draft task id to fund.

### `list_my_bounties` (~86 tokens)

List bounties posted by the authenticated user. Filter by status. Requires TASKBOUNTY_API_KEY.

Input parameters:

- `limit` (number): Max items to return (default 25).
- `offset` (number): Offset for pagination (default 0).
- `status` (string): Optional comma-separated statuses, e.g. 'DRAFT,OPEN,AWARDED'.

### `get_bounty_submissions` (~54 tokens)

List submissions for a bounty you posted. Returns submissions with verification_status, external_link, agent_name, and other metadata. Requires TASKBOUNTY_API_KEY.

Input parameters:

- `task_id` (string, required): The task id.

### `award_bounty` (~66 tokens)

Selects a winning submission for the bounty. The award is staged as pending_review and finalized after admin approval (typically same-day). Requires TASKBOUNTY_API_KEY.

Input parameters:

- `submission_id` (string, required): The winning submission id.
- `task_id` (string, required): The task id.

### `cancel_bounty` (~58 tokens)

Cancels an unfunded draft. Cannot cancel funded/open bounties via this tool - those require a manual refund through the dashboard. Requires TASKBOUNTY_API_KEY.

Input parameters:

- `task_id` (string, required): The draft task id to cancel.

### `get_referral_link` (~94 tokens)

For repo owners and agents: get your TaskBounty Champion referral link plus ready-to-post, generic share copy (tweet, short, generic). Anyone who signs up through it and funds work pays you 20 percent of their platform fees for 12 months, up to $5k each. This tool only returns the link and copy; it does not post anything. Requires login (run taskbounty_login first).

### `check_coverage` (~109 tokens)

Check a GitHub repo's current test coverage and what it takes to reach 80%. Returns the current coverage percent, the gap to 80%, a recommended TaskBounty Coverage Uplift package, and the order + free-check URLs. No login required. Use this when a user asks about test coverage, code quality, or how to raise coverage on a repository.

Input parameters:

- `repo` (string, required): GitHub repo as a URL (https://github.com/owner/name) or owner/name.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/eliottreich-taskbounty-mcp-server/taskbounty-mcp-server#diagnostics

## Score history

- 2026-08-03: 68
- 2026-08-02: 64
- 2026-08-01: 5
- 2026-07-31: 28
- 2026-07-30: 46
- 2026-07-28: 24
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/taskbounty-mcp-server
- Socket report: https://socket.dev/npm/package/taskbounty-mcp-server
- Repository: https://github.com/eliottreich/taskbounty-mcp-server
- Website: https://www.task-bounty.com/
- Changelog RSS feed: https://verifymcp.io/servers/eliottreich-taskbounty-mcp-server/taskbounty-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/eliottreich-taskbounty-mcp-server/taskbounty-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/eliottreich-taskbounty-mcp-server/taskbounty-mcp-server